The "funds were not affected" line deserves exactly the skepticism you give it. Crypto can be made whole; identity data can't be rotated. A leaked KYC record - name, address, document image - is a permanent asset for whoever holds it, and its most immediate use is precision phishing: someone who knows you hold a specific card, knows your name, and can cite a real incident has everything needed to craft the follow-up "verify your account" email that actually lands. One thing worth adding to the response checklist for fintech breaches: a pre-planned user-communication channel that does not rely on email, because email is precisely the channel attackers will imitate in the days after the announcement. The first line of these statements tells you about the ledger. The second line tells you about the next six months of phishing.