Privacy Technology · Monetary Sovereignty & Digital Money

From Database to Doorstep: 153 Million Driver’s Licenses, Crypto Data Leaks and the KYC Paradox

How exposed identity documents, exchange records, tax data and transparent blockchains can combine to create digital and physical security risks — and why privacy by default matters.

By Dr. Max Anon · September 5, 2026

Ryo Merchant Network

Featured in the Ryo Directory

Businesses accepting RYO

←

Online Stores

Luna Azul

Accepts RYO Online ✓ Payment Verified

Premium online boutique offering leather products through a refined ecommerce storefront, with Ryo Currency accepted directly…

View Business →

★ Featured Placement

Feature Your Business

Put your business in front of the Ryo community.

5000 RYO · 30 days Get Featured →

→

Key Takeaways

• The reported 153 million+ figure describes the scale of a marketplace dataset, not a confirmed count of 153 million unique victims.^[1]
• A stolen driver’s license does not cryptographically defeat strong MFA, but it can strengthen impersonation, SIM-swap and account-recovery attacks around it.^[5][6]
• Crypto-specific breaches can add a dangerous wealth signal to ordinary identity exposure; France’s recent violent attacks show why financial privacy can become a physical-security concern.^[28][36]
• Lawful or mandatory disclosure does not eliminate privacy risk. Data entrusted to exchanges, tax systems and other institutions still has to survive insiders, credential theft and external compromise.
• Ryo cannot undo an identity breach. Its relevance is compartmentalization: a private-by-default ledger can reduce the public financial graph available to be fused with identity and location data.^[13]

The Nexus story is a useful starting point because it forces a distinction that ordinary breach reporting often misses. A stolen password is a credential failure. A stolen driver’s license is an identity-layer failure: the exposed object contains attributes that other institutions may use to decide who you are.

For cryptocurrency holders, that distinction matters more than it first appears. The danger is not confined to fraudulent credit applications or phishing. Once an identity record can be joined to exchange data, tax records, hardware-wallet customer data or a transparent blockchain, the same person can become associated with a home address, a crypto relationship and an estimate of wealth.

France’s recent experience shows why that combination deserves to be treated as a personal-security problem, not merely a data-protection problem. The country has suffered a wave of kidnappings, attempted abductions and violent extortion directed at crypto holders and their families. The public record does not establish that a particular leaked database caused a particular attack. It does establish that identity, location and financial information are valuable targeting inputs once they leave their intended context.

This article therefore asks a broader question than who breached whom: how much damage can one disclosure do when every other layer of the financial system is designed to reveal more?

1. What the Evidence Establishes

Before moving from the breach itself to its implications, the evidence needs to be separated into three categories: what has been directly established, what current security standards show to be technically plausible, and what remains inference. The table below is the evidentiary baseline used throughout the article.

That distinction is especially important for the 153 million figure and for the later discussion of physical attacks. Both subjects invite headlines that outrun the underlying record.

2. The Breach Is Not Merely a Breach

Data-breach reporting tends to compress unlike events into one vocabulary. An email address leaks. A password hash leaks. A credit-card number leaks. A government identity document leaks. All become “records.” Their security properties are not equivalent.

A password can be rotated. A card number can be cancelled. An authentication token can be revoked. A face, date of birth and historical identity record are much harder to replace. A driver’s license can also contain or encode a residential address, document number, physical characteristics, signature and machine-readable information, depending on jurisdiction. The Nexus material reportedly went further: Krebs found six images associated with his record, including front and back captures in ordinary, infrared and ultraviolet imaging modes.^[1]

That distinction matters because the document is valuable not only for what can be read from it, but because other systems are trained to trust it.

The current NIST Digital Identity Guidelines define a driver’s license as identity evidence: documentation supporting the real-world existence of a claimed identity. NIST’s proofing model then separates resolution, validation and verification. Attributes can be checked against authoritative sources such as state departments of motor vehicles; the claimant may also be asked to establish that the person presenting the evidence is its rightful owner.^[3]

This is why a high-quality license scan is better understood as a reusable identity artifact. It can carry several pieces of mutually reinforcing information in one object: a name, a face, a government identifier, an address and the visual grammar of an authentic credential.

