Hacker News new | past | comments | ask | show | jobs | submit login
Celsius exposes the names of all customers (web3isgoinggreat.com)
148 points by wslh on Oct 7, 2022 | hide | past | favorite | 78 comments



During the real estate bubble of the 70s and 80s in Japan, there was a type of Real Estate property that involved selling small parcels of land in forests that had no roads coming to them. This was called 原野商法, and in an era with a serious real estate bubble and before Google Maps existed, there were many people who were conned by these ads - and not for small amounts of money.

Now, many years later, many people are still hanging onto the properties and are unable to unload them as they cannot conceive that their holdings are worthless. The shady RE companies sold their information (or passed it along within their 'organization') and the land purchasers are now preyed upon again; this time, by scammers who claim they can sell the property (but require a ~$3000 payment in advance).

This PDF is the crypto equivalent of that forest land buyers list, and everyone on it can look forward to being preyed upon for the rest of their life.

(Here is a great video about the whole sordid thing, Japanese only though https://www.youtube.com/watch?v=TPzTDRmtozc)


The same story played out in Florida only for uninhabitable swamp land, must be a common scam throughout the world. https://en.m.wikipedia.org/wiki/Swampland_in_Florida


Also, "souvenir plots" in Scotland (and accompanying laird title):

https://en.wikipedia.org/wiki/Laird#Souvenir_plots_and_false...


A bit different as people never buy the land officially (as in its not registered the Scottish official records). Every single one of these title sellers just pinky promise to keep a record of your ownership of their land and respect that it is yours.


>A bit different as people never buy the land officially (as in its not registered the Scottish official records).

Sure, much different also given that the money involved is much less, still a good proxy for gullibility.


Not really. The Japanese thing is an investment scam. The Scottish think is somewhat transparent that your little plot of land is mostly symbolic. And literally noone buys the souvenir land as an investment. Its bought for the glossy certificates to gift that uncle that claim to be three-seventh Scottish.


> that uncle that claim to be three-seventh Scottish

Bit of an aside, but I find it odd how hostile people are to Americans retaining any connection to their European ancestry.

If I tell people I'm half-Indian and half-Persian nobody bats an eye. If my wife tells people she's half-Irish and half-Czech she gets treated like she's not supposed to have any heritage or culture other than whatever people imagine as "white American".


I am not sure to understand, in which way is she (mis-)treated?


One of the most prominent of these "laird" title providers switched from a scam for gullible people to green activities (saving unused plot of lands, re-creating wild-life habitats and similar) and now they make clear that the title is not worth the paper it is printed on and only a gadget, but a few years ago they promoted the whole stuff and people fell for it (just like they are falling for it now after the "greenwashing").

Lord Hicks of Lochaber would like to have a word with you:

https://www.dailyrecord.co.uk/news/scottish-news/essex-firem...


I understand it's common for scammers to follow this route. With the modern "tech support" telephone scams, they apparently do the same thing, and if the first wave has scammed you out of money, you'll get multiple additional waves that'll either try different scams, or build upon the first one and pretend to be a police investigator etc.

It's strange to me that there aren't more coordinated investigations. Individually, these will often be smaller sums, nothing that'll justify international police actions, but collectively the damage is huge. Even just one gang will reach millions of USD. They're not criminal master minds, Youtubers are able to track them down.


In France, if you have an inaccessible land, either:

- it's surrounded by private property, and the neighbor must offer some sort of passage through their land to yours. If it's a field, it does mean to destroy permanently part of it so you can go through.

- it has at least one border with public property, and the state must provide a real asphalt road to access it.

However, you are left to organize traversal of your own land, so if your house is deep inside it, you get to pay. And of course, getting power lines and water pipes connected to it is still 100% at your charge.


This is one of the most interesting comments I've encountered on HN. Thanks!


Now they may be able to monetize these as collectors' items by turning them into NFTs.


I just downloaded the legal PDF, opened it up in Preview (took a few minutes) and then did a search for my full name (also took a few minutes). Yup, there I am... All my transactions (amounts and dates). WTF? Why didn't they redact names? This is a leak of personal information right?


