bitcofun: How The FTX Collapse Could Leave Blockfolio Users Exposed

Wednesday, December 7, 2022

How The FTX Collapse Could Leave Blockfolio Users Exposed

This is a viewpoint editorial by Morgan Rockwell, creator of Bitcoin Kinetics.

I'm not worried about Sam Bankman-Fried presumably getting a loan from Alameda, which was in fact FTX consumer funds wired through Alameda to be credited on FTX. I'm not worried about the ethical compass of the star financiers who offered billions to a kid they didn't truly understand or comprehend, yet backed with wealth and reliability. I'm not extremely interested in the monetary and market results upon the lots of business, exchanges and traders who for some factor depended upon FTX in any kind.

I'm most worried about Sam Bankman-Fried getting the individual recognition info of countless consumers, and utilizing that information to do chain analysis on the Blockfolio app he bought which was utilized by lots of Bitcoiners and cryptocurrency holders as a tracking tool of Bitcoin, Ethereum and other watch-only cryptocurrency wallets.

Source: Google Images

If you aren't mindful, Blockfolio was an app that was utilized by numerous Bitcoin holders and other cryptocurrency holders to track the currency exchange rate or the costs of their coins kept in freezer or on wallets that they just wished to be enjoying and not have actively on a hot wallet on their mobile phone. Keeping the wallet addresses really were not even required on the app. You might simply put in a quantity of a specific cryptocurrency that you wished to view and state that you had-- however there was likewise a function to link to exchanges to monitor all of your coins throughout all of the exchanges you had them on in one app. This was the appeal of Blockfolio as it didn't always request excessive individual recognition info besides an e-mail to assist monitor your account so you can visit from several gadgets.

Most of us like myself ended up being mindful of Sam Bankman-Fried since of the purchase of Blockfolio by a recently formed entity called FTX. Over a number of weeks the Blockfolio app was rebranded as the FTX app which now had its own exchange. It likewise had a brand-new set of Know Your Customer guidelines, Anti-Money Laundering policies, a brand-new Terms of Service, in addition to its own custodial wallet held by FTX, we presumed.

Here you can see the Terms of Service at Blockfolio from June 30, 2017:

Source: Blockfolio Privacy Policy 2017

Blockfolio avidly argued that they were not and would never offer user information. Blockfolio even tried to de-identify users with a hashing system for IDs to not even let themselves recognize and link user portfolios to email addresses; this obviously never ever taken place after the purchase and improvement into FTX.

Here you can see the plain distinction in the brand-new FTX Privacy Policy:

Source: FTX Privacy Policy 2022

Here is what bit is pointed out about individual recognizable info within the FTX Terms of Service, which is a various file than the Privacy Policy.

For recommendation, if you have never ever check out a Terms Of Service or Privacy Policy of a business in the past, I highly suggest you get a strong beer and enjoy this word soup!

This all has actually raised concerns around this merger and the acquisition that took place in the cryptocurrency market just a few years back. I am worried due to the fact that after the fallout of this exchange, FTX declaring bankruptcy and all of its properties possibly being installed for auction, I wish to understand the state of the individual recognition info that FTX had actually been required to collect due to the fact that of KYC and AML laws. My issue is the huge quantity of details collected consisting of passports, telephone number, IP addresses, house addresses, cryptocurrency wallet addresses, e-mail addresses, passwords and federal government IDs. All of these might be cost auction as client information or client profiles to whoever discovers them important.

ftx disclosure in event of sale or merger — *Source: FTX Privacy Policy (disclosure in case of merger, sale, or other property transfers)*

Now the possessions held by FTX whether they were really genuine cryptocurrency such as bitcoin or comprised tokens developed on another layer one network such as ethereum are not too essential in this discussion in my viewpoint. What is essential is the information, the personal privacy information, the information mining operation that might have or will be done on all of this information FTX had actually collected on clients either it was done by them or it will be done by whomever purchases this information at auction. Much more so, the jurisdiction of that information is open to anywhere in the world.