3. From Identity Document to Attack Surface

The obvious risks are familiar. The U.S. Federal Trade Commission warns that exposed driver’s-license information can be used to impersonate the holder and recommends contacting the issuing motor-vehicle authority and protecting credit files when such information is compromised.^[9] Credit fraud, fraudulent account opening and targeted social engineering are direct applications.

The more consequential problem is that leaked identity data can be combined with data from other breaches. A criminal does not need one perfect database if several imperfect databases can be joined. A license image can be matched with an email address from one breach, a telephone number from another, a password reuse event from a third and a public social profile that supplies context for convincing impersonation.

Generative AI lowers the cost of packaging those fragments into something coherent. In 2024, the U.S. Treasury’s Financial Crimes Enforcement Network reported increased suspicious-activity reporting involving deepfake media and specifically highlighted fraudulent identity documents used to circumvent identity verification and authentication. The agency described schemes combining falsified or altered documents with stolen personally identifiable information and synthetic identities.^[8]

This does not mean that possession of a driver’s license scan is sufficient to pass a competent modern proofing process. NIST recommends validation against authoritative sources, biometric comparison and controls for forged or manipulated media. It means only that the attacker starts with better source material.

4. The Strong Front Door and the Recovery Door

Security advice often ends with “enable 2FA.” That is good advice, but authentication is a system rather than a checkbox.

An account protected by a strong password and a hardware security key may still need a procedure for the day its legitimate owner loses the key. NIST SP 800-63B explicitly recognizes repeated identity proofing as one class of account-recovery method. After successful recovery, a subscriber may bind new authenticators to the account.^[5]

That creates an unavoidable engineering question: is the recovery path at least as resistant to impersonation as the normal login path?

The answer depends on the implementation. A properly designed recovery process does not simply accept a photograph of a license. It may require authoritative validation, a live biometric comparison, recovery codes, previously verified contact channels, waiting periods and independent notifications. But weaker systems and human support processes exist, and identity-rich leaks improve the material available to attack them.

A stolen driver’s license does not necessarily give an attacker the key to an account. It may help the attacker convince a system to issue a new key.

SIM Swapping and 2FA: What the License Can — and Cannot — Do

The distinction is especially important for SMS-based second factors.

U.S. cybersecurity guidance has repeatedly warned that SMS and voice codes are vulnerable to number-porting and SIM-swap attacks. In a successful SIM swap, the attacker persuades or compromises a carrier process so that the victim’s telephone number is reassigned to a SIM or device under the attacker’s control. Incoming text messages and calls then follow the number.^[6][7]

Identity data is useful here because telecom fraud frequently contains a social-engineering component. The attacker may know a legal name, address, date of birth, account context and other attributes before contacting a carrier or attempting recovery elsewhere. A driver’s-license scan can strengthen that pretext. It does not guarantee that a carrier will accept it, and modern carrier controls are intended to resist precisely this class of attack.

The technical conclusion should therefore be stated narrowly:

• SMS 2FA can be undermined if an attacker successfully gains control of the telephone number.
• TOTP authenticator codes are not derived from the driver’s license and are not cryptographically broken by its disclosure.
• FIDO2/passkeys and hardware security keys remain substantially stronger against phishing and remote account takeover when recovery is designed to the same standard.
• The weakest recovery mechanism can dominate the effective security of the account if it allows stronger authenticators to be replaced.

This is a recurring privacy-engineering pattern. A system can be strong at one layer and weak at the junction between layers. The ProxyMark analysis reached a related conclusion in a different domain: ledger privacy and transport privacy cannot be evaluated as isolated properties when information from several layers can be fused.^[10]

5. Crypto-Specific Breaches Change the Threat Model

The Nexus dataset is alarming because a driver’s license can identify a person. Cryptocurrency-specific breaches can add another variable: why that person may be worth targeting.

This distinction changes the threat model. A generic consumer breach may reveal a home address. A crypto-service breach may reveal a home address plus evidence that the resident purchased a hardware wallet, held an exchange account, filed a cryptocurrency claim or had a particular account balance. The private key can remain perfectly secure while the information surrounding its owner becomes more dangerous.

