rewrite this title Vikrant Sharma: Third-Party Doctrine Opens Crypto to Unchecked Financial Surveillance

by
Victoria d’Este

Published: July 25, 2025 at 9:21 am Updated: July 25, 2025 at 5:00 pm

by Ana

Edited and fact-checked:
July 25, 2025 at 9:21 am

To improve your local-language experience, sometimes we employ an auto-translation plugin. Please note auto-translation may not be accurate, so read original article for precise information.

On July 7, 2025, the U.S. Supreme Court declined to review Harper v. Faulkender, by upholding the third-party doctrine’s application to public blockchain data. By treating on-chain transaction records like bank statements shared with a financial institution, the Court upheld a precedent allowing broad IRS and law enforcement scrutiny of Bitcoin transactions.

According to Vikrant Sharma, CEO of Cake Labs (Cake Wallet), this is a shift towards financial monitoring that threatens users’ personal privacy. 

Third-Party Doctrine: An Outdated Surveillance Lever

The third-party doctrine, created before the digital age, says that any information you willingly share with someone else isn’t protected by the Fourth Amendment.  Decades ago, that meant bank statements or phone numbers dialed; more recently, courts extended it to stored emails and location data.

Now, by applying it to blockchain records, the doctrine has been repurposed as a sweeping surveillance lever. Blockchains are decentralized, pseudonymous ledgers, nothing like a commercial bank’s centralized database. Yet the law forces users to forfeit privacy simply by participating in a public network.

Mass surveillance: 

Back then, investigators targeted specific accounts based on probable cause. But with blockchain analytics firms housing terabytes of on-chain data, a single IRS summons can now sweep in millions of transactions and hundreds of thousands of addresses. 

A single broad subpoena could potentially reveal a detailed map of who paid whom, when, and how much — especially when combined with external metadata. Criminals, activists, and ordinary citizens alike find their financial histories laid bare. The Supreme Court’s hands-off approach transforms what was once targeted oversight into unchecked dragnet surveillance.

Beyond U.S. courts, international regulators are tightening surveillance mandates. The Financial Action Task Force’s “Travel Rule” compels virtual-asset service providers worldwide to share sender and recipient personally identifiable information for transactions above a threshold. 

Many European, Japanese, and Canadian exchanges now exchange KYC data in real time, creating transnational surveillance networks. Even compliant users see their pseudonymous transactions rendered transparent to multiple governments, and no warrant is required. The Harper ruling further entrenches this surveillance scaffolding by legitimizing bulk data access.

Coinbase’s appeal: 

Recognizing the chilling implications, Coinbase, the largest U.S. cryptocurrency exchange, filed its own complaint this spring against the Department of Justice and IRS summons practice. Coinbase argues that mass subpoenas for on-chain data violate users’ Fourth Amendment rights and exceed statutory authority.

Under the IRS’s authority, a John Doe summons allows the agency to demand records relating to unnamed individuals. Historically, this tool was reserved for narrow, targeted investigations, say, tracing a specific set of bank accounts.

For Coinbase, broad data demands could expose information belonging to countless users who were never subjects of any investigation — a scenario that undermines the fundamental principles of due process and privacy. Coinbase is in a difficult position: defending user privacy on one hand, while contending with government demands on the other.

Coinbase asserts that compelling production of on-chain mappings information held by a third party but intrinsically tied to its customers’ private keys constitutes an unreasonable search. Unlike bank statements, which users knowingly share with a financial intermediary, on-chain analytics derive from public blockchain data and private-key ownership. By blurring these distinctions, the IRS has effectively reclassified pseudonymous, self-custodied user data as “voluntarily” shared, eroding any expectation of privacy.

Beyond constitutional concerns, Coinbase challenges the statutory basis for the summons itself. The company argues that the IRS lacks authority under the Internal Revenue Code to demand bulk data from non-custodial service providers. Under current law, summonses must target specific persons or transactions; they were never intended as tools for mass data harvesting.

When Private Firms Become Surveillance Vessels

Surveillance goes well beyond government agencies. Some analytics companies sell detailed blockchain data that links wallet addresses with IP logs and KYC details from exchanges to marketing firms, hedge funds, and private investigators

Back in September 2023, Nansen, a blockchain analytics platform, disclosed a third-party vendor breach that exposed email addresses, encrypted password hashes, and blockchain addresses for roughly 6.8% of its users. 

In June 2022, there was a breach involving OpenSea’s email provider, Customer.io, which ended up exposing the email addresses of over seven million users. About two and a half years later, those emails ended up online and pretty much gave scammers a ready-made list for targeting people with phishing attacks. 

Beyond wallet draining, some attackers posed as platform administrators, scamming high-profile users and making people even more hesitant to trust digital asset platforms.

Conclusion: 

Financial privacy underpins free speech, association, and dissent. If every donation to a cause people find controversial, every subscription to an indie newsletter, or even buying something sensitive can be linked back to you, it’s only natural that people start censoring themselves.

Journalists, activists, and ordinary citizens alike will avoid blockchain solutions, fearing exposure. The stakes extend beyond individual choice. A surveillance-chilled ecosystem undermines the very promise of decentralized finance, a promise built on autonomy, censorship resistance, and permissionless participation.

If we’re okay with letting anyone dig through on-chain records now, we’re basically setting the stage for a future where even the most ordinary financial move can be picked apart by governments or data brokers whenever they want. That kind of precedent opens the door to even more surveillance over time, slowly wearing down civil liberties until real privacy is almost gone.

Turning things around will require action on multiple fronts. Courts must recognize that decentralized-ledger data is not equivalent to bank statements and rein in dragnet summonses. Legislators should enact targeted reforms that require specificity and warrant-level oversight for blockchain data requests. 

Regulators, for their part, can tell the difference between custodial exchanges and people using self-custodial wallets, granting the latter a reasonable expectation of privacy aligned with their autonomy.

At the same time, people and companies need to start doing their part, things like switching up addresses, using privacy tools, and avoiding oversharing data with big platforms. The more we make surveillance expensive and harder to pull off, the more it sends a message that real privacy protections actually matter.

About The Author

Victoria is a writer on a variety of technology topics including Web3.0, AI and cryptocurrencies. Her extensive experience allows her to write insightful articles for the wider audience.

More articles

Victoria d’Este