Media want 9 million FTX customer names released despite fear of ChatGPT-driven ‘pig butchering’ scams

The New York Times, The Financial Times, and Bloomberg have again asked a U.S. bankruptcy court to release the names of 9 million FTX customers despite the risk of exposing them to AI-driven “pig butchering” scams.

The bankruptcy court has so far kept the full list of creditors sealed, for fear of exposing them to hackers, phishing scams and other fraudsters who prey on people desperate to get their savings back. The 9 million are mostly customers with money stuck or lost on Samuel Bankman-Fried’s collapsed crypto exchange. A 90-day deadline on renewing that seal is pending, and the media companies now want the names released.

In U.S. federal law, there is a presumption of openness and transparency around bankruptcy proceedings. It is normal for lists of creditors to be filed publicly when a company fails, the media coalition argued in a May 3 filing. “But there is no legal basis for giving crypto users the ability to participate in bankruptcy proceedings anonymously.”

The debtors in control of the shell of FTX had previously argued that crypto customers are uniquely vulnerable when their personal data is exposed. A security expert for FTX stated in an affidavit that FTX customers would be likely targets for scams, including “pig butchering,” where targets are persuaded to invest money in a crypto account controlled by a scammer posing as a trusted intermediary who claims to be helping them restore their funds. Once the account is full, the scammer drains the funds.

Artificial intelligence platforms like ChatGPT now make this even easier for scammers, Jeremy Sheridan, FTX’s security expert, told the court in an April 20 filing.

Scammers can use FTX customer names to discover other personal info about them

Customers of Celsius, another bankrupt crypto company, have already been targeted this way, Sheridan stated, because once the names are known scammers are able to use that to discover other personal information about their targets.

“Subsequently, many Celsius customers became the target of phishing attacks by scammers posing as bankruptcy lawyers using emails and phone calls.”

“These examples of phishing attacks targeting the Celsius customers ranged from simple attempts to connect over messaging applications, to sophisticated emails using Celsius logos and impersonating legal counsel, and in one instance resulted in the bankruptcy court involving the U.S. Marshal.”

“Even though Celsius customer email addresses and phone numbers were redacted, malefactors were still able to reach customers based solely upon the disclosed names,” he said.

ChatGPT can make crypto scammers more convincing

ChatGPT will now make this easier for scammers because it can provide them with scripts written in near-perfect English. Often, scammers are non-English speakers whose poor grammar gives them away.

“Historically, these efforts have been hampered by linguistic, grammatical, or content errors committed by the malefactor, especially those in foreign locations. Simply put, the malefactor makes errors in the impersonation message that raise suspicion in their target and prevent the scheme from being successful,” Sheridan said.

"However, the arrival and refinement of artificial intelligence programs, such as ChatGPT, … has further propelled the success of these impersonation attacks by essentially eliminating previous telltale signs of poor grammar, typos, and recycled material/narratives," he said.

Pig-butchering scams cost Americans more than $429 million in losses last year, he added.

No evidence of scams being successful so far

In response, the media companies argued that FTX and Celsius customers are actually less susceptible to scammers precisely because they are familiar with much of the skullduggery that goes on in crypto. The only reason Sheridan knows that Celsius customers were targeted by scams is because those people alerted the bankruptcy court who then alerted everyone else, they said.

“Despite these scam attempts, the record contains no evidence that any individuals named in the Celsius litigation have fallen victim to theft—either of their identities or their crypto assets,” the news organisations argued.