After a data leak affecting tens of thousands of users, Coinbase is now touting cryptographic tools as a fix for outdated financial crime laws.<\/p>\n
Just months after suffering a major data breach, Coinbase<\/a> is now pointing to cryptographic privacy tools as a potential fix for what it calls \u201carcane\u201d financial crime laws.<\/p>\n In an Aug. 4 blog post<\/a>, Coinbase\u2019s chief legal officer, Paul Grewal, argued that the U.S. Bank Secrecy Act, which governs financial reporting and know-your-customer (KYC) rules, is outdated.<\/p>\n He urged lawmakers to modernize the framework by allowing the use of zero-knowledge<\/a> proofs (ZKPs), a cryptographic tool that can prove facts about users, such as age or residency, without exposing their full personal data.<\/p>\n Grewal says the current version of the Bank Secrecy Act is \u201cstill rooted in decades-old requirements that reflect paper-based compliance protocols and a financial system in which funds moved over days, not seconds.\u201d<\/p>\n \u201cBeyond the annoyance customers feel every time they repeat the KYC process, these personal files are honeypots for criminals. Companies are required by law to hold your data for years and to send that data to bureaucrats,\u201d Grewal explained.<\/p>\n In contrast, ZKPs could allow users to verify identity credentials while reducing the risks associated with storing sensitive data. Law enforcement would still retain the ability to subpoena full records if necessary, he said.<\/p>\n Grewal’s post comes less than three months after Coinbase revealed<\/a> that nearly 70,000 customers were affected by a data breach linked to third-party contractors.<\/p>\n The breach, which began in December 2024 and was discovered only in January, involved unauthorized access to ID images, partial Social Security numbers, bank account data, and, in some cases, passport details. Coinbase disclosed the incident publicly only in May, stating it had declined to pay a $20 million ransom demand and had cut ties with the vendor involved.<\/p>\n Instead, the exchange launched a $20 million bounty program for information related to the breach and pledged to compensate affected users. Fixing the breach could cost<\/a> Coinbase between $180 million and $400 million, but so far, there\u2019s no sign the company has identified the perpetrator.<\/p>\n Coinbase did not respond to The Defiant\u2019s request for comment.<\/p>\n Omar Azhar, vice president of business development at Matter Labs, the firm behind the ZKsync network, told The Defiant that ZKPs are already being used in real-world settings.<\/p>\n \u201cUsing ZK and blockchain-based verifiable credentials for identity is a proven technology that already exists,\u201d Azhar said. \u201cWe just need the political movement here in the US to implement it. The government of Buenos Aires already uses verifiable credentials on ZKsync through QuarkID for all their residents when they need to verify identity to anyone in their day-to-day lives.\u201d<\/p>\nData Breach<\/h2>\n
Deeper Issues<\/h2>\n