OpenAI KYC provider accused of sharing users’ crypto addresses with federal agencies

Summarized:

A February 18 investigation published by security researchers who go by vmfunc, MDL, and Dziurwa found publicly accessible code that appears to send data collected by Persona, the KYC provider, to The Financial Crimes Enforcement Network — or FinCEN — a bureau of the US Department of the Treasury that safeguards the financial system from illicit use.

Multiple IT specialists and security experts confirmed to DL News that the investigation and its findings appear legitimate.

Persona CEO Rick Song has since responded to the allegations publicly on X. He accused the investigation’s authors of not reaching out to him before publishing their findings.

In emails between vmfunc and Song posted by Song on his X account, the Persona CEO said his firm does not work with any federal agency today. He has yet to directly address the findings of the investigation.

“I am genuinely disappointed in how all of this has been handled,” Song said on Thursday in a since-deleted X post. “What has really been frustrating for me is that I also admire vmfunc’s work and their clear talent.”

Vmfunc, also known in online circles as Celeste, is widely regarded as credible because of their track record of technical investigations that other security experts have repeatedly validated.

OpenAI and Persona did not immediately respond to DL News’ requests for comment.

The allegations come as both crypto users and the broader public grow increasingly concerned about the mass surveillance and privacy-eroding capabilities of enforced identification checks.

According to the investigation, the code that runs these functions has been in place since November 2023.

As for how long data that is forwarded to the government agencies is kept for? That’s not clear either.