Source: FTX Privacy Policy (disclosure in the event of merger, sale, or other asset transfers)

As somebody who has actually personally dealt with coin analysis ideas and innovation for the United States Military, in addition to spoken with on this for the Department of Defense as a so called "topic specialist," I can personally testify that it is really simple to associate an individual to their Bitcoin wallet address utilizing absolutely nothing more than the quantities of bitcoin hung on particular addresses, in addition to the gadget information that is keeping an eye on those particular quantities on particular addresses-- this is basic SIGINT, MASINT or HUMINT, all of which are various types of intelligence event.

If you are keeping an eye on any bitcoin on any wallet over any Bitcoin explorer that is browsed a web browser or app on any gadget, phone, laptop computer or tablet, there is now a record that will be linked to the IP address, the MAC number, the SIM telephone number, the VOIP number, charge card number, house address and any other individual determining info that is connected in any method to this gadget. I understand this due to the fact that Edward Snowden dripped files revealing that the NSA had actually a program called XKEYSCORE and applications were utilized like OAKSTAR and its subprogram MONKEYROCKET to particularly track Bitcoin users at the NSA.

Source: Wikipedia Search For HUMINT — *Source: https://theintercept.com/2018/03/20/ the-nsa-worked-to-track-down-bitcoin-users-snowden-documents-reveal/*

Now what I'm getting at is this information that FTX was required under AML and KYC law to be collected. This is possibly among the biggest events of this kind of information in the cryptocurrency market ever performed in history. This information, integrated with coin analysis details associated to bitcoin, ethereum and other cryptocurrency quantities being tracked by the formerly entitled Blockfolio app has actually developed a circumstance where KYC information individual recognizing info can be now superimposed over Blockfolio e-mail addresses, UTXOs and view addresses that lots of individuals utilized on Blockfolio with no individual details being disclosed to the app.

So this implies that individuals that utilized Blockfolio to monitor the quantity of cryptocurrency they had, wished to purchase or were monitoring for whatever factor will now have the ability to be associated to extremely comprehensive individual recognition details. The issue I have is not whether FTX and its numerous subsidiaries were tracking this details from Blockfolio or utilizing it in any method, however tha t their large brand-new swimming pool of client details and information will be binded in the future to the Blockfolio information. I do not presume FTX was smart adequate to do this for any function such as marketing, or information showing a hedge fund like Robinhood was captured doing, however I do presume that they might have thought about offering this information to police, to marketers or to stars in the intelligence neighborhood as SBF stated there was an open door to regulators and police at FTX.

What we require to consider now is when the possessions of FTX increase for auction, which they will, that not just the digital currencies and tokens in addition to the licenses will be offered to some brand-new celebration, however it will be the clients themselves, individual determining details and the huge information mining that might have been or will be finished with that information.

I was never ever an FTX user, I never ever produced an account with FTX or FTX.us and I never ever wired any cash to Alameda. Due to the fact that of my durability in the Bitcoin area, I utilized Blockfolio like numerous Bitcoin users prior to me to keep track of the quantities of Bitcoin I had in numerous places and their overall worth. Now that information that I believed was personal will be linked to KYC information of anybody I understand, engaged with over a wire and any gadget they utilized, specifically if through numerous connections it leads back to FTX in any method.

What we require to do now is ask the severe concerns and not concentrate on the monetary responsibilities or mishandlings of SBF and FTX. We must ask who has this information? What has been made with this information and who will be owning this information in the future? The truth is FTT liquifying into absolutely nothing isn't a "Force Majeure Event," so the majority of the users are screwed.

If this at all issues you or includes you, I would recommend all of us discover the appropriate channels to safeguard ourselves from the worst case circumstance from this fallout of information. This is the greatest issue with KYC and AML laws, due to the fact that after all of this monetary turmoil, there is now a criminal-run exchange that remains in belongings of countless individuals's individual details about their gadgets, their houses, their financials and more, all offered to the greatest bidder.

Notes: