# Identity for Crypto and Web3: Wallet Login, KYC, and Travel Rule Source: https://startwithidentity.com/articles/identity-for-crypto-web3/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- Crypto and Web3 identity sits on two foundations at once. On-chain, a user is a wallet address controlled by a private key, pseudonymous and self-custodial by design. Off-chain, exchanges, custodians, and other virtual asset service providers (VASPs) are regulated financial businesses that must know their customers. A useful identity design serves both, letting people prove control of a wallet without giving up keys, while meeting KYC, AML, and Travel Rule obligations where money moves. See the [crypto and Web3 vertical](https://startwithidentity.com/verticals/crypto-web3/) page for the sector overview. ## Wallet authentication and Sign-In with Ethereum Signing a message with a wallet proves control of an address. [EIP-4361, Sign-In with Ethereum](https://eips.ethereum.org/EIPS/eip-4361) (SIWE, created October 2021 and now Final), standardizes that into a login. The app presents a plaintext message with its domain, the user's address, a URI, a chain ID, a random nonce, and an issued-at time, optionally with an expiry. The user signs it, and the app creates a session. The security depends on the relying party doing the checks: - Verify the domain in the message matches your own origin, so a signature collected by a phishing site cannot be replayed against you. - Issue a fresh, single-use nonce per attempt and reject reuse. - Enforce expiry and bind the resulting session to the server, as you would after any [OpenID Connect](https://startwithidentity.com/standards/openid-connect/) login. A wallet login proves key control, not who the person is. It also inherits the wallet's weaknesses: if the key or seed phrase is lost, so is the account, and if it is stolen, the attacker is the user. Many consumer apps therefore pair wallet login with an account recovery path or with embedded wallets that use passkeys or multi-party computation to avoid a single seed phrase. ## DIDs and verifiable credentials [Decentralized identifiers](https://startwithidentity.com/standards/decentralized-identifiers-did/) and [verifiable credentials](https://startwithidentity.com/standards/verifiable-credentials/) are the W3C standards for portable, cryptographically verifiable identity claims. In crypto they are most useful for reusable KYC: an issuer verifies a person once and issues a credential the user holds in a wallet, and other services verify it without repeating document checks. With [selective disclosure](https://startwithidentity.com/glossary/selective-disclosure/) or [zero-knowledge proofs](https://startwithidentity.com/glossary/zero-knowledge-proof/), a user can prove a fact such as "over 18" or "passed KYC with issuer X" without revealing the underlying data. [OpenID for Verifiable Credentials](https://startwithidentity.com/standards/openid4vc/) and the EU's [EUDI Wallet](https://startwithidentity.com/digital-ids/european-union/eu-eudi-wallet/) are pushing these formats toward mainstream use. Our [decentralized identity primer](https://startwithidentity.com/guides/fundamentals/what-is-decentralized-identity/) and the glossary entries on [DIDs](https://startwithidentity.com/glossary/decentralized-identifier/) and [verifiable credentials](https://startwithidentity.com/glossary/verifiable-credential/) cover the details. Vendors in this space include [SpruceID](https://startwithidentity.com/vendors/decentralized-identity/spruce-id/), which maintains SIWE tooling, [Privado ID](https://startwithidentity.com/vendors/decentralized-identity/privado-id/), and [Civic](https://startwithidentity.com/vendors/decentralized-identity/civic/). ## KYC, AML, and the Travel Rule Regulated VASPs perform [KYC](https://startwithidentity.com/glossary/kyc/) and [AML](https://startwithidentity.com/glossary/aml/) checks like any financial institution: document and biometric verification, sanctions screening, and ongoing monitoring. The crypto-specific layer is the Travel Rule. FATF Recommendation 16 requires VASPs to obtain, hold, and transmit originator and beneficiary information with qualifying transfers. FATF's [2025 targeted update](https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/2025-Targeted-Upate-VA-VASPs.pdf.coredownload.pdf) found that 73 percent of responding jurisdictions had passed Travel Rule legislation, but implementation and supervision remain uneven, and transfers to self-hosted wallets add verification questions. In the EU, the Markets in Crypto-Assets Regulation, [Regulation (EU) 2023/1114](https://eur-lex.europa.eu/eli/reg/2023/1114/oj), sets authorization rules for crypto-asset service providers, and the recast Transfer of Funds Regulation, [Regulation (EU) 2023/1113](https://eur-lex.europa.eu/eli/reg/2023/1113/oj), applies the Travel Rule to crypto-asset transfers. Both apply from 30 December 2024. Personal data collected for KYC still falls under [GDPR](https://startwithidentity.com/regulations/european-union/gdpr/), which creates tension with immutable ledgers: never write personal data on-chain. ## Wallet drainers, seed phrases, and account takeover The largest consumer losses in crypto come from users authorizing the theft themselves. Wallet drainers are phishing kits that trick a user into signing a malicious transaction or token approval. [Scam Sniffer estimated](https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/) that drainers stole about $494 million from roughly 332,000 addresses in 2024 on EVM chains. Seed-phrase phishing (fake support agents, fake wallet updates) and [infostealer malware](https://startwithidentity.com/techniques/infostealer-credential-harvesting/) that lifts wallet files complete the picture. Institutional signing is a target too. In February 2025 the FBI [attributed](https://www.ic3.gov/PSA/2025/PSA250226) the theft of about $1.5 billion in virtual assets from the Bybit exchange to North Korean actors. Public reporting tied the incident to a compromised third-party wallet interface that showed signers a different transaction from the one they approved. Controls that matter: - Wallets and apps that decode transactions and approvals into plain language, warn on unlimited allowances, and simulate the result before signing. - Hardware-backed keys and multi-signature or MPC policies for treasury and hot wallets, with an independent check of what is being signed. - [Phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) and [passkeys](https://startwithidentity.com/guides/authentication/passkeys-101/) on exchange accounts, never SMS alone, given [SIM-swap](https://startwithidentity.com/glossary/sim-swap/) attacks on high-value users. - Support processes that never ask for a seed phrase, and [help desk](https://startwithidentity.com/techniques/help-desk-social-engineering/) verification that resists social engineering. ## Choosing platforms Most crypto businesses combine an identity verification provider such as [Sumsub](https://startwithidentity.com/vendors/identity-verification/sumsub/) or [Persona](https://startwithidentity.com/vendors/identity-verification/persona/), a customer identity platform for exchange accounts, and wallet authentication libraries. The [decentralized identity for KYC](https://startwithidentity.com/rankings/best-decentralized-identity-for-kyc/) and [identity verification for startups](https://startwithidentity.com/rankings/best-identity-verification-for-startups/) rankings compare options, and the [regulations hub](https://startwithidentity.com/regulations/) tracks obligations by country. In crypto, identity is where self-custody meets regulation, and the strongest designs keep keys with users while making every signature clear about what it does.