The Hardware-Wallet Paradox: The Keys Can Be Safe While the Owner Is Exposed

Ledger’s incident makes the distinction clear: the hardware wallets remained uncompromised and private keys were not extracted, yet the ecommerce breach associated approximately 272,000 customers with names, addresses and telephone numbers.^[27]

The wallet can perform its narrow job correctly while another system exposes its owner. Security can succeed at the key-management layer while failing at the identity layer.

The Coinbase incident demonstrates an even richer version of the same asymmetry. Its SEC filing says private keys and passwords were not compromised, but government-ID images, physical addresses, balance snapshots and transaction history were among the data taken. Coinbase itself warned that the material could be used in social-engineering attempts.^[28]

That is no longer merely a phishing list. It can resemble a target dossier.

The central privacy problem is therefore not that one database knows everything. It is that many databases know different things about the same person, and persistent identity fields provide the join keys.

The danger is not that one database knows everything about you. It is that every database knows something about you — and your identity can join them together.

6. The KYC Paradox

Now consider the cryptocurrency user who reads about a dataset containing more than 153 million reportedly exposed driver’s-license records and reaches a reasonable conclusion: I should disclose less identity data.

The user decides to acquire a privacy coin.

The exchange responds: upload your driver’s license.

That is the KYC paradox. The user seeks stronger financial privacy by first creating another copy of the credential whose replication created the security problem.

This is not an argument that customer due diligence has no legitimate purpose. Financial institutions and regulated virtual-asset service providers operate under anti-money-laundering, sanctions and customer-identification obligations that vary by jurisdiction. The Financial Action Task Force continues to press jurisdictions to implement its standards for virtual assets and VASPs, including risk-based customer due diligence and information-sharing requirements.^[11][12]

The engineering consequence nevertheless remains: every additional party that collects a reusable identity artifact becomes another custodian of that artifact.

This matters even more after the crypto-specific incidents above. Coinbase demonstrates that a single centralized service can hold identity documents, home addresses and account-level financial information at the same time. Where identity collection is optional, minimizing it reduces the breach inventory. Where disclosure is legally required, the obligation shifts toward strict purpose limitation, segmentation, retention controls and accountability.

The security objective should therefore not be “collect everything and promise never to lose it.” It should be to collect the minimum information required for the stated purpose, retain it for no longer than necessary, separate it from unrelated activity and avoid creating identity repositories where the service can function without them. NIST’s own identity-resolution guidance begins with collection of the minimum amount of identity evidence and attributes needed for the proofing task.^[3]

7. Mandatory Disclosure Does Not Make Data Harmless

The privacy discussion becomes harder when disclosure is not optional.

France requires French tax residents to report certain qualifying crypto-asset accounts held abroad to the tax administration. Current implementing rules require account declarations to include identifying information about the declarant and, where applicable, the account holder or beneficial party.^[40] France has also implemented expanded reporting obligations for crypto-asset service providers. A December 2025 decree states that the new provider-reporting regime applies to transactions beginning January 1, 2026, with reports beginning in 2027; the underlying law requires providers to report identifying information and transaction data to the tax administration.^[41]

These requirements have a legitimate public-law purpose, but they also create a security fact: tax authorities and reporting intermediaries may hold unusually sensitive combinations of identity and financial information. The conclusion is not to conceal legally reportable assets. Tax compliance and privacy engineering are separate questions. Required data should still be tightly segmented, access-controlled, audited and not unnecessarily replicated.

The Alleged French Tax-Insider Case

That distinction is no longer theoretical in France. A former employee of the French tax administration in Bobigny, identified in reporting as Ghalia C., remains accused of abusing internal tax software to obtain information outside the scope of her work and passing information to criminals. Le Parisien reported that investigators found searches involving cryptocurrency specialists among other targets; Protos reported that she admitted passing information to men later involved in a violent attack on a prison officer, while disputing knowledge of how the information would be used.^[42][32]

Chainalysis’s August 2026 review of violent crypto crime describes the alleged tax-data compromise more broadly, saying dossiers on high-net-worth crypto holders included names, addresses, holdings, telephone numbers and tax records and were allegedly sold through criminal intermediaries. Chainalysis characterizes that compromise as the “likeliest culprit” behind France’s subsequent surge in violent crypto attacks.^[33]

That latter conclusion should be treated as an analytical assessment rather than a judicial finding. The ongoing criminal case does not establish that every French attack came from tax records, nor does the public record demonstrate that the tax administration as an institution sold information. The allegation concerns abuse by an employee with legitimate access.

