- Celsius produced a trove of documents this week containing creditor information that has some worried they may be left vulnerable to cyber threats.
- Celsius and the creditor committee both sought to shield this information in recent weeks, presenting arguments multiple times before the judge.
- The judge ultimately would allow the redacting of customer addresses, but not their names.
Celsius filed a trove of documents this week containing users’ names and information about certain transactions, setting off a wave of concern among some creditors, despite the disclosure of such information being an expected part of the Chapter 11 bankruptcy process.
Transparency has been at the heart of the Chapter 11 case, with creditors calling for more insight into the company’s financials and its executives in the lead-up to the firm’s collapse. Now, some creditors are finding that the transparency baked into the bankruptcy process has drawbacks for crypto users.
More than 14,000 pages of documents hit the docket this week in the form of financial statements and schedules. That included a statement of assets and liabilities, which contains the names of creditors and the amounts they’re set to claim from Celsius. Also included are statements of financial affairs, which contain the transactions that occurred on the platform in the past 90 days with usernames, dates and the transactions on those dates. Those documents allow insight into financial moves made by executives in the lead-up to the firm’s collapse, and they also reveal the moves of customers.
Some worried that data breaches or leaks from other firms combined with the now-public information from Celsius could leave users vulnerable to doxxing, hacks or other cyber threats. There are merits to those concerns, said Beth Bisbee, director of investigation solutions at Chainalysis.
“It definitely does highlight the concern of connecting off-chain data to on-chain data when breaches occur to centralized platforms providing services to decentralized networks.”
While there may be real threats, they may be the trade-off for an open and transparent bankruptcy process.
Attempts to redact
When the filings hit the docket, some speculated counsel had made a mistake by publicly revealing the names of users or engaged in some kind of leak. However, a squabble over the issue had already played out in recent hearings, one that saw the creditor committee and Celsius argue the names should be redacted to protect customer identities and touching on many of the concerns that users would express once the information became public. The government representative in the case pushed back. Ultimately, Chief Bankruptcy Judge Martin Glenn disagreed, compelling Celsius to include the information in the final filings.
Glenn had made it clear as early as Sept. 1 that while he was willing to redact address information in the financial schedules, he was reluctant to redact names.
“I’m not going to allow anonymous proofs of claim, I can tell you right now,” Glenn said during the Sept. 1 hearing in the U.S. Bankruptcy Court for the Southern District of New York. He would hear arguments on the issue multiple times before handing down his opinion on Sept. 28.
In most bankruptcy processes, creditors must be identifiable in order to make claims to the estate. To claim funds, creditors have to prove the funds belong to them and they are who they say they are. A transparent process usually means disclosing who your creditors are and how much you owe them, according to Rick Hyman, a partner at Crowell & Moring, who has represented a number of lenders in Chapter 11 proceedings.
“It’s a fundamental principle of U.S. bankruptcy law that there is full disclosure,” Hyman said. “Full disclosure includes not just information that is essential to the debtors’ operations, but also to the identity of the creditors.”
To address that issue, Celsius’ counsel filed a motion to redact customer names in this case in early August, arguing the disclosure could leave customers open to cyber threats. “The Debtor’s ability to continue to protect customers’ personal information is critical to maintaining their customers’ continued safety, loyalty, and business,” the filing said.
“Furthermore, like many individuals who invest in cryptocurrencies, the Debtors’ customers are particularly concerned with the security and privacy of their personally identifiable information because disclosure of such information could potentially result in a customer becoming the target of identity theft, blackmail, harassment, stalking, and doxing,” Celsius’ counsel argued in the August filing.
The creditor committee filed its support for Celsius’ motion on Sept. 12, after the government’s Office of the U.S. Trustee filed an objection to the request. In that objection, the government argued that disclosure is the backbone of the bankruptcy process since it provides the necessary transparency to evaluate the business and foster communication between parties.
However, Celsius may have had plans for an alternative mode of identifying creditors. During one hearing, Celsius’ counsel said it intended to propose a new process of making a claim in later filings that would lay out the claims process. At that time, the firm’s lawyers told the judge that the process could include issuing a string of characters to customers that they could use to identify their claim in the public documents. However, they’d never get to formally file that plan.
While Glenn was amenable to redacting address information to protect customers, his order ultimately wouldn’t allow for the redaction of names, saying Celsius hadn’t proved there was significant danger to naming account holders and the names couldn’t be redacted under a statute protecting commercial information.
“Identifying the individual account holders by name, without physical and email addresses, is insufficient information to expose customers to risks of identity theft or personal danger,” according to his opinion accompanying the order. “Sealing information such as that sought by the Debtors from public disclosure risks transforming the open and transparent bankruptcy process into something very different, which the Court is loath to do without a strong showing of real and not speculative risks.”
“Moving forward @CelsiusUcc will continue to work to protect account holder privacy in light of the recent court-ordered disclosure of account holder names and balances,” the creditor committee tweeted.
This article was originally published on theblock.co