600k+ Celsius customer crypto-coin records revealed

And why it's not actually a leak

Documents filed in crypto lender Celsius Networks' bankruptcy case have revealed financial info on more than 600,000 users.

The massive document set [PDF, see page 34] contains the names of hundreds of thousands of Celsius customers, along with the types and amounts of transactions they performed with Celsius – such as deposits, withdrawals, and interest earned – and a few other bits of metadata. Which is a little awkward for the privacy-obsessed world of cryptocurrency.

This isn't a leak, though. The paperwork containing the info was a statement of financial affairs Celsius filed in court last week; specifically, details of "payments or transfers to creditors" in the three months to the start of bankruptcy proceedings. This isn't out of the ordinary for Chapter 11 bankruptcy cases in the United States, which as The Block explained over the weekend, work on the principle of full disclosure.

The argument goes that transparency is key when it comes to handling claims by potential creditors: the organization's financial affairs need to be opened up, hence the filing.

Along with those customer records, the documents submitted in the case include extensive info on the dealings of Celsius executives, including ex-CEO Alex Mashinsky who cashed out $10 million in crypto-assets from the biz in May before Celsius froze withdrawals for ordinary users in June. 

Mashinsky quit the biz at the end of September. 

The release of thousands of pages of transactions won't be much comfort for those creditors who said in letters sent to the judge in the case they have been feeling betrayed and hopeless.

To Celsius' credit, the company's lawyers did file a motion [PDF] asking to have personal information, such as people's addresses, redacted from the financial affairs filing "to protect those individuals' personally identifiable information and avoid potential unnecessary harm to those individuals." 

The US trustee for the case, William Harrington, objected to Celsius' redaction motion [PDF]. Harrington argued that disclosure is necessary in bankruptcy proceedings to avoid any and all suggestions of impropriety. 

"This is particularly important in these cases, wherein the lack of transparency has led to extreme creditor and customer distrust in the [Celsius] … If the Motion is granted, the ability of interested parties to evaluate [Celsius] and their bankruptcy process and to communicate and find each other will be significantly curtailed," Harrington argued. 

The judge's response [PDF] to Celsius' request was to grant a part of it, allowing the redaction of home and email addresses of individual customers. The judge noted that Celsius also requested the blocking of the names of individual and business creditors, as well as business creditors' email and physical addresses, all of which were denied.

"The strong public policy of transparency and public disclosure in bankruptcy cases requires very narrow exceptions and only on strong evidentiary showings. The court concludes that the Debtors' evidentiary showing is insufficient to justify the wholesale sealing of creditors identities," Chief US Bankruptcy Judge Martin Glenn wrote in his opinion. 

Lest the goodwill of Celsius in protecting its customers is assumed, it's worth noting that Judge Glenn said one of Celsius' arguments for redaction was the value of such information for competitors. According to the chief judge, Celsius had previously argued that the list had value in a future potential asset sale, and would lose value if released in full.

All that customer data was collected by Celsius due to "know your customer" (KYC) regulations. KYC rules require financial orgs to vet customers to validate their identities, which has resulted in cryptocurrency exchanges maintaining records that link people to their wallets. 

KYC has been a bugbear to some in the crypto industry, who see it as antithetical to the decentralized nature of digicash. As Coindesk points out, most crypto exchanges have been forced to adapt to KYC, resulting in the storage of customer records like those revealed in the Celsius case.

Finally, we note that someone made a website that attempted to make the Celsius data searchable, however its figures don't seem to line up with the court paperwork. So if you do happen across it, you might want to double check the claims. ®


Similar topics


Send us news

Other stories you might like