Did Celsius ‘dox’ its customer base? How an attempt to dodge regulators ended with thousands of pages of user data published online

While the filing provided vital information—such as confirmation that Celsius executives had withdrawn large sums from the platform before halting withdrawals—people on Twitter immediately described Celsius’s data sharing as doxing. Anybody could easily match the on-chain activity and addresses of named Celsius users with the dates and amounts of transactions.

According to legal and identity experts, the move was a legal requirement for Celsius, but it still revealed the dangers of centralized crypto services, especially as the industry reckons with, at best, inconsistent regulation.  

“Celsius’s lawyers didn’t actually ‘dox’ anyone,” said Joseph Collement, an attorney who leads the legal and compliance team for Bitcoin.com. 

Before Celsius went bankrupt, it was one of the largest crypto-lending platforms, attracting almost 2 million customers by offering yields as high as 17% on deposits and managing almost $12 billion in assets.

While Celsius acted like a customer-facing bank, it didn’t want to be regulated as one. People who deposit money in banks are protected by bank secrecy laws. To avoid such regulations, including FDIC requirements, Celsius instead classified its customers as “creditors”—a distinction usually reserved for major financial players.

“Since these types of creditors represent potential systemic risk, it’s important that their activities are transparent,” Collement told Fortune. 

Because Celsius had registered its users as creditors, not depositors, they were subject to creditor disclosures.

“Clearly this makes little sense at face value—Celsius’s customers are not systemically important in the same way banks’ creditors are,” Collement continued. “However, because regulations about creditor disclosures were not designed with quasi–crypto banks in mind, we are stuck with the legal framework we have.”

As part of the bankruptcy proceedings, Celsius tried to have the names of its customers (or creditors) redacted, arguing that disclosure of the list would affect the firm’s chances of selling it as part of its reorganization. At the end of September, the judge agreed that Celsius could redact the physical and email addresses of its individual creditors, but that it would have to include their names.  

A lawyer who spoke to Fortune on the condition of anonymity explained that debtors are required to identify creditors that have received payments or transfers within either 90 days or a year, depending on their status. Celsius was not exempted because it had taken a nontraditional approach to classification of its customers.

Phillip Shoemaker, executive director and CEO of decentralized verification service Identity.com, said Celsius’s failure to protect its customers is representative of the dangers of centralized crypto platforms.

“This is problematic because blockchain transactions are intended to inherently protect a user’s identity, and it is assumed that when operating in Web3, an individual’s identity is not unveiled,” he told Fortune. “Many crypto users are considering this filing as going against decentralization, and believe Celsius no longer values a right to privacy for its users.” 

Crypto Twitter’s uproar that Celsius had doxed its customers was not quite accurate—in reality, that lack of privacy was baked into its business model and attempt to game the system.

The episode demonstrates how the promise of decentralization is often just a veneer for many crypto companies, especially as their shortcomings are revealed in a market downturn.

“The moral of the story here,” Shoemaker said, “is that if a company is going to do business in Web3, every aspect of its operations should reflect Web3 and blockchain values of being secure, decentralized, and transparent.”