- What Exchanges Really Know About You — and How Long They Keep It
- When the Law Requires Silence — and When It Requires Disclosure
- The Scale of Surveillance: Transparency Report Statistics
- The Myth of Anonymity: How Criminals Are Tracked
The cryptocurrency industry is still haunted by the myth of complete anonymity. Many users believe that digital assets are the modern equivalent of cash—money that can be transferred without attracting the attention of governments or regulators.
The reality, however, is quite different. A centralized cryptocurrency exchange often knows more about you than your bank does. Under certain circumstances, it may also be willing—or legally required—to hand over your personal data to law enforcement agencies in virtually any country.
The issue gained renewed attention after a recent Reuters report revealed that user data obtained from Binance had been provided to Russian authorities and was later used as evidence in a terrorism financing case. Legal experts immediately pointed out a potential legal conflict: Binance officially exited the Russian market in 2023 and, as a company operating under EU jurisdiction, could have been prohibited from sharing such information under the General Data Protection Regulation (GDPR).
The case highlighted an important reality: the country where an exchange is registered is not always a reliable shield against requests from foreign law enforcement agencies.
What Exchanges Really Know About You — and How Long They Keep It
Know Your Customer (KYC) procedures have transformed cryptocurrency exchanges into fully regulated financial institutions with strict compliance requirements.
According to Denis Polyakov, Head of the Digital Economy Practice at GMT Legal, a typical exchange database contains:
• Complete identity records: passport or ID documents, selfies for identity verification, and proof of address (utility bills).
• Digital footprint: login history, IP addresses, device information, and activity logs.
• Financial history: every deposit, withdrawal, internal transfer, P2P transaction, and transfer to external wallets.
Mikhail Uspensky, a member of the Russian State Duma’s Cryptocurrency Expert Council, notes that KYC procedures are designed to identify potentially illegal activity from the moment a user registers.
The retention period is equally significant. Most exchanges keep customer data for three to five years after the last account activity or after the account has been closed.
“Data retention policies, deletion procedures, and other important details are usually buried in the fine print of the user agreement—documents that many people accept without ever reading,” Uspensky warns.
By checking the box that says, “I agree to the Privacy Policy,” users effectively grant the exchange long-term permission to retain their digital profile.
When the Law Requires Silence — and When It Requires Disclosure
Providing customer information to government authorities is not an arbitrary decision made by an exchange’s security team. It is typically governed by legal procedures, and exchanges generally disclose information only in response to official requests.
Legal Grounds for Disclosure
According to Denis Polyakov, one of the key factors is whether the requesting country has a mutual legal assistance treaty (MLAT) or similar legal cooperation agreement with the jurisdiction where the exchange operates. If no such agreement exists, the exchange may legally ignore requests from a foreign police agency or prosecutor’s office. In practice, however, major exchanges often cooperate voluntarily to maintain constructive relationships with regulators.
Uspensky identifies the most common legal grounds for disclosure:
• Court orders: the most common and legally compelling basis, typically issued during criminal investigations.
• Prosecutorial requests: less common and usually subject to stricter procedural requirements.
• Tax authority requests: in some jurisdictions, including those participating in the Common Reporting Standard (CRS), certain financial information may be exchanged automatically.
“Other types of requests can remain under review for months and are frequently rejected in the end,” Uspensky explains.
To process these requests efficiently, major exchanges such as Binance operate dedicated systems like the Law Enforcement Request System (LERS). Law enforcement officers must first verify their identity before gaining access.
Once a valid preservation order is received, an exchange is generally required to preserve the relevant records for at least 90 days, preventing a suspect from withdrawing funds while the request is being processed.
The Scale of Surveillance: Transparency Report Statistics
Leading cryptocurrency exchanges publish annual Transparency Reports, and the numbers illustrate the scale of cooperation with law enforcement.
• Kraken (2025): nearly 8,000 requests from authorities in 74 countries, a 15% increase year over year. The largest share came from the United States (28%), followed by the United Kingdom (11%) and Germany (6%).
• Coinbase (October 2024 – September 2025): approximately 12,700 requests from more than 60 countries, up 19% from the previous reporting period.
• OKX (2024): nearly 35,000 requests processed from 1,036 law enforcement agencies across 110 jurisdictions.
Receiving a request does not automatically mean that a user is suspected of criminal activity. Exchanges frequently assist in identifying victims of fraud, tracing stolen funds, or verifying the lawful origin of assets during civil disputes.
The industry is also moving toward more proactive cooperation.
The Beacon Network, an initiative developed by TRM Labs, brings together Coinbase, Binance, Kraken, and OKX. Its purpose is straightforward: when law enforcement identifies stolen cryptocurrency, investigators can submit the wallet address to Beacon, which immediately alerts participating exchanges to freeze any attempted deposits or withdrawals involving those assets.
The Myth of Anonymity: How Criminals Are Tracked
A common concern among newcomers is, “Will they identify me through my IP address?”
Experts argue that, in practice, de-anonymization is usually much simpler. It happens at the intersection of on-chain and off-chain data.
As Uspensky explains, users of centralized exchanges have no direct connection to the public blockchain. The wallet addresses displayed in an exchange app belong to the exchange itself—they are custodial addresses. A single exchange may control hundreds of such wallets, while the mapping between each wallet and a customer’s internal account ID exists only in the exchange’s private databases.
Denis Polyakov describes a typical investigation as follows:
• Investigators determine that a suspect used Exchange X.
• They request records showing where User Y transferred funds.
• The exchange provides the list of external wallet addresses associated with those withdrawals.
Investigators then use blockchain analytics platforms such as Chainalysis or Crystal to trace the movement of funds through transaction patterns and address clustering heuristics.
Once the funds arrive at another centralized exchange, investigators submit a new legal request to that platform, seeking information about the recipient.
In this way, the transparency of the blockchain itself becomes a powerful investigative tool.
Without assistance from an exchange, blockchain transactions appear to be nothing more than transfers between anonymous strings of characters. But once a single exchange links a wallet address to a verified identity, years of financial activity can become an open book for investigators.
Conclusion
Today, meaningful financial privacy in the cryptocurrency ecosystem largely depends on using decentralized tools, such as decentralized exchanges (DEXs) and self-custodied cold wallets.
The moment you complete KYC verification on a centralized exchange, the concept of financial anonymity changes fundamentally. Your personal information becomes part of an international data-sharing ecosystem, and the only things standing between your customer file and a foreign law enforcement agency may be a judge’s signature and the speed of the exchange’s legal department.
