Crypto data firm Arkham Intelligence stirred controversy Monday by announcing a new service aimed at unmasking the owners of digital wallets, angering privacy-focused crypto advocates. But it turns out Arkham has been leaking its own customers’ private information, putting a spotlight on its own approach to user privacy.
As a staunch privacy advocate, I believe these tools infringe upon user privacy, said m4gicpotato, a contributor to the privacy blockchain Beam. The pseudonymous m4gicpotato posted about the issue on Twitter, which quickly went viral.
The issue stems from the way Arkham set up its web link referral program. Users of Arkham’s wallet tracking dashboard can invite others onto the platform by sharing their unique referral URL. Those URLs appear to end with a meaningless jumble of characters. In reality, they’re an easy-to-decipher version of the user’s email address written in Base64, which is trivial to decode.
Arkham Intelligence builds a popular service for tracking crypto transactions and identifying the owners of crypto wallets. On Monday, Arkham unveiled the Intel Exchange, a marketplace for placing bounties on the identity of anonymous crypto wallets.
The choice to encode user emails in Base64 just added another layer of incredulity to the situation, m4gicpotato added. It’s unclear how many users could be affected by the setup. In theory, anyone who generated a referral link and shared it sent their email address into the ether.