You're not a criminal. But every time you sign up for a financial service, you have to prove it. Here's what happens to that proof.
KYC — "Know Your Customer" — flips that on its head. Before you can open a bank account, buy bitcoin, or use most financial services, you must hand over your most sensitive personal data to prove you're not a criminal.
Your passport. Your selfie. Your home address. Your bank statements. All stored in databases you'll never see, managed by companies you have no reason to trust.
They promised your data would be safe.
Each step of "verification" hands over more of your identity. Each piece of data becomes a weapon if it leaks.
After five steps, a company you just met has your name, face, passport number, home address, income, and biometric data.
Now multiply that by every service that requires KYC.
You think you're giving your data to one company. In reality, it passes through a chain of organizations — each one a potential breach point.
Submit your passport, selfie, address
Coinbase, Binance, Kraken…
Jumio, Onfido, Sumsub — companies you've never heard of
AWS, Google Cloud — your ID on a server somewhere
Outsourced teams with database access in unknown jurisdictions
You trusted one company. Your passport photo now sits in five different databases, managed by organizations you've never heard of. Any single breach in this chain exposes everything.
A timeline of the largest data breaches. Billions of records. Passports, SSNs, home addresses, biometric data — all gone. These are just the ones we know about.
305 documented physical attacks against cryptocurrency holders since 2014. Home invasions, kidnappings, torture, murder. The data collected by KYC makes people targets.
Source: GART Research & Jameson Lopp
The Ledger breach is the clearest proof that KYC data collection creates physical danger.
This is not an exhaustive list. These are just the ones we know about.
Every piece of identity you hand over becomes a liability stored in a database you don't control, protected by a company that will eventually get breached.
The question isn't if your data will leak. It's how many times it already has.
Data sourced from public breach disclosures, regulatory filings, GART Research, Jameson Lopp, and verified security research. This is not exhaustive — thousands of smaller breaches go unreported every year.