A stolen coin can be returned. A leaked identity cannot.

Evin McMullen is co-founder and CEO of Billions Network, which builds privacy-preserving digital identity for people and A.I. agents.

This friction is the part of the security conversation we keep skipping. Every layer of the connected technology industry that touches the real world collects identity data. Crypto exchanges verify who you are. Hardware wallet makers collect your physical shipping address. On-ramps store your vital documents. Each becomes a repository of private data critical to their offerings and to the lives of their customers, each transforming with scale into a separate honeypot: a centralized store of highly sensitive data, a growing pile of static value sitting neatly on a server somewhere, waiting to be breached. The stolen $320 million is a wound that can potentially heal — tokens can be returned, identical money can be earned in the future. A leaked identity file is a scar that spreads, because once your name is linked to an address whose balance anyone can read onchain, that link is permanent and public.

The debate is stuck on the wrong axis. We argue about whether platforms were secure enough, whether they patched quickly enough, whether users held their keys correctly. All of it assumes the data had to be collected in the first place. It did not. Verifying a fact about someone and collecting their identity are different operations, and we have known how to separate them for years. A vendor can confirm you are a real, sanctions-cleared customer without keeping your passport on a server. You can prove you are authorized to withdraw without handing every counterparty a copy of who you are. Minimum disclosure: the fact is verified and discarded. No identity collected means no honeypot created, and nothing left to leak, sell, or mail to your door.