But the security lesson is already clear: authorization is not the same thing as safety. A firewall is designed to keep an outsider out. It is less useful when the person querying the database already possesses valid credentials and abuses the access entrusted to them.

Separate Compromises of French Government Data

In February 2026, the Direction générale des Finances publiques disclosed unauthorized access to FICOBA, France’s national bank-account register. Compromised official credentials were used to access bank-account details, account-holder identities and addresses affecting approximately 1.2 million accounts.^[34]

In August 2026, DGFiP disclosed separate unauthorized accesses involving credentials belonging to a tax employee and an authorized third party. The Finance Ministry said data concerning 678,000 individuals and businesses was consulted or extracted, including tax-income, household, withholding-rate and cadastral information; ordinary public tax-portal passwords were not compromised.^[35]

The two incidents are distinct. Neither should be misdescribed as a leak of every French taxpayer’s complete crypto portfolio. Their relevance is structural: financial and tax databases can contain identity, address, income and asset-related context that may become valuable when combined with other sources.

Waltio provides a parallel private-sector example. The French crypto-tax service disclosed that an attacker accessed users’ email addresses, 2024 gains or losses and balances per cryptocurrency used in year-end tax calculations. Waltio said wallet addresses, transaction histories, identity documents and postal addresses were not part of the exposed data.^[30] France’s Cybermalveillance.gouv.fr separately confirmed that an investigation into the Waltio incident was underway and warned of fraud attempts impersonating crypto operators and bank anti-fraud teams.^[31]

Each dataset is partial. Joined through persistent identifiers, however, those partial disclosures can become a much fuller profile.

8. France: When Financial Data Becomes Physical-Security Data

Privacy discussions in cryptocurrency often stop at surveillance, profiling and account compromise. France demonstrates why that boundary is too narrow.

On January 21, 2025, Ledger co-founder David Balland and his partner were kidnapped from their home in central France. French gendarmerie says the captors demanded a ransom in cryptocurrency; both victims were recovered and ten suspects were arrested within days.^[37]

In May 2025, the father of a wealthy cryptocurrency entrepreneur was kidnapped in Paris and later rescued. Days later, a masked group attempted to abduct the daughter of Paymium chief executive Pierre Noizat in broad daylight in Paris. Reuters described the incidents as part of a series of violent attacks that had pushed French crypto executives to change routines and consider personal-security measures.^[39]

The response moved beyond ordinary cybersecurity advice. On May 16, 2025, France’s Interior Ministry convened crypto-sector representatives and announced measures including priority contact with police, home-security consultations and additional protection for professionals and their relatives.^[36] By January 2026, the ministry publicly warned that the threat had evolved beyond entrepreneurs and industry professionals to include private crypto holders, advising people not to display holdings or gains online and to remain discreet about crypto activity.^[38]

Chainalysis’s August 2026 dataset places that escalation in broader context. It recorded 19 publicly known violent crypto incidents in France during 2025 and 30 by mid-2026, while noting that Interior Minister Laurent Nuñez had said authorities had documented more than 70 crypto-related violent incidents. Chainalysis also found that more than 40% of the French incidents in its dataset targeted a relative rather than the crypto holder directly.^[33]

These are no longer only account-security events. They are examples of a threat model in which a person’s perceived control of portable, self-custodied wealth can affect the safety of a household.

What the Evidence Does — and Does Not — Connect

The public evidence generally does not permit a straight line from the Ledger, Coinbase, Waltio or government-data incidents to a specific kidnapping. Target selection can come from public posts, insider knowledge, business relationships, surveillance, open-source research, stolen databases or combinations of those sources.

What can be said is narrower and stronger: the attacks are real, the compromised datasets are real, and several contain exactly the attributes that can reduce the cost of target selection — identity, location, crypto affiliation and wealth indicators. Chainalysis has assessed the French tax-data compromise as a likely contributor to the national surge, but that remains an analytical assessment rather than case-by-case attribution.^[33] Privacy engineering asks whether an information architecture creates dangerous capabilities when data changes hands; it does not require proving that one database produced one particular crime.