I'm sure this list will be not be used by totally scrupulous people to target people of modest skepticism.


Where can I find the PDF?

EDIT: Nevermind, found it [0]

[0] https://ia601401.us.archive.org/28/items/celsius/celsius.pdf



Is there a version of this searchable online?


Download and type `grep -i 'name' celsius.txt`


Weird, I didn't find myself in there. Could it be only there American customers? Or only people that had still outstanding balances? Only had some yield pending.


Its also only april and may transactions it seems


OP's link is "Certain payments or transfers to creditors within 90 days before filing this case".

These _could_ be clawed back by the trustee to increase recoveries for all creditors. They might go after large amounts.

The 1400pg listing of "Non‐Priority Unsecured Retail Customer Claims" and amounts is here:

https://cases.stretto.com/public/x191/11749/CORRESPONDENCE/1...

(As I understand it, as Celsius made interest payments, pretty much every retail claimant got some kind of payment in the 90 days before bankruptcy, so the names almost entirely overlap)


This just has the “a” names, what is the Stretto link for the rest? The document linked for that doc number in my email from Stretto is only 108pgs long…


Bankruptcy is a public process. Unsure if a judge can override that.

In Canada the bankruptcy judge can and hide creditors (and the quadrigacx creditors are almost all unpublished).

Not sure if the US judge decided not to, couldn't, or nobody asked so they couldn't decide.


Bankruptcy is a public process for the entity going bankrupt. I'm not aware of any modern financial or services industry bankruptcy that resulted in the company publishing its entire customer list during legal proceedings.

This seems like a straightforward legal cock-up.


Creditors are usually published by the trustee. End-consumers can be a toss-up.

Lehman Brothers just finished up it’s liquidation after 14 years. It’s trustee listed all its creditor claimants’ names and addresses and their claimed amounts, even if it’s just a few bucks.


Well, they just painted targets on peoples back. Attackers are going to run this pdf through code, and target people who have large balances and lot's of transactions. Attackers will have first and last names, that's all they need now a day.


This is burying the lede here, which is that you can correlate the transactions to on-chain data to dox customer addresses and transactions.


This is exatly the problem with pseudoanonimity. The moment you start tracking actions with unique identifiers, even if those identifers are not connected to real names initially, you're opening a big box of privacy no-nos.

You just need one instance where you can connect a pseudonymous identifier to a real person, and boom, you have the whole history and future right there.


This was bound to happen the moment they decided to use a public ledger system to make transactions.


yeah, that’s true, requires a little scripting

but I’ve always found it easy to find an individual based on an amount a range of dates (with a bonus of knowing probable destinations)

not interested in that but yeah its there


Also other leaks that had names and addresses but not amounts.


Customer names were already published a while ago as one of the bankruptcy documents. Recent transactions is something new and suspicious.


For others wonder what's this about, Celsius is a bitcoin lending / savings company apparently.


I thought crypto meant sophisticated cryptography would prevent people you don't trust from spending all your money, and from people knowing who you are and how you spend your money.


Cryptos were *Catch-22* created without understanding the real problem, why centralized institutions are there, and naively thought fraud was all about trustworthy of the records.

So they made the ledgers open and let *ALL participants* run the same calculation at the same time with a fancy name Proof-of-Work. So with some easy cross ref you can easily find out exactly who did what and own how much etc.. Dumb huh? But it doesn't end there. Soon the participants realized they could not trust their counter parties. In a scenario that someone trade his/her crypto for fiat money(let's say money from now on) is not guaranteed to receive the money after the cryto transferred out or vice versa as transfer of crypto and transfer of money are two separate processes and none one can make sure both to happen as intended.

So the exchanges came into play. But wait, weren't they the centralized institutions crytos aimed to remove? Decentralize by centralizing but with almost no regulations. I cannot find anything better for frauds.


Yes, so apparently our societies necessitate a level of trust demonstrated by the prevalence of centralised exchanges:

Technology is difficult, and we outsource the management massively.

