TLDR
DOJ released at least eight documents containing Richard Kahn's active Deutsche Bank online banking portal credentials — user ID, account number, and browser fingerprint — for the Southern Financial LLC account that processed $606.9 million in inflows. The release raises questions about DOJ's redaction protocols for sensitive financial information.
What Was Released
Documents EFTA01268275 through EFTA01268283 in DOJ Data Set 10 contain identical captures of screenshots of Deutsche Bank online banking login pages (PAPER TRAIL Project, 2026a). The captured credentials belong to Richard Kahn, Epstein's accountant, co-executor, and Butterfly Trust co-trustee. The details are specific:
- USERID: 867730320z
- Account Number: 867730320
- Account Title: Southern Financial LLC
- Browser: Firefox 65 (released January 2019) (Mozilla, 2019)
- Operating System: macOS 10.13 (High Sierra)
- Full User-Agent String: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:65.0) Gecko/20100101 Firefox/65.0
The user ID follows Deutsche Bank's online portal convention of appending a letter suffix to the account number. The browser version and operating system place the session in early-to-mid 2019 — the same period when Deutsche Bank accounts were being closed and funds migrated to TD Bank (PAPER TRAIL Project, 2026a).
Eight Duplicate Captures
The same portal session appears across at least eight documents, suggesting bulk export of banking portal pages during the Manhattan federal prosecutor's financial seizure (PAPER TRAIL Project, 2026a). This duplication pattern is consistent with forensic document collection procedures where an investigative team captures every accessible page of an online banking session, including repeated instances of login screens, account dashboards, and transaction histories.
The eight-document cluster represents a moment frozen in time: Kahn logged into Deutsche Bank's portal, accessing the Southern Financial LLC account that processed $606.9 million in inflows and $194.7 million in outflows (PAPER TRAIL Project, 2026b). This is the account through which the largest documented Epstein financial flows moved.
The Redaction Problem
DOJ redacted names, addresses, and identifying information throughout the Epstein file releases. In some cases, the redactions were so aggressive that victim names, minor identifiers, and even paragraph numbers were blacked out. In other cases — documented in the February 2, 2026 emergency takedown — victim identities were left completely unredacted, exposing 43 or more individuals including 24 minors with home addresses (PAPER TRAIL Project, 2026c).
The banking credential release falls into a third category: technical information that is neither a personal name nor an address but is nonetheless sensitive. A user ID and account number for an online banking portal are access credentials. While the accounts were likely frozen or closed by the time of release, the credential format and convention information could have value to social engineering attacks against Deutsche Bank's authentication systems.
What It Confirms
Setting aside the redaction question, the credential capture is valuable evidence. It confirms that Richard Kahn had direct online portal access to Southern Financial LLC — not merely signatory authority on paper, but active digital control (PAPER TRAIL Project, 2026a). He was logging in, viewing transactions, and managing the account through a web browser on his personal Mac.
This level of operational access is significant because Southern Financial LLC was not a small account. It was the primary Epstein investment vehicle. The entity's $606.9 million in inflows make it the highest-volume entity in the documented financial network (PAPER TRAIL Project, 2026b). Kahn's direct portal access confirms his role as the operational financial controller — not merely a name on corporate documents.
The Source of Wealth Profile
From the same document range in Data Set 10, document EFTA01297200 reveals a separate DOJ artifact: a "Source of Wealth" profile compiled for Darren Indyke (PAPER TRAIL Project, 2026a). This profile includes Reuters reporting, Martindale.com legal directory listings, and classification markings reading "CONFIDENTIAL - PURSUANT TO FED. R. CONF." The profile appears to be a government investigative work product that was included in the released files, providing insight into how the Manhattan federal prosecutor's team was mapping the financial network.
The Broader Pattern
The banking credential release is part of a broader pattern of inconsistent redaction across the Epstein file releases. Some documents are so heavily redacted they consist entirely of black rectangles. Others contain credentials, victim names, or investigative work product that appears to have bypassed redaction review entirely.
This inconsistency is not random. The Epstein corpus contains 2.1 million files. Manual review of every page at the redaction stage was likely impossible given the 30-day statutory deadline imposed by the Epstein Files Transparency Act (Pub. L. No. 119-38, 2025). The banking credentials and the victim identity exposure both suggest that automated redaction tools were applied unevenly, with some document types receiving thorough review and others — particularly technical financial documents — slipping through.
The credentials remain in the public corpus. They are findable by anyone who searches Data Set 10 for the relevant document identifiers. Whether they should be is a question the DOJ appears not to have considered when releasing them.
References
Epstein Files Transparency Act, Pub. L. No. 119-38 (2025).
Mozilla. (2019, January). Firefox 65 release notes. Mozilla.org.
PAPER TRAIL Project. (2026a). Banking portal credentials and Source of Wealth profile [Observation]. OBSERVATIONS.md, OBS-2.
PAPER TRAIL Project. (2026b). Southern Financial LLC volume ($606.9M inflows, $194.7M outflows) [Research file]. ENTITY_OWNERSHIP.md.
PAPER TRAIL Project. (2026c). Victim identity exposure and February 2, 2026 takedown [Research file]. doj_compliance_status.md.