Troy Hunt, the security researcher behind the data-breach notification service Have I Been Pwned, said the project will stop accepting cryptocurrency donations. The reason: Australia's tightening oversight of digital assets has created compliance requirements that Hunt says are impossible to meet, especially for small, one-off contributions.
Why Hunt made the call
Hunt, who is based in Australia, said the country's cryptocurrency oversight requirements have become too onerous for a donation-funded service. The compliance burden, he explained, is disproportionate for small donations. Verifying the identity of every donor who sends a few dollars in Bitcoin or Ethereum isn't practical. The project would need to collect personal information from donors, which runs counter to the privacy ethos of many crypto users. Hunt called the requirement impossible to fulfill.
Why small donations are the problem
Have I Been Pwned relies on voluntary contributions to keep running. Many of those come in small amounts from individual users who want to support the service. Under the new Australian rules, each donation would require the same level of due diligence as a large transaction. That means collecting names, addresses, and identification documents from people who just want to send a few bucks. Hunt said that's not feasible for a small team.
The service will continue to accept donations via traditional methods like credit cards and PayPal. The core functionality — notifying users if their email appears in a data breach — remains free. Hunt said the decision was not made lightly, but the regulatory environment left no choice. The change takes effect immediately.
The move shows the growing tension between privacy-focused services and anti-money laundering rules. Australia has been tightening its crypto regulations, and other countries may follow. For now, crypto donors will have to find other ways to support the project. Hunt did not specify whether he plans to challenge the regulations or seek an exemption.
