How and Why Crypto Exchanges Share User Data: Lawyers Explain

Ivan Pavlovskyy
Choose us on Google

• How Crypto Platforms Interact With Law Enforcement

• Legal Nature of Cooperation

• What Data an Exchange can Disclose

• Will the User be Notified About the Transfer of their Data?

“Not your keys — not your coins”. This phrase is one of the main arguments used by supporters of so-called self-custody solutions, who view centralized exchanges with skepticism. The key reasons include the possibility of sudden asset freezes, the potential loss of funds if a company goes bankrupt, a lack of transparency around reserves, and more. 

However, beyond their coins, users also entrust platforms with something else, far more valuable — personal data. 

It is no secret that crypto exchanges may share client data at the request of law enforcement agencies in different countries, as most of them aim to operate in a regulated, legal environment, which implies cooperation with government authorities. At the same time, representatives of crypto platforms always assure users that any disclosure of user data happens only in response to a legally grounded request and only to the minimum extent necessary.

But what exactly are these requests? The Incrypted editorial team asked lawyers how, when, and why crypto exchanges share user data with law enforcement, and how this works in Ukraine.

High-profile stories about crypto exchanges handing over personal data or freezing user assets at the request of law enforcement agencies stopped being breaking news a long time ago. Some companies even regularly publish reports on requests from government bodies and their cooperation. 

For example, according to its reporting, Binance processed more than 72,000 law enforcement requests in 2025, and as of June 2026 — another 36,000. Over its entire operating history, the company has logged more than 313,000 such requests. During the 2025 reporting period, Coinbase received about 12,700 requests, while Kraken received nearly 8,000 requests, of which it fulfilled 51.3%. Companies count differently and disclose different amounts of data, but one thing is clear: law enforcement agencies in different countries regularly submit requests to exchanges. 

Cooperation between cryptocurrency platforms and law enforcement is a complex intersection of national criminal procedure law, international legal assistance, and exchanges’ strict internal compliance, says Igor Bykov, PhD in Law and attorney at LESHCHENKO & PARTNERS:

“And although for the crypto community — oriented toward the original philosophy of decentralization — such steps are often perceived as “betrayal,” they are a natural process. Major crypto exchanges have become a full-fledged part of the global financial system, so they play by its rules without reservation. Their management clearly understands the cost of compromises with the law.”

Today, as part of AML/KYC procedures, sanctions screening, and the fulfillment of other regulatory obligations, exchanges collect and store a significant amount of information. Such data may include a name, date of birth, passport details, or an ID, and so on.

In addition, this includes technical information — IP addresses, login history, device information — as well as transaction data: wallet addresses, deposits and withdrawals, buying and selling assets, and so on.

One of the biggest user mistakes is equating the blockchain’s pseudonymity with the anonymity of an account on a centralized exchange, experts emphasized. 

“On the blockchain, we can see that assets moved from address A to address B. But the blockchain itself does not necessarily tell us that address A belongs to a specific person. A centralized exchange can potentially become that missing link that connects a blockchain address to a real individual,” notes Karina Klymenko, a lawyer at Stron Legal.

However, data sharing is not automatic or unconditional. It takes place only on the basis of an official, properly executed request. As a rule, this is within the framework of criminal proceedings or another procedure предусмотрена by law, Manimama Law Firm CEO and attorney Hanna Voievodina emphasized in a conversation with Incrypted.

The key factor in how an exchange responds to a request from a given authority is its jurisdiction, experts say. 

If an exchange is registered, licensed, or listed as a service provider in a particular country, or is effectively providing services in that market, it falls under that state’s regulators and is required to respond to their requests, Juscutum senior lawyer Daniil Voloshchuk told Incrypted: 

“This obligation is direct and does not require any international procedures, as it follows from the licensing terms and national legislation, and failure to comply entails fines, supervisory measures, suspension or revocation of the license, and in some cases personal liability for officials (including the compliance officer).”

Depending on the jurisdiction, a request may come from investigators, prosecutors, courts, financial investigation bodies, tax authorities, and other competent agencies, Hanna Voievodina said.

What does this process look like legally? 

1. Documentation: the investigative body opens a case and identifies the exchange, account, wallet addresses, transaction hashes, the suspect’s contact details, and other identifiers that can be used to establish their link to crypto assets. 
2. Request preparation: investigators then draft the request themselves or obtain court or prosecutorial authorization. The request typically includes the name of the requesting authority, the responsible official and their contacts, the case number, factual background, legal qualification, specific data, the time period, and the purpose for using the requested data. 
3. Submitting the request: the request is submitted via the communication channel provided by the exchange. This may include dedicated request portals or official email.  
4. Exchange review: the crypto platform’s legal team verifies the applicant’s authenticity, jurisdiction, legal basis, and territorial scope of the request. 
5. Clarification: if needed, the exchange may ask to narrow the scope of the request, clarify certain points, or object. In addition, it may preserve the requested data until a more substantiated document is received — for example, a court order. 
6. Data transfer: if the request is approved, the exchange provides the requested information to investigators.

At the same time, the scope of such information is determined by the content of the request and the principle of minimum sufficiency, Hanna Voievodina emphasized.

Can an exchange refuse to comply with a request?

An exchange’s transfer of customer data to law enforcement is not an obligation in every case. 

