Identity for Crypto and Web3: Wallet Login, KYC, and Travel Rule

Crypto and Web3 identity sits on two foundations at once. On-chain, a user is a wallet address controlled by a private key, pseudonymous and self-custodial by design. Off-chain, exchanges, custodians, and other virtual asset service providers (VASPs) are regulated financial businesses that must know their customers. A useful identity design serves both, letting people prove control of a wallet without giving up keys, while meeting KYC, AML, and Travel Rule obligations where money moves. See the crypto and Web3 vertical page for the sector overview.

Wallet authentication and Sign-In with Ethereum

Signing a message with a wallet proves control of an address. EIP-4361, Sign-In with Ethereum (SIWE, created October 2021 and now Final), standardizes that into a login. The app presents a plaintext message with its domain, the user's address, a URI, a chain ID, a random nonce, and an issued-at time, optionally with an expiry. The user signs it, and the app creates a session.

The security depends on the relying party doing the checks:

• Verify the domain in the message matches your own origin, so a signature collected by a phishing site cannot be replayed against you.
• Issue a fresh, single-use nonce per attempt and reject reuse.
• Enforce expiry and bind the resulting session to the server, as you would after any OpenID Connect login.

A wallet login proves key control, not who the person is. It also inherits the wallet's weaknesses: if the key or seed phrase is lost, so is the account, and if it is stolen, the attacker is the user. Many consumer apps therefore pair wallet login with an account recovery path or with embedded wallets that use passkeys or multi-party computation to avoid a single seed phrase.

DIDs and verifiable credentials

Decentralized identifiers and verifiable credentials are the W3C standards for portable, cryptographically verifiable identity claims. In crypto they are most useful for reusable KYC: an issuer verifies a person once and issues a credential the user holds in a wallet, and other services verify it without repeating document checks. With selective disclosure or zero-knowledge proofs, a user can prove a fact such as "over 18" or "passed KYC with issuer X" without revealing the underlying data. OpenID for Verifiable Credentials and the EU's EUDI Wallet are pushing these formats toward mainstream use. Our decentralized identity primer and the glossary entries on DIDs and verifiable credentials cover the details. Vendors in this space include SpruceID, which maintains SIWE tooling, Privado ID, and Civic.

KYC, AML, and the Travel Rule

Regulated VASPs perform KYC and AML checks like any financial institution: document and biometric verification, sanctions screening, and ongoing monitoring. The crypto-specific layer is the Travel Rule. FATF Recommendation 16 requires VASPs to obtain, hold, and transmit originator and beneficiary information with qualifying transfers. FATF's 2025 targeted update found that 73 percent of responding jurisdictions had passed Travel Rule legislation, but implementation and supervision remain uneven, and transfers to self-hosted wallets add verification questions.

In the EU, the Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, sets authorization rules for crypto-asset service providers, and the recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, applies the Travel Rule to crypto-asset transfers. Both apply from 30 December 2024. Personal data collected for KYC still falls under GDPR, which creates tension with immutable ledgers: never write personal data on-chain.

Wallet drainers, seed phrases, and account takeover

The largest consumer losses in crypto come from users authorizing the theft themselves. Wallet drainers are phishing kits that trick a user into signing a malicious transaction or token approval. Scam Sniffer estimated that drainers stole about $494 million from roughly 332,000 addresses in 2024 on EVM chains. Seed-phrase phishing (fake support agents, fake wallet updates) and infostealer malware that lifts wallet files complete the picture.

Institutional signing is a target too. In February 2025 the FBI attributed the theft of about $1.5 billion in virtual assets from the Bybit exchange to North Korean actors. Public reporting tied the incident to a compromised third-party wallet interface that showed signers a different transaction from the one they approved.

Controls that matter:

• Wallets and apps that decode transactions and approvals into plain language, warn on unlimited allowances, and simulate the result before signing.
• Hardware-backed keys and multi-signature or MPC policies for treasury and hot wallets, with an independent check of what is being signed.
• Phishing-resistant MFA and passkeys on exchange accounts, never SMS alone, given SIM-swap attacks on high-value users.
• Support processes that never ask for a seed phrase, and help desk verification that resists social engineering.

Choosing platforms

Most crypto businesses combine an identity verification provider such as Sumsub or Persona, a customer identity platform for exchange accounts, and wallet authentication libraries. The decentralized identity for KYC and identity verification for startups rankings compare options, and the regulations hub tracks obligations by country. In crypto, identity is where self-custody meets regulation, and the strongest designs keep keys with users while making every signature clear about what it does.