What Exchanges Hand Over in Data Requests

Most people think of crypto exchange data requests as an abstraction - a line in a transparency report, a number without faces. A case reported by Reuters puts a face on it. According to documents the agency reviewed, Binance responded to a Russian investigative request with the transaction history of one client, and that history became evidence in a terrorism financing prosecution.

The client is an IT worker detained in the autumn of 2025. On October 13 a Moscow district court ordered him held pending trial under an article covering assistance to terrorist activity, which carries up to fifteen years. Investigators allege that between January 2023 and March 2024 he sent crypto to Ukrainian organizations; per the Investigative Committee, the amount involved exceeded seven hundred dollars.

Seven hundred dollars. That figure is the reason this case is worth studying rather than skimming. Whatever you assume about thresholds - that small transfers are beneath notice, that exchanges only respond when the numbers are large - the record here says otherwise.

What was in the package

The documents describe two categories, and the second one surprises people.

The first is the on-chain and account history: which transfers left the account, when, and to which addresses. This is the part everyone expects, because it is the part that reads like "crypto." Some of it is public on a block explorer already; what the exchange adds is the link between an address and a named human.

The second category is the identity file. Reporting on the case describes date of birth, home address, phone number, a scan of the Russian passport and a copy of a Bulgarian residence permit. None of that lives on a blockchain. All of it exists because of onboarding.

That is the structural point behind crypto exchange data requests: the blockchain is not what exposes you. Verification is. The exchange holds the file that turns an anonymous string of characters into a person with an address, and that file is what a legal request reaches.

Reporting also indicates investigators asked about other people who had sent funds to the same wallet. One request can therefore touch a set of accounts, not just the one named in the case.

How the documents surfaced

The materials reached Reuters through a legal-aid nonprofit that supports people prosecuted in politically sensitive cases; the nonprofit received them from a relative of the accused. Reuters said it could not independently verify them.

That caveat belongs in any honest summary. What is not in dispute is the shape of the process, because exchanges describe it themselves: a law enforcement body sends a request, a compliance team reviews it, and responsive records are produced.

The exchange's position

A Binance representative said the company does not set or enforce the laws of any jurisdiction, does not determine charges, and does not decide how a government uses information in legal proceedings. The company also said it cooperates with law enforcement worldwide within the framework of lawful requests, and declined to comment on specific confidential requests or individual cases.

Read plainly, that is neither an admission nor a denial. It is a description of the position every large intermediary occupies. An exchange operating in dozens of countries receives crypto exchange data requests from all of them, and its compliance function is built to answer rather than to litigate.

Where the legal argument gets interesting

Mike Bystrov, founder of the law firm Stellar Consulting, told Reuters the company was not obliged to provide these records, because Binance exited the Russian market back in 2023.

His second point is the sharper one. If the account holder was registered as an EU resident - and a Bulgarian residence permit makes that plausible - then European data protection rules apply, and those rules bar disclosure of personal data to a third country without a court order. Under that framework, Russia is not treated as a jurisdiction with adequate data protection, which makes transfers there especially sensitive. Reuters could not establish how the account was registered.

The unresolved question generalizes well beyond this case: which country's rules govern your file? Not the one you live in, necessarily. Not the one whose passport you hold. The answer depends on the entity that onboarded you, the terms you accepted, and where that entity is willing to be sued.

What this means if you keep funds on an exchange

Custody and privacy are separate questions, and conflating them causes most of the confusion here.

An exchange is genuinely good at custody. It runs key management you cannot replicate at home, it can freeze an account after a phishing incident, and it absorbs some categories of loss. Nothing about this case argues that self-custody is safer against theft - for most people it is not.

Privacy is where the asymmetry lives. Everything the exchange knows about you is one lawful request away from a government file, and you will usually not be told. There is no notification requirement in most jurisdictions, no chance to object, and no visibility into whether the request was narrow or broad.

The practical response is not "leave every exchange." It is to decide what you are comfortable being linked to your legal identity, and to structure accordingly.

Keep on an exchange what you actively trade, plus whatever fiat on-ramp you genuinely need. Move long-term holdings to a wallet whose keys you control, so that the intermediary who answers crypto exchange data requests holds a smaller picture of your finances.

Understand that self-custody removes the identity file, not the trail. Chain analysis still connects addresses, and the moment funds touch a verified account again, the link reappears. Privacy here is a gradient, not a switch.

Assume that anything uploaded during verification is permanent. Documents given to a compliance system are retained under regulatory schedules that outlive your account, which is why closing it changes very little.

Why exchanges rarely refuse

Refusal is not free. An exchange that ignores crypto exchange data requests in a country where it operates risks license conditions, frozen banking relationships and personal exposure for local executives. Compliance costs almost nothing by comparison.

That asymmetry is precisely why crypto exchange data requests get answered at a volume most users never see. Large platforms report tens of thousands of them per year. The disclosure in this case is unusual only because a document set became public.

The realistic mental model for crypto exchange data requests is therefore closer to a bank than to a private vault. Banks answer subpoenas; so do exchanges. Anyone whose threat model treats regulated intermediaries as neutral ground is working from the wrong diagram.

FAQ

Does an exchange notify you when it hands over your data? Usually not. Many legal requests arrive with confidentiality conditions attached, and even when they do not, most platforms have no policy of informing the account holder. Users typically learn about disclosure through a case file, as happened here.

Does leaving a market mean an exchange stops answering that country's requests? Not automatically. Exiting a market changes which obligations are enforceable, but records already collected still exist, and the company may still choose to respond. That is exactly the point the lawyer in this case raised.

Are small transfers really worth an investigation? The amount here reportedly exceeded seven hundred dollars, which shows the threshold is set by the nature of the case rather than by the size of the transfer. Where a prosecution turns on intent, the sum is evidence, not a filter.

Does using a non-custodial wallet make you invisible? No. It removes the verified identity file from one intermediary, but transactions remain public and analytics firms link addresses routinely. It changes who holds the connection between you and an address, not whether such a connection can be built.

Which jurisdiction's privacy law protects my account? Whichever one governs the entity that onboarded you, which is often not the country you live in. Check the terms of service for the operating entity's name, and note that global platforms register users to different entities depending on residence.

Should I split funds across several exchanges? It reduces how complete any single picture is, but it multiplies the number of identity files that exist. If the goal is fewer places holding your documents, fewer accounts with larger balances is the more consistent choice than many small ones.