Privacy advocates are calling for a fundamental rethink of how know-your-customer data is gathered and stored, arguing that the sprawling troves of personal information collected by crypto exchanges and financial services have become prime targets for hackers.
The Problem With Centralized KYC
Every time a user signs up for a regulated crypto platform, they typically hand over sensitive documents — government IDs, proof of address, sometimes biometric data. That information is then stored in centralized databases, creating vast repositories of personal records that are attractive to attackers, according to Coin Center's Laz Pieper.
The concern is not hypothetical. Data breaches at financial and identity-verification firms have repeatedly exposed millions of people to fraud and identity theft. Once compromised, the underlying information — a person's real name, address, or biometric details — cannot simply be reset like a password.
When you concentrate everyone's most sensitive data in one place, you build a target too tempting for criminals to ignore.
The regulatory requirements that mandate KYC collection were designed to combat money laundering and illicit finance. But the way that data is retained often exceeds what any single service actually needs to operate, leaving users exposed to risks they never consented to.
A Case for Privacy-Preserving Verification
Pieper argues that emerging cryptographic tools could break the trade-off between compliance and privacy. Instead of surrendering entire documents, individuals could prove only the specific fact a service requires — such as being over 18 or residing in an approved jurisdiction — without revealing the underlying data.
Such systems would keep personal information under the individual's control, sharing verified attributes rather than raw records. This approach could satisfy regulatory obligations while dramatically shrinking the honeypots that hackers pursue.
Key advantages of privacy-preserving identity verification include:
- Users disclose only what a service legitimately needs to know
- Sensitive underlying data stays in the individual's possession
- Centralized databases holding mass personal records become less necessary
The shift would require buy-in from regulators, platforms, and technology providers alike. But as breaches continue to mount, advocates say the status quo of hoarding sensitive data is increasingly untenable — and that redesigning identity verification around privacy is both possible and overdue.