When identity, location and wealth can be joined, a privacy failure can stop being informational and become physical.

9. When Identity Exposure Meets a Transparent Ledger

A leaked identity database is dangerous on its own. A transparent financial database is dangerous in a different way. The combination can be more informative than either source independently.

The France cases add a physical-security dimension to this data-fusion problem. An attacker does not need perfect knowledge of a person’s holdings to benefit from a public financial graph. Even an approximate indication that a known resident controls substantial liquid crypto wealth can change the economics of targeting.

Suppose an observer has a record containing a person’s name, face, date of birth and residential address. That still does not reveal the person’s cryptocurrency holdings. Suppose the observer separately sees a public blockchain address with balances, incoming payments, counterparties and timestamps. That still does not necessarily reveal the address owner.

The problem changes when an exchange withdrawal, merchant record, reused address, seized device, public donation, invoice or other external source creates a reliable bridge between the two datasets.

This is the same unequal-observer problem that appears throughout cryptocurrency privacy research. A passive public observer and an exchange holding customer records do not possess the same ground truth. Once external labels are added to a ledger, previously ambiguous transactions can become easier to interpret.

10. Where Ryo Fits: Compartmentalization, Not Identity Erasure

Ryo should not be described as a tool that “fixes” an exposed identity. It cannot remove a driver’s-license image from a criminal dataset. It cannot stop a carrier employee from being socially engineered. It cannot secure a compromised laptop, repair a weak exchange recovery process or delete records already retained by an intermediary.

Its role is narrower: reduce the public financial information that can be attached to that identity.

Ryo currently uses private-by-default Ring Confidential Transactions with a default ring size of 25, together with one-time address mechanisms and confidential amounts. The official Ryo website describes amounts, origins and destinations as concealed by default and separately describes a transition toward zero-knowledge proofs as future work.^[13]

For this article, the important current property is simpler: Ryo reduces the public ledger information available to an outside observer. Future privacy upgrades should remain clearly separated from capabilities deployed on mainnet today.

This distinction is important. A privacy system is strongest when it minimizes information at several separate points:

• the identity disclosed before acquisition;
• the records retained by the exchange or swap provider;
• the information visible on the ledger;
• the network metadata surrounding transaction broadcast;
• the information exposed by the user’s wallet, device and counterparties.

Ryo addresses the ledger layer today. That does not remove exchange records, device compromise, counterparties or network metadata; it limits one major source of universally available financial intelligence.

If criminals already know where you live, the blockchain should not tell them what you are worth.

Your identity may already exist in databases you cannot control. That is an argument for exposing less of your financial life — not more. The security objective is compartmentalization: a failure in identity privacy should not automatically reveal a financial graph, and a failure in financial privacy should not automatically reveal a home address.

11. Identity-Minimizing Access: Non-KYC Markets and Decentralized Liquidity

The KYC paradox raises a practical question: if unnecessary identity replication is part of the risk, how can a privacy-conscious user acquire RYO without simply creating another copy of the same identity dossier? Ryo’s current exchange footprint is relevant here. The official Ryo website lists NonKYC, CEXSwap, Nonlogs and NoirTrade as RYO markets, while the ryo.news market page independently monitors those venues and their RYO pairs.^[13][15]

The relevant property is not the label on an exchange. It is the data model: what identity is collected, what operational records are retained, who controls custody and what remains visible on-chain.

Avoiding routine identity-document collection reduces the breach inventory: a platform that never receives a driver’s-license scan cannot later leak that scan. But no KYC is not the same as no data; centralized venues may still hold custody and retain trading or withdrawal records. Policies, liquidity and legal access can change, and these listings are not endorsements or guarantees of solvency. Ryo’s own site recommends moving RYO to an official self-custody wallet rather than treating an exchange account as the final privacy environment.^[13]

Beyond No-KYC: Decentralized Liquidity Removes a Different Layer of Trust

Removing identity-document collection and removing centralized exchange trust are separate steps. A custodial venue can avoid routine KYC while still holding funds and observing deposits and withdrawals; a decentralized protocol can remove the conventional account and custodian while leaving activity visible on transparent chains.

No KYC, non-custodial, decentralized and private are not synonyms. Each removes a different source of information or control.

