600k+ Celsius customer crypto information exposed in court case • The Register

Documents filed in crypto lender Celsius Networks’ bankruptcy case have revealed the financial information of more than 600,000 users.

The massive document set [PDF, see page 34] contains the names of hundreds of thousands of Celsius customers, along with the types and amounts of transactions they made with Celsius—such as deposits, withdrawals, and interest earned—and a few other bits of metadata. Which is a little difficult for the privacy-obsessed world of cryptocurrency.

However, this is not a leak. The paperwork containing the information was a statement of financial affairs Celsius filed in court last week; specifically, details of “payments or transfers to creditors” during the three months before bankruptcy proceedings begin. This is not out of the ordinary for Chapter 11 bankruptcy cases in the US, which, as The Block explained over the weekend, work on the principle of full disclosure.

The argument goes that transparency is key when it comes to dealing with claims from potential creditors: the organisation’s financial affairs must be opened up, hence the filing.

Along with those customer records, the documents filed in the case include extensive information about the dealings of Celsius executives, including ex-CEO Alex Mashinsky who cashed out $10 million in crypto assets from the biz in May before Celsius froze withdrawals for regular users in June.

Mashinsky left the industry at the end of September.

The release of thousands of pages of transactions will not be much comfort to those creditors who said in letter sent to the judge in case they have felt betrayed and hopeless.

To Celsius’ credit, the company’s lawyers have filed a lawsuit [PDF] requests that personal information, such as people’s addresses, be removed from the financial archive “to protect those individuals’ personally identifiable information and avoid potential unnecessary harm to those individuals.”

The American trustee for the case, William Harrington, objected to Celsius’ editorial proposal [PDF]. Harrington argued that disclosure is necessary in bankruptcy proceedings to avoid any suggestion of impropriety.

“This is particularly important in these cases, where the lack of transparency has led to extreme creditor and customer distrust of [Celsius] … If the proposal is granted, the ability of interested parties to assess [Celsius] and their bankruptcy process and communicating and finding each other will be significantly limited,” Harrington argued.

The judge’s response [PDF] to Celsius’ request was to grant part of it so that home and email addresses of individual customers could be redacted. The judge noted that Celsius also asked to block the names of individual and corporate creditors, as well as corporate creditors’ email and physical addresses, all of which were denied.

“The strong public policy of openness and public disclosure in bankruptcy cases requires very narrow exceptions and only on strong evidence. The court concludes that the debtors’ evidence is insufficient to justify the wholesale sealing of creditor identities,” says US Bankruptcy Judge Martin. Glenn wrote in his opinion.

Lest Celsius’ benevolence to protect its customers be assumed, it is worth noting that Judge Glenn said that one of Celsius’ arguments for redaction was the value of such information to competitors. According to the Chief Justice, Celsius had previously argued that the list had value in a future potential asset sale, and would lose value if released in its entirety.

All customer data was collected by Celsius due to “know your customer” (KYC) regulations. KYC rules require financial organizations to vet customers to validate their identity, which has resulted in cryptocurrency exchanges maintaining records linking people to their wallets.

KYC has been a bugbear for some in the crypto industry, who see it as antithetical to the decentralized nature of digicash. As Coindesk points out, most crypto exchanges have been forced to adapt to KYC, resulting in the storage of customer records like those exposed in the Celsius case.

Finally, we note that someone created a website that attempted to make the Celsius data searchable, but the numbers don’t seem to match the court papers. So if you come across it, you might want to double check the claims. ®