Shalini Nagarajan

<div id="highlights-block_62e3bbeab713f" class="highlights">
 <ul>
 <li>The same data breach that affected OpenSea has affected Celsius</li>
 <li>Customer.io removed its employee responsible for email leaks</li>
 </ul>
 
</div>



Celsius users — look out for phishing attacks.&nbsp;



The cryptocurrency lender has warned customers that a data breach led to their emails being leaked.



Late Thursday, Celsius emailed users informing them that an employee at its email delivery vendor Customer.io accessed a list of client addresses and sent them to an unauthorized party.



The embattled firm said it didn’t consider the incident to pose “high risks,” and had been informed that no other Celsius-related data was compromised beyond identified email addresses.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Announcement from Celsius: “We are writing to let you know that we were recently informed by our vendor<a href="https://t.co/452EROQtbc">https://t.co/452EROQtbc</a> that one of their employees accessed a list of Celsius client email addresses held on their platform and transferred those to a third-party.”&mdash; Celsians (@CelsiansNetwork) <a href="https://twitter.com/CelsiansNetwork/status/1552737193407533057?ref_src=twsrc%5Etfw">July 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



About a month ago, collectibles platform <a href="https://cms.blockworks.co/opensea-warns-of-phishing-attacks-due-to-data-breach/" target="_blank" rel="noreferrer noopener">OpenSea warned users</a> that their email addresses were compromised in a similar leak. Customer.io was responsible for that incident too, since one of its employees abused their access. The vendor <a href="https://customer.io/blog/update-to-compromised-email-addresses-incident/" target="_blank" rel="noreferrer noopener">said</a> that the employee responsible had been terminated, had all access removed and was reported to law enforcement.



Celsius, aware that Customer.io was one of its vendors, said it proceeded to remove data held with the firm after the OpenSea episode. At the time, the vendor found no Celsius data involved in the breach.&nbsp;



But on July 8, Celsius was notified that it too had been affected by the same offender. In a <a href="https://customer.io/blog/update-to-compromised-email-addresses-incident/" target="_blank" rel="noreferrer noopener">statement</a>, Customer.io confirmed five clients apart from OpenSea were impacted by the email leaks. “We do not expect to learn any additional information since this incident resulted from the actions of a single employee, who had legitimate access to these email addresses as part of the employee’s job,” it added.



Celsius customers took to Twitter to express frustration over a stream of trouble they’ve had to face with the lender.&nbsp;



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Celsius is a total disaster. Leaking a list of customer emails is a nice cherry on top of the bankruptcy sundae. <a href="https://t.co/J9lqUSdhIA">pic.twitter.com/J9lqUSdhIA</a>&mdash; Asher (#361) (@Asher68W) <a href="https://twitter.com/Asher68W/status/1552746070899171328?ref_src=twsrc%5Etfw">July 28, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The firm is dealing with restructuring its assets after <a href="https://cms.blockworks.co/celsius-to-file-for-bankruptcy-imminently-report/" target="_blank" rel="noreferrer noopener">filing for bankruptcy</a> on July 13. A court document shows Celsius has $5.5 billion in liabilities and $4.3 billion in assets, leaving it with a <a href="https://cms.blockworks.co/celsius-faces-heat-for-1-2b-balance-sheet-hole-customers-owed-4-7b/" target="_blank" rel="noreferrer noopener">$1.2 billion hole</a> on its balance sheet.



And while Celsius has been quick to downplay the risk to its users, similar data breaches have shown that affected users have actually lost funds due to phishing attacks.&nbsp;



When hardware wallet manufacturer Ledger suffered a <a href="https://www.ledger.com/addressing-the-july-2020-e-commerce-and-marketing-data-breach" target="_blank" rel="noreferrer noopener">data leak</a> of its marketing database in July 2020, its users were targeted with devious scams designed to steal their cryptocurrencies.



