The Collision of Cryptocurrency: Anonymity, Bankruptcy Transparency and Cybersecurity
By Deborah Reperowitz, Stradley Ronon, Guest Contributor
Deborah Reperowitz combines 20 years of law firm practice with years of C-level experience at publicly traded companies to counsel and represent clients in bankruptcy, commercial litigation and related transactional matters. She also draws on her broad background to serve as a neutral arbitrator and mediator in commercial matters. Debbie brings a uniquely comprehensive perspective to assist companies in developing and executing on practical legal and business strategies, frequently in complex, high-stakes matters.
A nationally recognized bankruptcy and commercial litigation lawyer and an alternative dispute resolution (ADR) professional, Debbie provides clients with pragmatic, business-minded advice and representation.
She represents debtors, creditors and acquirors of assets, including stalking horse bidders, in bankruptcy cases. Her practice is focused upon complex cases, where she engages in litigation involving fraudulent transfer issues, debtor-in-possession (DIP) financing, fraud, lien avoidance/priority claims, plan confirmation and examiner/trustee appointments. Debbie also has a robust ADR practice, serving as a mediator and arbitrator in business disputes. She has served as a neutral in more than 100 commercial disputes involving such issues as business torts, breach of contract, defamation, directors and officers (D&O) insurance, and disputes arising in bankruptcy cases.
Previously, Debbie was senior vice president and chief litigation counsel at CIT Group, a publicly traded international financial services company, where she established and chaired the litigation and government investigations legal team, managing virtually all of the company’s litigation, bankruptcy cases and government actions. Debbie reported directly to the board of directors and worked closely with senior management to identify, prevent and mitigate litigation risk. She is a former general counsel of publicly traded financial adviser Fairholme Capital Management, where she worked closely with the fund adviser to three open-ended non-diversified mutual funds. She previously was a partner at a global law firm.
INTRODUCTION
Bankruptcy courts have been forced to make decisions regarding, or at least impacting, fundamental cryptocurrency issues since the collapse of the cryptocurrency market in mid-2022. Many of the cryptocurrency bankruptcies have been headline-catching, high profile, “mega” cases, including Three Arrows, Voyager, Celsius, FTX, BlockFi, Genesis, and Terraform Labs, the company behind TerraUSD, the stablecoin that with its companion token, Luna, dramatically collapsed in May 2022 sending shockwaves throughout the cryptocurrency world. Because cryptocurrency is a relatively new industry with atypical assets and operations and unique rules or a lack thereof, bankruptcy courts have found themselves faced with novel issues, including whether cryptocurrency customers, creditors and/or equity holders are entitled to the anonymity touted to be inherent in cryptocurrency ownership and transactions when a cryptocurrency exchange, platform or lender is a debtor under the United States Bankruptcy Code.
The tension between secrecy and openness in United States courts goes beyond bankruptcy cases and cryptocurrency matters. It has been well-established by the Supreme Court of the United States that the First Amendment right to distribute information affords the public a corresponding right to receive information and ideas. Indisputably, in a democratic society where laws, policies, leadership, and major undertakings of the government are directly or indirectly decided by the people, public access to court hearings and records has been considered imperative. Specifically, such access imposes a sense of responsibility on the judge, attorneys and jury for their actions and decisions, promotes fairness and equality of court proceedings, and serves to deter violations of the law and protect those who have been harmed. In Richmond Newspapers Inc. v Virginia, 448 U.S. 556 (1980), the trial court denied public access to a fourth murder trial after the first three trials ended in mistrials. The Supreme Court reversed, holding that the First Amendment prohibits the government from summarily closing courtroom doors. In his concurrence, joined by Justice Thurgood Marshall, Justice William Brennan wrote: “The Executive Branch seeks to uproot people’s lives, outside the public eye, and behind a closed door. Democracies die behind closed doors.” Today, almost 25 years later, “Secret Justice” remains a concern for those committed to open access to the courts.
