Identity for Crypto & Web3

The job identity does in crypto and Web3

Crypto sits between two identity worlds. Exchanges, custodians and on-ramps must run KYC and AML like any financial institution, while the on-chain world is pseudonymous and self-custodial by design. Identity has to verify real people at onboarding, protect accounts where a single bad approval moves irreversible funds, and govern the signing keys and cloud sessions that control wallets.

Crypto and Web3 account for 6 of the 123 incidents in the Identity Breach Database (4.9%): 3 disclosed in 2021-2022 and 3 in 2025-2026. The count is small, but the losses are the largest in the database. The three records that carry a stolen-value figure are all crypto, per the Identity Breach Report 2026: about $34 million, almost $620 million and about $1.5 billion. The sixth, the Binance wallet theft disclosed on October 30, 2026, carries no figure yet: Binance said about $6.34 billion in digital assets were impacted and about $2.85 billion frozen or intercepted as of November 3, subject to reconciliation.

The identity threat picture, from the incident record

MFA that was present and defeated. In 3 of the 6 incidents MFA was on the abused account and bypassed; in 2 there was no interactive login for it to protect, and the Binance record does not yet state MFA status. No crypto record shows MFA simply absent. In 2021, attackers who already held victims' passwords abused a flaw in Coinbase's SMS account recovery to obtain two-factor codes, and at least 6,000 customers had funds stolen. In January 2022, Crypto.com found withdrawals from 483 accounts approved without the user entering a 2FA code, worth about $34 million; it revoked every customer's 2FA token and added a 24-hour delay for new withdrawal addresses. Both are failures of account recovery and step-up logic, not of the second factor itself.

Signing keys and cloud sessions as identities. The two largest thefts went through identities rather than smart contract code, and both were attributed to North Korean operators. At Ronin, attackers used keys for five of the bridge's nine validators to sign withdrawals worth almost $620 million. Four came from Sky Mavis infrastructure, and the fifth from a temporary validator allowlist granted in late 2021 that was never revoked. The FBI attributed it to Lazarus Group. At Bybit, a Safe{Wallet} developer's Mac was compromised on 4 February 2025, and the attackers hijacked the developer's active AWS session tokens to alter the multisig front end Bybit used to sign transactions, avoiding the need to pass MFA. About $1.5 billion in ether was drained on 21 February; the FBI attributed it to TraderTraitor. The technique is token replay on an unbound endpoint.

Bought insiders in support. In May 2025 Coinbase disclosed that an attacker had paid overseas support contractors or employees to collect customer data, then demanded $20 million not to publish it. 69,461 people were notified, and the data was used to impersonate Coinbase and talk customers into sending funds. Coinbase's 8-K preliminarily estimated $180 million to $400 million in remediation and reimbursement costs.

The regulatory floor

• KYC, AML and the FATF Travel Rule require identifying customers and parties to certain transfers. In the EU, the AML Regulation's single rulebook for customer due diligence, including remote onboarding with eIDAS electronic identification, applies to crypto-asset service providers from 10 July 2027, and AMLA direct supervision of selected institutions is expected from 2028. See AML and KYC.
• MiCA sets authorization requirements for crypto-asset service providers in the EU, and providers authorized under MiCA are also financial entities under DORA Article 2(1)(f); firms operating only under a national transitional regime are not. DORA requires strong authentication, least-privilege access and privileged access monitoring. The next register of information on ICT third parties is due 31 March 2027. See identity controls for DORA.
• New York virtual currency firms licensed by DFS are Covered Entities under NYDFS Part 500 by virtue of that license. MFA for every user has applied there since 1 November 2025 and the next annual compliance certification is due 15 April 2027.
• Privacy law covers the personal data collected in verification: GDPR, Singapore's PDPA for firms such as Crypto.com, and the UAE PDPL for firms such as Bybit.

The identity controls that matter most

1. Phishing-resistant authentication, and no SMS fallback in recovery. FIDO2 security keys and passkeys defeat code relay, and recovery must be at least as strong as login. Coinbase's 2021 losses came through the recovery path. See SIM swap for why SMS cannot carry this weight.
2. Server-side step-up and delays on money movement. Enforce step-up authentication on the server for withdrawals and new addresses, and hold new payees for a delay. Crypto.com's 24-hour hold limits what any authentication flaw can drain.
3. Signing keys governed as non-human identities. Separate validator and multisig keys across organizations and hardware, and revoke temporary delegations when the need ends. See non-human identity security.
4. Short-lived, device-bound sessions for developers and cloud consoles. Bybit shows a hijacked session carries the power of a fresh MFA login. Device-bound session credentials, proof of possession and separate approval for production front-end changes break the chain.
5. Least-privilege support access. Support agents should see the records a ticket needs, with per-record justification and alerts on lookup volume. See least privilege and identity threat detection and response.
6. Strong onboarding with reusable credentials where possible. Document and liveness checks with sanctions screening, and reusable KYC with verifiable credentials to cut repeated proofing.

Vendor categories and named vendors

• KYC and AML: Sumsub and Persona for document, liveness and screening workflows. See best identity verification for startups.
• Reusable and on-chain identity: Civic; see best decentralized identity for KYC.
• Customer authentication: Auth0 and Transmit Security for passkeys and risk-based step-up. See best passwordless CIAM providers.
• Phishing-resistant staff MFA: Yubico hardware keys; see best phishing-resistant MFA.
• Production and cloud access: Teleport for short-lived, certificate-based infrastructure sessions, and HashiCorp Vault for secrets and key management.
• Access governance for support: Veza for mapping who can see which customer data.

Background on requirements is in identity for crypto and Web3.

Common pitfalls

• Strong login with a weak recovery path, the exact gap in Coinbase's 2021 incident.
• Client-side or bypassable checks on withdrawals.
• Temporary key delegations that are never revoked, as at Ronin.
• Support tools that let one agent browse thousands of customers.
• Recovery designs that quietly reintroduce custodial risk.

Where it is heading

The EU AML Regulation and MiCA push exchanges toward bank-grade identity controls, and reusable verifiable credentials promise lower-friction KYC. The incident record says the bigger shift is internal: treating developer sessions, signing keys and support access as the identities that actually move funds.

Frequently asked questions

How do attackers steal from crypto exchanges through identity?

In the database's 5 crypto incidents: bypassing 2FA through recovery or approval flaws (2), stolen signing keys (1), a hijacked developer cloud session (1) and paid insiders in support (1). None required breaking cryptography.

Is SMS two-factor enough for an exchange account?

No. Coinbase's 2021 losses came from an SMS account recovery flaw. Security keys or passkeys, with recovery that does not fall back to SMS, close that path.

What is the Travel Rule?

A FATF requirement (Recommendation 16 as applied to virtual assets through Recommendation 15) that virtual asset service providers obtain, hold and pass on identifying information about the originator and beneficiary of virtual asset transfers, applied through national AML law.