---

I once found a locked iPhone and tried to give it back to the owner by asking Siri to dial random sound bits (I didn't know about "ICE"). The first two people in the person's phone books were super sketchy people who claimed it was their phone, and when I asked what number they were calling from, started walking sideways in the conversation. Social recovery wallets are great if you have trustworthy friends. ;-)


"Crypto" is named for the use of public/private keys for receiving/sending, and maybe also for the hashing algorithms in Proof of Work.

For most cryptocurrencies (including Bitcoin and Ethereum) it is trivial to calculate someone's balance if you know their public key (aka wallet address). Someone can maintain multiple wallets for privacy, but transactions between them (directly or indirectly) can be used to correlate and find the source of funds. This is why bitcoin mixers[1] exist.

There's a whole bunch of so-called "privacy coins" that attempt to address these issues and others (e.g. by making it harder to tell which IPs transactions are broadcast from).

[1] https://techcrunch.com/2022/08/12/suspected-tornado-cash-dev...


> There's a whole bunch of so-called "privacy coins" that attempt to address these issues and others.

Why do you say "so-called"?


To start off, I'm trying to be unbiased here, but I am generally anti-"crypto", nonetheless here goes:

I obviously can't speak to OP's view, but in general the privacy coins are all small bit players. Because of that they are vulnerable to 51% attacks, this _can_ happen as the first google hit I did just now so that I could appear smart and knowledgeable :D : https://www.coindesk.com/markets/2020/11/08/privacy-coin-gri...

How practical such an attack would be on the bigger networks I don't know, there were a couple of February ones saying monero was at risk, but I have no idea how plausible that would actually be.

I would also consider smaller coins more likely to run into transaction correlation simply due to volume - I really don't know how secure the coins are if there are few participants, but if it's a small network looking for 10btc/eth transfer with a corresponding transaction in the small network, and then a later transaction back, doesn't seem implausible. My thinking here is purely along the lines of "imagine a mixer that only has 1 participant", that's obviously going to achieve nothing, but how many participants are needed before it stops being useless?


Good question. Avoiding blanket endorsement/nudging people to do their own research, I guess.


This, as usual, was your crypto being held by someone else. That’s why people say "not your keys, not your crypto"


You thought right, but the people affected were using a centralized financial institution called Celsius, which collected their PII and held custody of their crypto and fiat. They leaked (actually the court) this information, not a blockchain or a specific cryptocurrency network.

You cannot expect privacy with cryptocurrencies when you renounce to it voluntarily by doing this.

In addition leaks of this kind when it comes to credit card numbers and other sensitive financial information are not very rare unfortunately, hopefully you express the same concern when it happens to millions of people every year.


To be fair to them, it was the court that compelled them to do this. They didn't choose to do it.


I wonder if asking European GDPR bodies to penalize US court for forcing someone to publish private data of EU citizens would generate a response.


What would this "penalize" US court look like?

And what do you think the US reaction to something like that would be?


> What would this "penalize" US court look like?

Asking them to pay a fine, ultimately backed by the threat of perhaps imposing tarrifs or seizing their assets in the EU.

> And what do you think the US reaction to something like that would be?

It would be negotiated, there would be a line in some treaty somewhere, most likely a fraction of a percent in the next trade deal.

Yes, the US is the mightiest country around, but that doesn't mean it can act with complete impunity. Publishing EU citizens' details without due process or compensation is no different from e.g. seizing the assets of an EU company without due process or compensation - something which would and should trigger a diplomatic protest.


Your statement is fantasyland. It’s absolutely legal in the US to publish “EU citizens’ details”! It’s not a crime, and it’s not even against the GDPR at all.

The GDPR is explicitly about EU companies (or American companies with EU subsidiaries) that have EU-based customer data. An American bankruptcy court, or any kind of court, is not an EU company, or any kind of company.


Article 2

> This Regulation does not apply to the processing of personal data: in the course of an activity which falls outside the scope of Union law;

Article 3

> This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

Article 4

> ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

It is about data controllers, not companies - independent of the location of the controller. Celsius might be in the clear due to Article 2 (IANAL), but GDPR definitely applies to data controllers who have no EU subsidiaries irrespective of whether they are a company.


