They call it KYC. Here's what it actually does to the people who comply.
Before you can open a bank account, buy bitcoin, or use most financial services, you must surrender your most sensitive personal data to prove you're not a criminal.
Your passport. Your selfie. Your home address. Your bank statements. All stored in databases you'll never see.
They promised your data would be safe.
Each step of "verification" hands over more of your identity. Each piece becomes a weapon if it leaks.
Full legal name, date of birth, nationality, tax ID.
Passport or driver's license — front and back.
Your face linked to your identity forever. You can't change your face like a password.
Now they know where you sleep. When Ledger leaked 272,000 addresses, home invasions followed.
Your income, employer, spending habits — an attacker knows exactly what you're worth.
After five steps, a company you just met has your name, face, passport number, home address, income, and biometric data.
Now multiply that by every service that requires KYC.
You trusted one company. Your passport now sits in five different databases.
Submit passport, selfie, address
Coinbase, Binance, Kraken…
Jumio, Onfido, Sumsub — companies you've never heard of
AWS, Google Cloud — your ID on a server somewhere
Outsourced teams in unknown jurisdictions
Billions of records. Passports, SSNs, home addresses, biometric data — all gone. These are just the ones we know about.
305 documented attacks since 2014. Home invasions, kidnappings, torture, murder.
Source: GART Research & Jameson Lopp
The Ledger breach is the clearest proof that KYC data creates physical danger.
Every piece of identity you hand over becomes a liability stored in a database you don't control, protected by a company that will eventually get breached.
The question isn't if your data will leak. It's how many times it already has.
Data sourced from public breach disclosures, GART Research, Jameson Lopp, and verified security research.