General information, not legal or tax advice. Rules change; check the authorities in your country. Status 23 October 2026.
Regulators ask exchanges to collect ID so crime can be traced. The side effect: large databases of names, addresses, ID photos and crypto balances.
The risk is not theoretical
In May 2025 Coinbase told the SEC that criminals had bribed overseas support staff to copy customer data, including names, addresses, ID images and balances, for less than 1% of monthly transacting users. The attackers demanded $20 million; Coinbase refused. Passwords and private keys were not taken, but leaked data can be used for phishing and even physical threats.
Why it matters more with Bitcoin
The blockchain is public. Once an exchange links your identity to an address, anyone with that link can follow the coins. See pseudonymity.
Practical, legal steps
- Withdraw to your own wallet instead of storing coins on the exchange.
- Use a new address for each receive.
- Use strong, unique logins and treat unexpected "support" calls as scams.
- Share only what the law requires.
KYC cannot be avoided on regulated exchanges. Bitcoin's contribution is that, after purchase, you do not need the exchange at all.