If this month's theft of more than 153 million US and Canadian driver's licenses proves anything, it is that the safest place to keep a copy of your driver's license is nowhere at all.

The leaked IDs, which appear to have originated from an identity verification provider, surfaced on Nexus, a dark web identity service, alongside millions of other stolen identity and travel documents. The FBI has said it is investigating the exposure, according to a Reuters report.

The danger was thrown into sharp relief this week, when fintech Revolut disclosed that a hacker had tricked it into handing over reams of sensitive customer data, including copies of passports and verification selfies. The attacker is now drip-feeding the identification documents of 680 customers onto the web in an attempt to secure a $3 million ransom in Monero, as Cointelegraph reported.

The irony is hard to miss. Know Your Customer (KYC) processes exist to make financial systems safer by establishing who customers are and ensuring they are not engaged in wrongdoing. Yet the way KYC is usually implemented requires companies to store vast quantities of sensitive information, creating valuable honeypots for criminals.

The problem is getting harder to ignore. In the first half of 2026 alone, data breaches in the United States affected at least 343 million people, according to the Privacy Rights Clearinghouse. More frustrating still, it is already possible to verify a person's identity without storing their documents, using zero-knowledge proofs.

Efrat Fenigson, host of the You're The Voice podcast, who writes and speaks extensively about privacy and KYC, told Cointelegraph Magazine:

"When regulators keep mandating a model that guarantees this outcome — while the technology to verify without storing already exists — it raises a red flag. It implies there is a lack of rational thinking and real will to solve problems."

The question is how many more leaks it will take before that will starts to bend.

KYC was built to collect identity, not just verify it

Today's KYC systems have largely evolved around the assumption that institutions should see a customer's passport or driver's license, record the relevant information and then store evidence of the check.

That approach has an obvious flaw: it has produced a sprawling ecosystem of identity providers, databases, vendors and compliance systems, each holding a separate treasure trove of individual KYC data. Every additional copy of a person's data is another potential point of failure — and hackers are growing ever more creative about finding ways in.

The Revolut breach illustrates the point. The hacker sent emails requesting the KYC data from a legitimate Italian law enforcement address. Lyudmyla Kozlovska, president of Open Dialogue, said on X that EU law left Revolut with no option but to comply:

"EU AML law imposes no verification duty on the bank and provides no meaningful mechanism to check who is really behind an authenticated state request. Refusal to answer carries fines in the millions. In practice, verification is impossible."

Susie Violet Ward, director and co-founder of Bitcoin Policy UK, warns that the real issue is the unnecessary storage of identity data: "We need to stop treating identity verification and surrendering your identity as though they are the same thing."

If a company only needs to know that someone is over 18, she argues, it should not automatically demand additional details such as a full name, address, exact date of birth and a permanent copy of the relevant document. "The irony is that KYC is designed to make systems safer, but the way we currently implement it can create an entirely different security problem. You can reset a password after a breach, but you cannot reset your identity in the same way," she said.

The technology to stop hoarding IDs already exists

For crypto proponents, the obvious solution is zero-knowledge proofs — mathematical demonstrations that something is true without revealing the underlying details. A phone app, for instance, could generate a proof confirming that a driver's license says its holder is over 18, without transmitting the birth date or a picture of the license itself.

Zcash founder Zooko Wilcox offers a useful explanation of the technology in a video interview with Crypto Fireside.

Evin McMullen, chief executive and co-founder of Billions Network, which develops privacy-preserving digital identity and zero-knowledge solutions, told Cointelegraph Magazine: "The technology works and is in production today, across thousands of applications and regulated institutions. What holds it back is that the entire compliance stack was built around collecting and storing copies of documents."

The barrier, McMullen said, was "never the technology" but the rules, incentives and infrastructure built around it: "This is a governance and standards problem wearing a technology costume."

If the technology works, what's stopping it?

The European Union is already incorporating zero-knowledge technology into the design of its digital identity and age verification systems, developing privacy-preserving age verification that allows users to prove their age without revealing their full identity or exact date of birth. Its Digital Identity Wallet also supports "selective disclosure," meaning users reveal only the information needed for a particular transaction.

So why isn't this being deployed more widely for financial KYC? McMullen cites "regulation and understanding" as the biggest obstacles to adoption: "The most common blocker is that compliance teams conflate 'we saw the ID' with 'we must keep the ID,' so they over-collect to be safe."

Interoperability is another stumbling block. Cryptographic proofs are only useful, she noted, "if the party relying on it can check it without calling back to whoever issued it." That requires shared standards — easier said than done.

ZK doesn't magically solve KYC

There is one important caveat: replacing an identity document with a zero-knowledge proof does not automatically eliminate every privacy or security problem.

Fenigson points out that what a ZK credential is tied to matters just as much: "The incentives point toward control, not privacy. Zero-knowledge proofs let someone prove a fact, like being over 18 or not on a sanctions list [...] What's missing is what that proof gets bound to. Right now it's usually bound to an account inside someone else's database."

It boils down to who ultimately controls the credential. If a person generates a privacy-preserving proof but that proof is tied to an account in somebody else's database, they are still dependent on a centralized intermediary.

The rules aren't as clear-cut as you might think

In many cases, the rules do not actually require the storage of ID data — it is more of a convention, because that is the way it has always been done.

The Financial Action Task Force's guidance explicitly considers how digital ID systems can be used to conduct customer due diligence, rather than requiring institutions to rely on physical identity documents. The FATF's recommendations also operate as a risk-based framework, leaving individual countries to implement standards through their own legal and regulatory systems.

"In many regimes, the rule is that you must verify identity and retain records of that verification, not that you must keep the raw document image forever," McMullen said. That means a cryptographically verifiable attestation, together with a record showing the relevant check was performed, could be enough to comply — without creating yet another permanent copy of an ID.

But because the guidance is "ambiguous," institutions default to keeping everything, since their compliance teams know auditors and examiners will accept it. Even where the rules technically permit a different approach, nobody wants to be the first to take the risk. As Ward explained: "There is an instinct in regulation that more information means more control and therefore more safety."

For institutions considering a different approach, the practical questions are therefore whether a proof can be accepted under the applicable rules, whether it can be independently checked across systems and whether the credential remains under the user's control rather than being tied to another centralized database. Those are governance and implementation questions, not simply questions about whether the underlying cryptography works.

It is hard to see that changing unless the rules are amended to explicitly allow zero-knowledge proofs. And while no system is perfect, ZK technology at least removes the need to collect and retain so much sensitive information. As McMullen put it: "You cannot lose what you never held."