Shopify, the e-commerce giant that Ledger used to sell its wallets, <a href="https://cointelegraph.com/news/shopify-facing-another-lawsuit-from-crypto-holders-over-ledger-data-breach" target="_blank" rel="noreferrer noopener">also came under attack</a> from users for “repeatedly and profoundly” failing to protect customer identities. Both firms were sued in April after victims lost some of their crypto assets.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Celsius

Celsius Admits Customer Emails Leaked In Third-Party Data Breach

<div id="highlights-block_62bd517a9613f" class="highlights">
 <ul>
 <li>A Customer.io employee shared email addresses with an unauthorized external party</li>
 <li>OpenSea warned users of fraudsters trying to impersonate the platform by using fake domain names</li>
 </ul>
 
</div>



Collectibles platform OpenSea has alerted customers to a data breach after staff found email addresses were shared with an external party.



Head of Security Cory Hardman said in a <a href="https://opensea.io/blog/safety-security/important-update-on-email-vendor-security-incident/" target="_blank" rel="noreferrer noopener">blog</a> post on Wednesday that an employee of <a href="https://customer.io/">Cust</a><a href="https://customer.io/" target="_blank" rel="noreferrer noopener">o</a><a href="https://customer.io/">mer.io</a>, OpenSea’s email delivery vendor, abused their access by downloading and externally sharing customer data.&nbsp;



“If you have shared your email with OpenSea in the past, you should assume you were impacted,” he wrote. “We are working with Customer.io in their ongoing investigation, and we have reported this incident to law enforcement.”



The company further warned customers might face phishing attacks&nbsp;— attempts by cybercriminals posing as credible institutions with an aim to obtain sensitive information — by using a domain name similar to the official “opensea.io,” such as “opensea.org” or “opensae.io.”



<a href="https://twitter.com/econoar/status/1542343306704732162?s=20&amp;t=Uf4dK_Yi0L8D7GG73hfZ6Q" target="_blank" rel="noreferrer noopener">Screenshots</a> posted to Twitter show OpenSea notified customers about the data breach via email. Some users <a href="https://twitter.com/Didzis68904323/status/1542363159230652416" target="_blank" rel="noreferrer noopener">demanded</a> compensation.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">OpenSea data breach. <a href="https://t.co/FEtDKsoHje">pic.twitter.com/FEtDKsoHje</a>&mdash; eric.eth (@econoar) <a href="https://twitter.com/econoar/status/1542343306704732162?ref_src=twsrc%5Etfw">June 30, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Customer.io told Blockworks that the employee in question has been suspended and had access removed, pending an internal investigation. &#8220;We are working closely with OpenSea and are reviewing exactly how these email addresses were compromised,&#8221; a spokesperson for the vendor company said.



A similar incident occurred in March, when hackers <a href="https://cms.blockworks.co/nydig-blockfi-pantera-circle-all-targeted-in-hubspot-data-breach/" target="_blank" rel="noreferrer noopener">breached</a> third-party marketing vendor HubSpot to target large crypto stakeholders. NYDIG, Pantera Capital, <a href="https://twitter.com/BlockFi/status/1504982848771608586?s=20&amp;t=nEdl35DgSTJHl-INlo8Z_g" target="_blank" rel="noreferrer noopener">BlockFi</a>, Circle and <a href="https://twitter.com/SwanBitcoin/status/1505261139571191813?s=20&amp;t=Cod2RQU8PdmBbXcAxeuF-A" target="_blank" rel="noreferrer noopener">Swan Bitcoin</a> were among the affected companies.



OpenSea found itself in a sea of trouble thanks to another incident prior the data breach. The Department of Justice earlier this month charged its former head of product, Nathaniel Chastain, with <a href="https://cms.blockworks.co/former-opensea-exec-charged-with-nft-insider-trading/" target="_blank" rel="noreferrer noopener">insider trading</a> in connection to non-fungible tokens (NFTs). He was charged with one count of wire fraud and another count of money laundering.



Chastain <a href="https://cms.blockworks.co/openseas-nate-chastain-calls-it-quits-after-insider-trading-allegations/" target="_blank" rel="noreferrer noopener">resigned</a> from his position at OpenSea in September after he was suspected of profiting from inside information and purchasing NFTs before they were posted publicly.



OpenSea remains the leading marketplace by volume by a wide margin, with over six times the sales of the second-largest NFT marketplace over the past 30 days, according to data from <a href="https://dappradar.com/nft/marketplaces" target="_blank" rel="noreferrer noopener">DappRadar</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>