The right to access, however, must be balanced against the Fourteenth Amendment’s right to privacy. Accordingly, the right to access court proceedings and documents is subject to certain narrowly drawn exceptions, such as a criminal defendant’s constitutional right to a fair trial, and privacy in juvenile court proceedings, trade secret matters, and matters involving compelling national security. Nonetheless, the default position is to afford the public open access to courtroom proceedings and documents. Thus, any decision to maintain the secrecy of court proceedings, documents or information must be narrowly tailored and based upon findings that such secrecy is required to protect an overriding interest. Such decisions should be based on a holistic analysis of the impact thereof on Environmental, Social and Governance (“ESG”) factors.
The concept of an ”ESG Movement” was solidified in 1994 when a United Nations report stated that prioritizing ESG issues will result in “stronger and more resilient investment markets, as well as contribute to the sustainable development of societies”. The “ESG Movement” originally was
focused on public companies and their sustainability, but has become relevant to private companies and government as well. The goal of ESG as applied to government, including the legislative, executive and judicial branches, is to build long-term sustainability by developing trust and confidence in the agencies and achieving desired outcomes for the public, with a focus upon how government treats its constituents and holds itself accountable. While the “ESG Movement” has become politicized and come under criticism by some, the underlying goal of sustainability and its focus on ESG as a means to achieving long-term sustainability cannot be dismissed.
It is indisputable that over the past decade or so, the nation’s concern and expectations for the future and accountability, therefore, have been paramount. Simultaneously, there has been a general declining trust and overall disappointment in the government, including the judicial system. Since members of the public have looked to the government to protect them, preserve their rights and set the stage for a promising future, measuring legislative, executive and judicial actions holistically through ESG considerations has emerged as a means to address fundamental public concerns and goals on a daily basis.
This article will focus upon the tension between the disclosure obligations imposed on debtors under the United States Bankruptcy Code and the rights of creditors to privacy and protection from victimization.
BANKRUPTCY TRANSPARENCY
Chapter 11 of the Bankruptcy Code provides companies with powerful legal tools and protections to allow them to restructure their finances and operations through the alteration of the rights of their creditors and interest holders, often over the objection of these parties-in-interest. In exchange for the privileges and opportunities provided to a debtor in bankruptcy, a restructure under Chapter 11 takes place in open federal bankruptcy court, and almost all of a debtor’s finances and operations are made publicly available. In fact, essentially all of a debtor’s actions, other than actions in the “ordinary course of business”, are subject to bankruptcy court approval on notice to stakeholders, thereby affording parties-in-interest an opportunity to participate in the restructure process. Transparency is so fundamental to the success of a Chapter 11 case that debtors have been said to live “in a fishbowl”. Thus, information that a debtor or its creditors may have viewed as confidential pre-bankruptcy could become publicly available once the debtor is in bankruptcy.
To ensure the transparency of the bankruptcy process, the Bankruptcy Code and applicable rules impose comprehensive disclosure requirements on a debtor throughout its Chapter 11 case, including the obligation to disclose the identity and contact information of each of its creditors. Disclosure of information affords parties-in-interest the opportunity to participate in the case and identify and communicate with each other. Significantly, bankruptcy transparency also provides the public with insight into who is participating in a case, the activity in and status of a case, and the rationale for arguments and decisions rendered in the case. In turn, transparency plays a significant role in keeping court procedures and the participants, including the judiciary, in check.
Congress’ attempt to balance the required transparency of the bankruptcy process against the need to maintain the confidentiality of certain protected or potentially damaging personal or corporate information is contained in Section 107 of the Bankruptcy Code, entitled “Public Access to Papers”. Section 107(a) explicitly states that bankruptcy papers and dockets "are public records and open to examination by an entity at reasonable times without charge." Section 107(b) carves out exceptions to this mandate that are designed to protect against public disclosure of confidential business information and "scandalous or defamatory" matters. This section allows the court to protect an entity’s trade secrets, or confidential research, development, and commercial information. It also allows the court to protect an individual or company from disclosure of defamatory or similar information.
Finally, in 2005 with the advancement of technology, particularly the ability to locate people and steal identities with only small bits of personal information, section 107(c) was enacted. This section allows the court to alter a debtor’s disclosure obligations to protect an individual’s personally identifiable information (PII), but only “to the extent the court finds that disclosure of such information would create undue risk of identity theft or other unlawful injury to the individual or the individual’s property”.
CRYPTOCURRENCY ANONIMITY
Since about 2008, when the first blockchain whitepaper was introduced, cryptocurrency ownership and transactions have been touted as private. Subsequently, however, many experts have concluded that anonymity in cryptocurrency transactions is a fallacy. Indeed, they have found that although potentially complicated, with the right tools and diligence, any cryptocurrency and its owner can be tracked. This is the case even with “privacy coins” that possess privacy-enhancing features designed to increase anonymity and reduce traceability. Although nearly all cryptocurrency transactions leave a digital trail that can lead to the identity of the transactors, many that own or transact in cryptocurrency continue to insist that cryptocurrency provides a way to invest and transact business on the internet while remaining publicly anonymous, and they continue to promote this secrecy as a hallmark feature of cryptocurrency that should be protected. With the proven ability of cryptocurrency debtors in bankruptcy to identify their customers and regulators working tirelessly to develop laws and regulations to govern the evolving cryptocurrency industry, arguments of anonymity are dubious at best.
TO DISCLOSE OR NOT TO DISCLOSE
Prior to the parade of cryptocurrency bankruptcies that began in mid-2022, bankruptcy courts occasionally were asked to alter a debtor’s disclosure requirements to protect a party-in-interest. Generally, such requests were supported by specific facts and set forth specific risks that would befall a particular person or people if their PII was disclosed. In cryptocurrency bankruptcies, sweeping requests have been made by debtors and creditors to maintain the anonymity of all of a debtor’s customers and creditors or to redact specific PII, such as residential and email addresses, for all customers. In cryptocurrency cases, the debtors’ customers comprise the vast majority, if not all, of the creditor body. Therefore, maintaining the anonymity of a debtor’s customers could result in maintaining the anonymity of substantially all of the debtor’s creditors. These requests to alter debtors’ fundamental disclosure obligations have forced bankruptcy courts to balance bankruptcy disclosure requirements and the public’s right to access judicial records, on the one hand, against creditors’ right to privacy, customers’ expectations of anonymity and the protection of creditors from wrongdoers on the other hand. The result is a split among the courts as to how far to go.
1. Arguments in favor of maintaining anonymity or redacting PII
Arguments in favor of limiting the disclosure of cryptocurrency customers’ PII or maintaining their anonymity in bankruptcy cases are straightforward. First, and of particular appeal to a bankruptcy court and creditors of a debtor, proponents of nondisclosure argue that such action is necessary to preserve and maximize the value of the debtor’s assets for the benefit of creditors. Specifically, they argue that because cryptocurrency transactions are undertaken anonymously or pseudonymously, customer lists have enhanced value over customer lists in other industries because of the difficulty, expense and time required to identify and market to potential customers. Indeed, the creditors’ committee in FTX’s bankruptcy case argued that the debtors spent tens of millions of dollars on advertising and branding including buying the naming rights for the FTX Arena, entering into sponsorship deals with celebrity athletes, setting up partnerships with sports teams, and airing a prime-time Super Bowl commercial, which resulted in a customer list containing in excess of nine million customer names and their contact information. Accordingly, proponents of maintaining customer anonymity in cryptocurrency bankruptcies argue that such action is necessary to prevent competitors from gaining an unfair advantage by poaching customers in order to avoid the marketing process unique to the industry.
Additionally, advocates of maintaining customer anonymity argue that a debtor’s customer list constitutes a trade secret or confidential or commercial information protected by section 107(b) of the Bankruptcy Code.
Second, proponents of keeping the identity of customers secret in cryptocurrency bankruptcy cases argue such action is required to protect customers from bad actors. They assert that cryptocurrency assets are particularly easy targets for thieves, fraudsters and scammers because ownership is difficult to trace and the assets are easily liquidated. Moreover, they contend that due to the lack of regulation in the cryptocurrency industry, there are no safeguards to unravel a fraud once it has been perpetrated.
Third, supporters of maintaining customer anonymity in cryptocurrency bankruptcies note that a debtor’s customer base is worldwide, and therefore foreign laws prohibiting disclosure of PII could result in the imposition of severe penalties against a debtor if it discloses the PII of its customers. For example, the general data protection regulation (GDPR) implemented by the European Union in 2018 severely restricts the dissemination of PII and provides for the assessment of exorbitant fines for violation of the regulation. Similarly, the violation of laws and regulations adopted in Japan to protect PII could result in the suspension of a violator’s license to do business in Japan.
Finally, it is argued that disclosure of customers’ identity is of little or no value or benefit to the public, and therefore, disclosure would serve no purpose other than to turn the cryptocurrency world upside down.
It is noteworthy that when requesting authority to maintain customer anonymity, debtors generally volunteer, and are directed by the court, to make protected confidential information available to the Bankruptcy Court, the Office of the United States Trustee and counsel to official committees appointed in their bankruptcy cases.
2. Arguments against maintaining anonymity
The most active opponents to maintaining customer anonymity in cryptocurrency bankruptcy cases have been the United States Trustee and news organizations, including Bloomberg, Inc., Dow Jones & Company, New York Times, Inc. and the Financial Times Ltd. The Office of the United States Trustee is a component of the Department of Justice responsible for overseeing the administration of bankruptcy cases. Its mission is to promote the integrity and efficiency of the bankruptcy system for the benefit of all stakeholders - debtors, creditors, and the public - and it is vested with broad administrative, regulatory, and litigation/enforcement authority. While the United States Trustee has been an active objector to maintaining customer anonymity in cryptocurrency cases, it does not object to filing the residential and email addresses of individual creditors, including customers, under seal.
Advocates of disclosure of creditor identity in bankruptcy cases point to the extensive disclosure requirements imposed upon debtors through the Bankruptcy Code, Bankruptcy Rules and Local Rules and conclude that transparency is critical to stakeholders, the public and the bankruptcy process. As to stakeholders, they argue that disclosure of creditor identity is essential to the rights of stakeholders to participate meaningfully in the bankruptcy process through the evaluation of debtors and their business dealings and through communication with each other. As to the public, they argue that full transparency ensures the public’s right of access to judicial records under the First Amendment, common law and public policy. Finally, as to the bankruptcy process, advocates assert that full transparency imposes a measure of accountability on the judiciary and the court system. Such accountability, they claim, is the best means to avoid suggestions of impropriety and to promote fairness and confidence in the bankruptcy process, the legal system and the administration of justice generally.
In support of its position, the United States Trustee has looked to debtors’ privacy policies to determine whether they permit sharing of customer information. In the case of FTX, the United States Trustee argued that the debtors’ policies permitted the sharing of PII under a variety of circumstances, one or more of which could apply to permit disclosure in bankruptcy cases. The United States Trustee also rebuffed concerns regarding the potential imposition of penalties against United States debtors under foreign privacy laws by arguing that there is no basis to assume that foreign statutes supplant the disclosure requirements contained in the Bankruptcy Code.
In support of disclosing customer identities and other PII, news outlets noted that they “act as the eyes and ears of the public, informing the public of issues of the day”, and concluded that “[t]his valuable social function is hampered by sealing of judicial records”. News organizations also noted that cryptocurrency bankruptcies have attracted extensive media coverage, perhaps because of the number of creditors involved, the impact on other cryptocurrency entities, the magnitude of the value of the assets involved, or the general drama surrounding such cases, which warrants transparency and disclosure. Further, the press reasoned that cryptocurrency customers “knowingly invested in a novel, volatile, and largely unregulated financial market; they assumed the risks inherent in such investment, and their decision to so invest does not entitle them to anonymity in related bankruptcy proceedings.”
In sum, proponents of disclosure of customer PII conclude that absent proof of extraordinary circumstances and a compelling need to maintain secrecy, creditors’ anonymity in bankruptcy cases cannot be condoned.
COURT DECISIONS
Numerous bankruptcy courts have been presented with motions to seal PII in cryptocurrency cases. A sampling of the courts’ rulings follows.
In the bankruptcy case of Cred Inc., an earlier cryptocurrency case in which a plan of reorganization was confirmed in 2021, the Bankruptcy Court for the District of Delaware authorized the debtor to keep the names and addresses of individual cryptocurrency customers secret.
In 2022, the Bankruptcy Court for the Southern District of New York permitted the sealing of the names, addresses and other personal information of individual customers in the bankruptcy case of Voyager Digital.
In 2022, the Bankruptcy Court for the Southern District of New York permitted Celsius Network, LLC to maintain the confidentiality of customers’ home and email addresses but required the disclosure of individual customer and creditor names. The Bankruptcy Court did not permit the redaction of information for non-individual customers or non-customer creditors. Following the disclosure of customer names, there were numerous reports of cyber-attacks against Celsius customers, and it is reported that the Bankruptcy Court called upon the United States Marshalls to assist in the identification and apprehension of criminals who fraudulently modified a court order and emailed it to Celsius customers. The fake order required customers to submit critical elements of their PII, including their wallet addresses and contact information and to pay filing and tax charges.
In 2023, in the bankruptcy case of BlockFi, Inc., the Bankruptcy Court for the District of New Jersey permitted the sealing of (a) the names and home and email addresses of all individual creditors and equity holders who are citizens of, and located in, the United States, including the debtors’ employees, former employees, and contract workers, and (b) the names, home and email addresses, and other personal data of any individuals to the extent they were or may have been subject to foreign data privacy regulations and laws. The Bankruptcy Court denied the redaction of information for corporations and business entities.
In late 2023, the Bankruptcy Court for the Southern District of New York in the Genesis bankruptcy case authorized the redaction of the names, addresses and contact information of certain individual and institutional creditors.
Finally, in FTX’s bankruptcy case, the Bankruptcy Court for the District of Delaware has cautiously approached requests to maintain the confidentiality of customer, creditor and equity holder PII. The Court preliminarily granted FTX’s original request, made on the date the bankruptcy was commenced, to keep customer and creditor PII confidential, but limited certain aspects of the authority to a period of 90 days, subject to extension upon application of any party-in-interest. The relief has been modified and the 90-day deadlines have been extended upon the filing of joint motions by the debtors and creditors committee and extensive evidentiary hearings. Bloomberg L.P., Dow Jones & Company, Inc., The New York Times Company, and The Financial Times Ltd. have appealed the first order extending the 90-day periods. That appeal remains pending as of this writing.
By order entered in February 2024, the Bankruptcy Court in FTX’s case permitted the redaction of the names, addresses and e-mail addresses of all of FTX’s individual customers, creditors, and equity holders from all filings with the Bankruptcy Court or that otherwise are made publicly available in FTX’s bankruptcy cases subject to the following:
The authority to redact customer names and the names and residential and e-mail addresses of customers that are not natural persons is for an additional 90 days, without prejudice to the rights of parties-in-interest to seek an extension of the 90-day period or modification of the relief;
The authority to redact customer names, whether natural persons or entities, and the addresses of customers who are not natural persons is limited to documents where disclosure would indicate the status of such person or entity as a customer; and
The names of all creditors appointed to the creditors committee and the residential and email address or phone numbers of any creditor appointed to the creditors committee who is not a natural person must be disclosed.
[Significantly, by order entered in June 2023, the court in FTX’s bankruptcy case denied the request to redact the names, addresses and email addresses of creditors or equity holders on the basis that such persons are protected by the GDPR or Japanese data privacy laws. – I am a little confused about the timing of the orders in the FTX case. Above you say “The Court preliminarily granted FTX’s original request, made on the date the bankruptcy was commenced, to keep customer and creditor PII confidential”. In this paragraph, you say that the court entered an order in June 2023, saying the opposite – that the names couldn’t be redacted. In the paragraph above, you seem to say most recently than the court went back and permitted redaction. Did the Bankruptcy Court change its mind twice?]
WHERE DOES THIS LEAVE US?
The tension between transparency and privacy has been tested repeatedly in cryptocurrency bankruptcy cases, but the implications of this debate go far beyond the cryptocurrency industry and bankruptcy cases. The trend appears to be to maintain the secrecy of the identity and other PII of individual customers. In some cases, this protection has been extended to individual non-customer creditors and institutional customers. Are we headed to nondisclosure of all individual creditor PII in all cryptocurrency bankruptcy cases? In all bankruptcy cases? In all litigation cases? Does it matter whether individuals are public figures or have thrust themselves into the public light? Does the type of debtor, size of the debtor or any other debtor-specific fact matter? What is the impact of a decision that chooses transparency over privacy or vice versa on the public’s trust and confidence in the bankruptcy process, the American jurisprudence system, and the government generally? These are just a few of the questions that need to be asked in deciding requests to maintain creditor PII confidential in bankruptcy cases.
Applying ESG sustainability principles to the conundrum presented by the competing disclosure and privacy rights at issue requires a deep-dive and holistic analysis of the long-term impact of favoring one right over the other. The goals are obvious: to keep the public as safe as possible while preserving the rights of stakeholders and the public to information regarding court procedures, while promoting public trust, confidence, and faith in the government, specifically the judicial system. To achieve these goals, the judicial system must be fair, honest and just, as well as, acting in the best interests of its constituents.
While protecting the public’s fundamental right to access information concerning the judicial system is paramount and chipping away at this right must not be done haphazardly, we are faced with a reality where the ability of cyber scammers and criminals to swindle and victimize innocent individuals is outpacing the development of protections against such malefactors. Beyond its negative impact on the public’s right to information, diminished transparency in bankruptcy cases through non-disclosure of creditor PII has broader ramifications. For example, the disclosures required to be made by professionals seeking to be retained by the Bankruptcy Court likely will be impacted since full disclosure could expose creditor PII. This creates a greater chance that a professional will be retained that does not satisfy the “disinterested” standard mandated by the Bankruptcy Code. Similarly, anonymous creditors could escape liability to the detriment of debtor’s estate since a debtor may not commence an action against a friend or insider when there is no third-party pressure to bring such action because the identity of the potential creditor/defendant was not revealed. Courts have attempted to minimize such concerns by directing that protected PII be made available to the judge, the United States Trustee and the creditors committee. Moreover, upon the request of a party-in-interest and a demonstration of “cause”, the court may grant access to protected PII.
Despite the potential negative impact of maintaining individual customer and creditor PII confidential in cryptocurrency bankruptcy cases, the risk of identity theft and financial and physical devastation that could be suffered by individuals and their families as a consequence of disclosure far outweigh the harms that will be imposed upon stakeholders, the public, the bankruptcy process and government generally by withholding disclosure. To understand the potential magnitude of individual harm that could be caused by disclosure, the FTX debtors claim to have a customer list containing over nine thousand names.
Whether to keep creditor PII secret in bankruptcy cases has less to do with the uniqueness of the cryptocurrency industry and instead is focused upon the potential victimization of individuals that has become common due to developments in technology and the government’s inability to stop scammers and criminals from its misuse. Therefore, maintaining the confidentiality of individuals’ PII to protect them from financially and personally devastating cyber attacks appears to be justified—at least until protections against cybersecurity scammers and criminals are established and enforced.