The ecosystem already illustrates distinct models. BasicSwap uses atomic swaps and decentralized messaging instead of a conventional custodial trading account, but remains beta software and still depends on client, protocol, chain and liquidity conditions.^[19] Haveno / RetoSwap use peer-to-peer trading, Tor and Monero multisig escrow; fiat rails and dispute processes can still expose identity.^[20][21]

THORChain removes the conventional signup/KYC account for supported native swaps but remains transparent on-chain; as of September 5, 2026, its announced Monero and Zcash integrations were delayed.^[22][23][24] Serai targets decentralized cross-chain liquidity but remains pre-mainnet, so its intended privacy and security properties are not deployed guarantees.^[25][26] Privacy must still survive the other chain, network metadata and any fiat endpoint.

RyoDAX: Anonymous, Self-Hosted Exchange on the Roadmap

RyoDAX has been described by the Ryo team as an anonymous, self-hosted exchange. The project is intended to reduce dependence on identity-intensive exchange infrastructure, with further technical and architectural details to be released as development progresses.^[14]

12. The Privacy Stack After Identity Compromise

Once identity data escapes, security changes from prevention to containment. The correct response is not to declare privacy impossible. It is to stop one compromised layer from automatically exposing every other layer.

13. What to Do If Your License Data May Be Exposed

The defensive response should begin outside cryptocurrency.

• Treat the license as compromised identity evidence, not merely a lost card number. Follow the issuing authority’s process for exposed or stolen license information and determine whether a replacement identifier is appropriate.^[9]
• Protect credit files. Monitor for new accounts and use freezes or fraud alerts where available and appropriate.^[9]
• Harden the mobile account. Use the carrier’s strongest available account PIN, port-out protection or number-transfer lock, and do not rely on biographical information as a secret.^[7]
• Prefer phishing-resistant MFA. Hardware security keys and passkeys are preferable for high-value accounts; avoid SMS as the only recovery path where stronger alternatives are offered.^[6]
• Review recovery mechanisms. The authentication method advertised on the login screen is not the entire account-security model.^[5]
• Stop unnecessary ID replication. When a lawful service offers an alternative credential or a method that reveals fewer attributes, use the minimum evidence required for the transaction.^[3]
• Separate identity from financial visibility. Self-custody and private-by-default transaction systems can reduce the amount of public financial information available to be joined with an already exposed identity.^[13]
• Treat public displays of crypto wealth as a physical-security decision. French authorities now explicitly advise holders not to publish holdings or gains online and to remain discreet about crypto activity.^[38]
• Protect household information as well as wallet information. The French attack pattern shows that relatives can become targets even when they do not control the assets themselves.^[33]

14. Privacy After the Leak

The most dangerous conclusion from a breach of permanent identity data is that privacy no longer matters.

The opposite is true.

If a password is exposed, rotate the password. If a card number is exposed, cancel the card. If a face, date of birth, home address and government identity document are copied into a dataset beyond the holder’s control, there may be no equivalent reset button. The rational response is therefore to reduce the number of additional systems that can be joined to that identity.

Here private money becomes a security property, not merely an aesthetic preference. In a threat model of extortion, home invasion and kidnapping, financial confidentiality becomes part of physical-security hygiene.

A transparent ledger can turn one successful identity attribution into a window onto balances, counterparties and transaction history. Private-by-default money reduces that public graph; identity-minimizing acquisition, self-custody and decentralized exchange architecture protect different layers around it. None makes the user invulnerable. The correct model is compartmentalization.

A privacy breach does not make privacy pointless. It makes privacy everywhere else more important.

If someone already knows your name, your face, your date of birth and where you live, the last thing a public database should automatically reveal is how much money you hold, where it came from and where it goes. The same principle applies when identity or financial information must be disclosed to a tax authority: lawful disclosure to one institution does not create a technical necessity for the same information to become visible to every observer.

Ryo cannot take a leaked driver’s license back.

It can help keep that leaked identity from becoming a public map of your financial life.

Privacy by Default. Freedom by Design.

Primary Sources and Further Reading

1. Brian Krebs, “FBI Probes Service Selling 153M+ Drivers Licenses,” KrebsOnSecurity, September 1, 2026.
2. BleepingComputer, “IDScan sued over alleged data breach affecting 153 million drivers,” September 4, 2026.
3. NIST SP 800-63A, Digital Identity Guidelines: Identity Proofing.
4. NIST SP 800-63A, Identity Evidence Requirements.
5. NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management, Account Recovery.
6. Cybersecurity and Infrastructure Security Agency, Implementing Phishing-Resistant MFA.
7. Federal Bureau of Investigation, “FBI San Francisco Warns the Public of the Dangers of SIM Swapping.”
8. Financial Crimes Enforcement Network, “FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions,” November 13, 2024.
9. U.S. Federal Trade Commission, IdentityTheft.gov, “What To Do If Your Information Is Lost or Stolen.”
10. Dr. Max Anon, “ProxyMark and Monero over Tor: How Privacy Can Fail Between Layers,” ryo.news, August 6, 2026.
11. Financial Action Task Force, Seventh Targeted Update on Implementation of the FATF Standards on Virtual Assets/VASPs, July 16, 2026.
12. Financial Action Task Force, Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers.
13. Ryo Currency, official website: current privacy architecture, wallets and listed RYO markets.
14. Ryo Currency, official FAQ and roadmap; RyoDAX roadmap entry.
15. ryo.news, Ryo Currency Market Data: exchange pairs, market structure and liquidity monitoring.
16. Nonlogs, Privacy Policy, updated August 2026.
17. Nonlogs, Data & Logs Policy, updated August 2026.
18. NoirTrade, Privacy Policy, updated April 2026.
19. BasicSwap Documentation, “What is BasicSwap DEX?”
20. Haveno Documentation, “Overview of Haveno.”
21. RetoSwap, official website.
22. THORChain, “How To: Walletless Swaps,” August 12, 2026.
23. THORChain, “How to read a transaction on THORChain?” April 22, 2026.
24. THORChain, “THORChain Puts Stability First: Monero & Zcash Delayed,” August 27, 2026.
25. Serai Documentation, protocol overview and current development status.
26. Serai, “Distributed Key Generation Protocol Audited by Least Authority,” August 19, 2026.
27. Ledger, “Message by Ledger’s CEO — Update on the July data breach,” December 21, 2020.
28. Coinbase Global, Inc., Form 8-K, Item 1.05 Material Cybersecurity Incident, filed May 15, 2025.
29. Kroll / FTX, Security Incident Involving Claimant Data: notices and FAQ, 2023.
30. Waltio, “Questions & Answers — Security Incident,” updated July 24, 2026.
31. Cybermalveillance.gouv.fr, “Violation de données personnelles dans le secteur des crypto-actifs : situation, risques et recommandations,” updated June 8, 2026.
32. Protos, “No release for French tax agent who gave crypto investor details to gangs,” January 9, 2026.
33. Chainalysis, “Estimated $30 Million Stolen in Violent Crypto Attacks in 2026 as France Emerges as Hotspot,” August 6, 2026.
34. Direction générale des Finances publiques, “Accès illégitimes au fichier national des comptes bancaires (FICOBA),” February 18, 2026, updated March 3, 2026.
35. French Ministry of Economy and Finance, “Accès illégitimes au système d’information de la Direction générale des Finances publiques,” August 14, 2026.
36. French Ministry of the Interior, “Réunion des acteurs du secteur crypto avec le ministère de l’Intérieur : prévenir, dissuader et protéger la filière,” May 16, 2025.
37. Gendarmerie nationale, “Enlèvement de David Balland : un engagement massif et complet de la gendarmerie nationale,” January 24, 2025.
38. French Ministry of the Interior, “Crypto-actifs : protéger les particuliers,” January 22, 2026.
39. Reuters, “Fear and anger in France’s crypto community after spate of kidnappings,” May 16, 2025.
40. Légifrance, Code général des impôts, annexe III, Articles 344 G decies – 344 G undecies: declaration of crypto-asset accounts held abroad, version in force July 1, 2026.
41. Légifrance, Décret n° 2025-1276 du 19 décembre 2025: reporting and due-diligence obligations for crypto-asset service providers, effective January 1, 2026.
42. Le Parisien, “L’agente du fisc ciblait gardiens de prison et investisseurs en cryptomonnaie pour un mystérieux commanditaire,” January 6, 2026.