GDPR is absolutely unenforceable in cases where the data controller has no presence in the EU.

The EU can scream all they want, but they have no recourse whatsoever.

Also, extraterritoriality is ass.


The EU has armies and navies, they have recourse if they care enough.


Surely you’re not serious, and even if you were serious, you probably know full and well that only the United States can get away with that kind of behaviour...


It's unlikely to come to that, but that's the underlying foundation of why the US can't (and doesn't) ignore the EU with complete impunity.


Celsius is failing art 3 but court procedures usually fall outside of GDPR


I don't think this goes against GDPR. There is legitimate reasons to handle and even publish this list.

Now holding to this list or using it for unrelated purpose would go against GDRP.


Why would they have any jurisdiction over a US court?


GDPR applies to companies doing business in Europe.

An American court is neither a company nor in Europe.


No, the GDPR applies to processing or control of personal data of EU citizens. There's even an explicit "what about if neither of those are in the EU(not Europe):

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.

https://gdpr-info.eu/art-3-gdpr/

I'm not sure an American court fits either of those conditions, but it's absolutely not limited to companies doing business in Europe.


They can claim extraterritoriality all they want, but they have no recourse whasoever if the data controller or processor has no presence in the EU.

What are they going to do? Send them a mean letter?


Not sure where you read that it only applies to companies - certainly not in the GDPR itself. It also applies to public entities - courts, government agencies, etc.

It wouldn't apply in this case due to other reasons though.


GDPR applies to doing business with EU citizens. That's why a US company like Meta can be held responsible for data stored in the US if it's about EU subjects.


Putting aside the fact that a US court is not a company doing business, the distinction still seems sort of academic. Of course the EU can pass whatever laws they want, but entities doing business with EU citizens, which don't have a presence inside the EU, will be hard to prosecute in EU courts.


name and shame everyone using UST? The Luna product

because I was scrolling through it and that gave me a chuckle. But its hard to know who was just a degen versus who was gullible and undiscerning.


I know the CTO personally, and he still has "laser eyes" & HODL t-shirt in his FB profile..


Well ironically enough, if their customers followed this advice (HODL) and and didn't give custody of their funds to pretty much a bank, they would still have these funds.

Also, individuals can hold jobs/positions which are not congruent with their beliefs... usually it doesn't last for a whole career (as it does take a toll on mental health). If you have worked in finance you will certainly know what I am talking about.


What is the actual Stretto link? The only document 974 I can find in my email is 108 pgs long. The link below is only for all the “a” names…


Nice, a list of people (marks) who think a 15% yield is reasonable. If I was a scammer that preyed on gullible people, this list would be a goldmine.


The IRS and law enforcement will have a field day with this. They can match up transactions to the blockchain to unmask owners.


Yuuup.

IRS reminds taxpayers they must check a box on Form 1040, 1040-SR or 1040-NR on virtual currency transactions for 2021

IR-2022-61, March 18, 2022

WASHINGTON — The IRS reminds taxpayers that there is a virtual currency question at the top of Form 1040, Form 1040-SR and Form 1040-NR. It asks: "At any time during 2021, did you receive, sell, exchange, or otherwise dispose of any financial interest in any virtual currency?"

All taxpayers filing Form 1040, Form 1040-SR or Form 1040-NR must check one box answering either "Yes" or "No" to the virtual currency question. The question must be answered by all taxpayers, not just taxpayers who engaged in a transaction involving virtual currency in 2021...

https://www.irs.gov/newsroom/irs-reminds-taxpayers-they-must...


Doesn't Molly get literally sick from being so absolutely negative all the time?


What is the direct stretto link?


any way to see if there are russian oligarchs on the list?


They're probably smart enough to use LLC's and other shell companies, several layers deep.


And bnb, the coin of binance just got hacked...


yyyoink

wow this pdf really slows down my iphone to read. safari doing too much, but yeah 14,000 pages is improbable and a lot

only 9.5mb though

synced to icloud

edit: acrobat reads it at the expected 60 fps


Acrobat on the phone? Brave :D


mine says 277MB


290 for me, I misclicked




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: