When an exchange writes on its website “we use bank-grade encryption and comply with GDPR,” this is a marketing formula, not a description of the real data storage architecture.
Legally - they are correct.
Technically - everything is far more complex and far more dangerous for the user.
It is precisely this gap between declared security and actual practice that needs to be examined.
1. How data is actually stored - without advertising claims
1.1. KYC is almost never “inside the exchange”
Most large CEXs do not have their own KYC infrastructure. It is unprofitable, expensive, and legally risky.
Instead, third-party vendors are used:
- Onfido
- Jumio
- Sumsub
- Trulioo
IDnow
The flow looks like this:
- You upload your passport and selfie not to the exchange's server, but to the KYC vendor’s cloud
- The documents are processed by AI plus manual review
- The exchange receives:
- a status (verified / rejected)
- metadata
- often copies of the documents themselves
⚠️ Key point:
A single breach or leak at the vendor level means the compromise of dozens of exchanges at once.
This is a systemic risk that exchanges prefer not to talk about.
1.2. “Account deletion” does not mean data deletion
Under AML/CFT requirements:
- EU: 5 years
- United Kingdom: up to 6 years
- USA: 5–10 years
- Some jurisdictions: up to 12 years
Even if:
- you closed the account
- deleted the profile
- contacted support
👉 your passport, selfie, and proof of address remain in archives.
The architecture usually looks like this:
- Hot storage — active users, support access
- Warm storage — recently closed accounts
- Cold archives — offline storage (S3 Glacier, tape backups, air-gapped storage)
But there is a nuance that is rarely mentioned:
During any “investigation,” re-verification, or regulator request,
the data is moved back into the hot zone, where humans have access to it.
1.3. Insider threat — the industry’s real nightmare
The most vulnerable part of the system is the human.
In practice:
- support is often outsourced
- wages are low
- controls are formal
- audits are selective
Typical geography:
- Philippines
- India
- Eastern Europe
- Latin America
A support operator can see:
- passport
- selfie
- address
- IP logs
- login history
- sometimes transaction data
💡 Little-known fact:
On some exchanges, a single operator may service 5–10 projects simultaneously (via one contractor).
This means cross-access between ecosystems.
2. Leaks and incidents: what actually happened
2.1. Binance (2019)
Leaked online:
- user photos with passports
- selfies holding “Binance” notes
The exchange stated:
“This was a leak on the side of a former KYC contractor”
What matters:
- the data surfaced a year after the vendor was replaced
- hackers demanded 300 BTC
- parts of the dataset are still circulating in private databases
2.2. Coinbase (2024–2025)
One of the most illustrative cases.
Not a hack.
Not a bug.
Employee bribery.
- support contractors were recruited
- access to admin panels
- data of ~70,000 users exfiltrated
Including:
- ID documents
- addresses
- KYC history
- internal risk-team notes
This is a classic insider breach that cannot be prevented by encryption alone.
2.3. Genesis Market (2023) — a warning signal
Genesis Market did not just sell documents.
It sold:
- cookies
- browser fingerprints
- sessions
- KYC photos
- behavioral patterns
Result:
- the hacker logged into the account
- 2FA did not trigger
- the system saw a “trusted device”
👉 This showed that KYC + behavioral analytics can be weaponized against the user.
2.4. BTC-e / WEX Telegram bot (2020)
One of the most underestimated cases.
The database included:
- passports
- addresses
- emails
- internal staff comments
Example labels:
- “suspicious”
- “likely cash-out”
- “possible linkage”
⚠️ These notes are never deleted, never reset, and can resurface years later.
3. Governments and exchanges: more than official requests
3.1. Semi-automated gateways
Large CEXs in the US and EU use systems where:
- a request from law enforcement
- automatic format validation
- a response — within hours
Lawyers get involved after the fact.
This is no longer a manual process, but an API-like workflow.
3.2. CARF — the end of “quiet” anonymity
Crypto-Asset Reporting Framework:
- rollout: 2026–2027
- automatic exchange
- balances
- profits
- fund movements
Important:
- even without fiat
- even without withdrawals
- even if you just hold assets
👉 The exchange becomes a tax informant, not just a platform.