“A crypto exchange is not a global database open to law enforcement agencies of any state. A proper request is not ‘provide all information about Ivan Ivanov.’ It must have a subject matter, a legal basis, a link to a specific investigation, and be sufficiently specific,” notes Karina Klymenko.

The lawyer emphasized that for a legal assessment, it is necessary to establish: who exactly sent the request, what powers this authority has, what the legal basis for the request is, which legal entity of the exchange serves the user, where it is registered or licensed, and so on.

So, jurisdiction plays an important role here as well. As a general rule, any state authority in a country where the exchange is neither registered nor has a presence has no coercive powers over it: its “internal” procedural document, by itself, does not create an obligation for the exchange to disclose data, stressed Daniil Voloshchuk of Juscutum.

To overcome this territorial boundary, there is a system of international treaties and cooperation mechanisms within which law enforcement agencies of different states interact: for example, UN conventions, the Council of Europe Convention on Cybercrime, bilateral mutual legal assistance treaties, and so on.

An exchange is not a passive executor of any request. It can refuse or, at the very least, not comply with the request in the form in which it was received, Voloshchuk says. However, this right is not absolute and is most often exercised not as an outright refusal, but as “managed disagreement”: the exchange asks to clarify or narrow the scope of the request, requires a proper procedural document, or requires going through the mutual legal assistance procedure.

In addition, based on a reasonable suspicion, an exchange may freeze the account and the assets in it until the circumstances are clarified or a court-ordered seizure is obtained.

If the exchange deems a request for information disclosure to be valid and agrees to comply, it may provide:

• verification data: full name, date of birth, passport/ID card series and number, registration address, selfie, phone number, and email
• technical and geolocation trail: the history of IP addresses used for registration and each login to the website/app, device identifiers, operating system types, language settings, and browsers
• transaction history: external wallet addresses, internal transfers between exchange accounts that are not reflected on the public blockchain
• financial details: linked bank cards, P2P deal details (including counterparties’ payment details), current balances, and order history on spot or futures.

Lawyers emphasize that this does not mean the exchange hands over all of this information at once — only a specific requested portion from this indicative list, and only if the scope of the request is not narrowed. 

There are cases where a client may not learn that law enforcement has requested their data. This depends on the laws of the relevant jurisdiction, the nature of the request, and the procedural document itself, Klymenko notes. 

According to her, sometimes an exchange is allowed to notify the user, and sometimes it is explicitly prohibited — for example, if disclosure could harm an investigation. As a result, people often find out about the transfer of information only after it has already happened. Conversely, if there was no notification from the exchange, that still does not mean the data was not shared with anyone.

How It Works in Ukraine 

Even though Ukraine still has not finally adopted a law regulating the crypto market, that does not stop law enforcement from already working with cryptocurrencies within criminal proceedings and seizing them.  

In Ukrainian practice, two main scenarios have emerged for how law enforcement interacts with international crypto exchanges, says Ihor Bykov: 

Scenario 1:operational. Ukrainian detectives from the BEB or Cyberpolice operatives may have accredited accounts on investigator portals (Binance, OKX, Bybit, and so on). The investigator prepares an official request letter, attaches an extract from the ERDR, and an analytical memo from blockchain analytics. Within a few days (sometimes hours, if there is a threat to life or terrorist financing), the exchange sends a response in the form of data tables or freezes the account.

Scenario 2: procedural. For exchange data to qualify as proper and admissible evidence in court, the investigator applies to the investigating judge with a motion for temporary access to items and documents. After obtaining a court order, it is sent to the exchange. 

As for who exactly can submit such requests, it all depends on the nature of the criminal offense and jurisdiction, notes Stron Legal lawyer Karina Klymenko. In relevant proceedings, this may include investigators or detectives from the National Police, the BEB, the NABU, the SBI, the SBU, and other competent authorities — in line with their powers, jurisdiction rules, and procedural status. 

A Ukrainian court has jurisdiction over Ukrainian criminal proceedings — but its ruling does not automatically have enforceable legal force against a foreign legal entity in another country. This is where the above-mentioned international cooperation treaties are often used.

As Daniil Voloshchuk explained, this is the classic “state — state” route (MLA). The investigative body prepares a request for mutual legal assistance, which is approved and sent via the central authority of its state to the corresponding authority in another country. In Ukraine, this is the Prosecutor General’s Office at the pre-trial investigation stage, the Ministry of Justice at the trial stage, and, in certain proceedings, NABU. The requested state’s agency then obtains its own national warrant, and it is that agency that serves it on the exchange. The data is returned through the same chain. Lawyers note that this is the most reliable, but also the slowest route, which can take months.

However, other processes may take place in parallel. For example, exchanges may accept direct requests from Ukrainian law enforcement agencies through their own systems. In addition, where there is an immediate threat to a person’s life or health, exchanges, as a rule, disclose the minimum necessary amount of data without a court warrant.

Conclusions

Using centralized exchanges does not guarantee absolute anonymity, as today they are increasingly becoming part of the global financial system and operate under its regulatory rules. 

Although platforms collect a significant amount of personal data and cooperate with law enforcement agencies, they do not disclose all information at the first request — this process is fairly regulated.

Ultimately, the choice remains with the user: accept these rules of the game for the convenience of CEX, or follow the philosophy of “not your keys — not your coins” by choosing non-custodial solutions.

Source: incrypted.com