Celsius Transaction Data Exposure Ignites Calls For Conversation Around Web3 Privacy

The crypto community is in uproar over the recent news that the beleaguered DeFi protocol Celsius Finance has revealed the wallet addresses and transaction details of thousands of its users in a court filing. 

The filing was submitted to a judge last week as part of bankruptcy proceedings involving Celsius. It contains more than 14,500 pages listing the financial transactions of its entire user base, including those of its founders Alex Mashinsky, Dan Leon and Nuke Goldstein. In addition, customer names, transaction dates, account types, assets and other information is included in the disclosure, as well as the amounts send. 

Celsius did at least redact the addresses of its users in the submitted documents, but the crypto community was quick to voice its dismay on Twitter, warning that many of Celsius’s users could end up being “doxxed” if hackers are able to link the exposed accounts to an individual.

“The @CelsiusNetwork bankruptcy court filing is the worst breach of user #privacy in #web3 history. Over 14,000 pages of identifiable user information and transaction history,” said Manta Network co-founder Kenny Li in a tweet. 

The crypto community is rightly concerned that the data from Celsius can be used to shed light on each user’s financial details. In some cases, observers may even be able to analyze the blockchain and de-anonymize some on-chain addresses, linking the transactions to well-known users in the crypto space. Given that danger, it seems that the filing could well go down as one of the biggest breachers of user privacy in history. 

Of particular concern is that Celsius user’s names were not redacted in the filing. According to reports, U.S. bankruptcy court trustee William Harrington objected to a request from Celsisu that customer’s names be redacted. He responded that there’s a need to be “open and transparent” and added that Celsius should demonstrate “extraordinary circumstances” and a “compelling need” to obtain protection to justify such a request. 

Twitter user @hdevalence commented that it would be a fairly simple task for any determined actor to piece together the details to identify Celsius’s user base. “[It] seems like, among other things, anyone can now dox all the on-chain activity and addresses of any named celsius user, by matching the dates and exact amounts to transaction data,” he said. 

No Turning Back

The expose ignited a strong rant from Manta’s Kenny Li, who explained that all of the transaction information can now be cross-referenced on-chain, leading to the doxxing of countless wallets and financial information of Celsius’s users.

“Victims of this release are already starting to voice their concern, but it’s already too late,” Li stated. “Once your #privacy is compromised, there’s no turning back. The documents are online, and exploiters are already hard at work. Victims can only watch and hope for the best.”

Unfortunately Li is right in that there’s little that anyone can do to erase what has happened, short of changing their legal name or moving to a new house. There are however some measures users may be able to take to mitigate the threat of being doxxed. For instance, they can join a service such as CoinJoin to hide the source of their funds in future transactions. What this does is it makes it impossible to see any future transactions coming from a doxxed wallet address, though it does little to prevent users from following their earlier history. A service such as PayJoins can also help to break the heuristics that bad actors rely on to infer details from on-chain data. 

Going forward, users could also use a service such as Li’s Manta, which is a tool that works by obfuscating wallet addresses and transaction amounts so these aren’t published on-chain. In that way, a user’s details won’t be exposed in the event of a future breach. 

Privacy Must Be Taken Seriously

More importantly perhaps, the Celsius breach highlights the need for data to be treated as the extremely valuable commodity that it is. Just like our finances, our data must be subject to the strongest-possible security measures to ensure it doesn’t fall into the wrong hands. 

Li called for more discussion around on-chain security, saying the Celsius breach was the direct result of ignorance. While lawmakers have good intentions, they fail to understand the consequences of these kinds of actions, he said, because they fail to understand how Web3 works in practice. 

“Much of the conversation around #web3 privacy is driven by people who don’t understand the space and can’t look beyond its primitive, outlier uses,” Li continued.

“The narrative of “if you want privacy you must have something to hide” or “oh you must be a money launderer” must change. We need to elevate the conversation around on-chain privacy because solutions are undeniably needed to prevent this and even worse attacks in the future.” 

While lawmakers and governments fail to recognize the importance of Web3 privacy today, users themselves have every incentive to take back ownership of their data and reclaim their privacy.