3.3. Blacklists and Source of Wealth
It only takes:
- an indirect link
- via a mixer
- via DeFi
- via 5–10 hops
And you get:
- an account freeze
- a Source of Wealth request
- the inability to prove past activity
At that moment, the exchange is not your ally, but the regulator’s executor.
4. AI and collective liability
Since 2025, active deployment includes:
- graph models
- user clustering
- reputation scoring
If you interact with a “flagged” account:
- your profile inherits risk
- limits are reduced
- checks become more frequent
This is already social scoring, not classical AML.
Short but brutal conclusions
- KYC is forever, even after account closure
- The main threat is people, not servers
- Leaks are systemic, not accidental
- In 2026, CEX = a point of total financial surveillance
This is not theory.
This is already an operating reality.
5. Little-Known but Critically Important Details Rarely Discussed
This is the part that even industry media seldom publish, because it’s inconvenient both for exchanges and regulators.
5.1. The “Second Life” of Your KYC Data
After the initial verification, the data does not just sit idle.
It gets reused:
- to train internal anti-fraud models
- to calibrate risk scores
- for retrospective analysis (“did we make a mistake back then?”)
💡 Little-known fact:
In some jurisdictions, anonymizing KYC data is only formally allowed. In practice, the data:
- is partially hashed
- is tokenized
- but can be restored using internal compliance keys
In other words, “anonymization” is often reversible.
5.2. Internal “Black Profiles”
Large exchanges maintain internal risk profiles that users never see:
Example parameters:
- “likelihood of regulatory scrutiny”
- “behavioral instability”
- “unusual pattern changes”
- “geographic anomalies”
These profiles:
- are not deleted
- are not reset
- transfer over during mergers, business sales, or jurisdiction changes
👉 Even if an exchange “moves countries,” the database moves with it.
5.3. Mergers, Acquisitions, and Database Transfers
GDPR permits the transfer of personal data in cases of:
- business acquisition
- restructuring
- bankruptcy
- asset transfer
What this means in practice:
- you completed KYC on one exchange
- three years later it gets acquired
- your passport data legally ends up with another company
And you are not required to give consent again.
5.4. Logs – The Most Underrated Source of Leaks
Even if documents are encrypted, the following remain:
- access logs
- audit logs
- debug logs
- API errors
These often contain:
- passport file names
- country
- document type
- date of birth
- sometimes base64 fragments
⚠️ These logs:
- are rarely cleaned
- are often accessible to DevOps teams and contractors
- can be stored for years
6. Why “Zero Anonymity” Is Not a Slogan but an Architectural Reality
6.1. The KYC + On-Chain Analytics Link
Today, every major exchange uses:
- Chainalysis
- TRM Labs
- Elliptic
- Crystal
The model is simple:
- KYC → real-world identity
- Addresses → network graph
- Behavior → profile
From there, the system operates automatically.
Even if you:
- changed addresses
- used DeFi
- made 20 intermediary hops
the graph still collapses.
6.2. Reputation as a Lifetime Attribute
A little-known but crucial point:
Reputation risk is inherited.
If:
- your old account had a flag
- you completed KYC again
- you use the same jurisdiction or device
The system links profiles probabilistically, not formally.
This is no longer an “account” but a digital shadow.
7. Practical Takeaways Without Moralizing
No slogans. No calls to action.
What matters to understand:
- Top CEX ≠ wallet or bank.
It is an observation node. - Account deletion ≠ data deletion.
- Regulatory interest does not vanish over time.
It accumulates. - Control technologies outpace legal guarantees.
What not to do (common mistakes):
- assume “small amounts don’t matter”
- believe “one exchange = one database”
- think changing accounts solves the problem
- ignore behavioral metadata
8. Key Takeaway
KYC on top exchanges is not just identity verification.
It’s an entry point into a long-term system of:
- storage
- analysis
- correlation
- transfer
And this system does not forget.
