Farming Crypto Exchange Accounts with AI-Generated Documents and Deepfake KYC

[Good Carder]

From carders to carders. In 2026, crypto exchanges are no longer the "Wild West." KYC has become mandatory for most platforms, and AML systems have learned to link accounts based on behavioral patterns. But this doesn't mean creating hundreds of verified accounts has become impossible. It means you need to take it to the next level. Instead of stealing other people's documents, you now create synthetic people—with AI-generated faces, fake passports, and deepfake videos.

In this article, I'll cover the full cycle of farming verified accounts on crypto exchanges. You'll learn how to generate unique faces using StyleGAN and diffusion models, how to create fake passports and driver's licenses, how to pass liveness detection using deepfake videos in real time, how to automate the registration of thousands of accounts using anti-detection and AI, and how to avoid being blocked after verification.

In 2026, crypto exchanges are spending millions on KYC providers (Sumsub, Onfido, Jumio, Persona), but their systems can still be circumvented. The key is to not be greedy and use a single fingerprint for hundreds of accounts. Let's get started.

Part 1: Why Cryptocurrency Exchange Account Farming Is the New Carding​

Previously, you stole cards and entered them into websites. Now you steal identities and enter them into the exchange. The goal is to get a verified account that can be used for:

• Withdrawals via carding. A clean Binance account with Level 2 verification allows you to withdraw up to 2–5 BTC per day.
• Cashing out cryptocurrency. A verified Bybit or OKX account is a bridge between cryptocurrency and fiat.
• Trading and laundering. With a verified account, you can make large-scale trades without raising suspicion.
• Synthetic identities are created. One verified account can be sold on the darknet for 50-300, while 100 accounts can sell for 5,000-10,000.

In 2026, losses from synthetic ID fraud in the financial sector reached $3.1 billion in the US, with global losses estimated at $10 billion. Cryptocurrency exchanges are a prime target because they allow withdrawals without physical goods. According to Sumsub, the number of deepfake attacks on KYC procedures has increased by 3,000% over the past 12 months, and one in five biometric fraud attempts involves deepfakes.

The average cost of a complete "synthetic identity + verified exchange account" package on the darknet ranges from $150 to $500. The cost of creating one account is approximately $10–$20 (proxy, document generation, deepfake). The profitability is 500–2,000%. This is a business.

Part 2. Generating Synthetic Documents: AI Instead of Photoshop​

Previously, forging documents had to be done manually: taking a passport template, changing the photo, adjusting the fonts. This took time and was easily detected during verification. Now, neural networks handle this.

2.1. Face Generation with StyleGAN and Midjourney​

Create a unique identity that never existed. This identity won't be found in leaked passport databases and won't raise suspicion during verification.

Tools:

• Midjourney / DALL-E 3 — generates photorealistic portraits for the search query "realistic passport photo, white background, neutral expression, front-facing, high resolution." However, you need to post the results several times to remove artifacts.
• StyleGAN3 is a local NVIDIA face generation model. It requires a powerful GPU but offers full control. GitHub repositories provide pre-trained models on the FFHQ dataset.
• This Person Does Not Exist is a simple website powered by StyleGAN2 that generates a random face on click. The quality is lower, but KYC is sufficient for many.

Important: AI faces often contain micro-artifacts (incorrect number of teeth, odd ears, asymmetrical eyes). Some KYC providers have learned to detect these. Therefore, use high-resolution models (1024x1024) and post-process them in Photoshop (remove artifacts, add natural noise).

2.2. Generating Passport and Identity Card Templates​

The face is ready. Now it needs to be pasted into a fake ID.

Tools:

• OnlyFake is a service that generates fake passports, ID cards, and driver's licenses for 26 countries for $15. According to 404 Media (2024), OnlyFake successfully bypassed KYC on OKX, Kraken, Bybit, Huobi, and PayPal. In 2026, the service significantly improved quality and added support for RFID chips (emulation).
• ChatGPT-4o – In April 2025, researcher Boris Museljak demonstrated that ChatGPT-4o could create a convincing fake passport in 5 minutes, which passed KYC verification on Revolut and Binance. This method was deprecated in 2026, but jailbroken local LLMs (Llama 3, Mistral) continue to be used.
• PSD templates – ready-made passport templates for the US, UK, and EU (from 20 to 100) are sold on the darknet. You insert your AI face and customize the details (name, date of birth, passport number). The key is choosing the font and the arrangement of the elements.

What should a quality fake passport contain?

• MRZ (Machine Readable Zone) with a valid checksum. Generated by online tools.
• Correct font (OCR-B, passport specific).
• Shadows and reflections in the photo (to simulate a real photo).
• Holograms (they are not present on photoshopped templates, but a digital image is sufficient for online verification).

2.3. Automation of document generation​

You won't be manually creating 100 passports. Write a script that:

1. Generates a random face using StyleGAN or Midjourney API.
2. Generates random data (name, surname, date of birth, address) using the Faker library.
3. Inserts a face into a passport template using OpenCV (resize, rotate, color correct).
4. Adds noise, compression, artifacts (simulates scanning).
5. Saves the result as PDF/JPEG.

import cv2
import numpy as np
from faker import Faker
from PIL import Image
import random

fake = Faker()

def generate_fake_identity():
name = fake.name()
dob = fake.date_of_birth(minimum_age=18, maximum_age=70)
address = fake.address()
return {'name': name, 'dob': dob, 'address': address}

def insert_face_into_template(face_image_path, template_path):
face = cv2.imread(face_image_path)
template = cv2.imread(template_path)
# Here's the code for scaling and inserting the face into the desired region
# ...
return output_path

Part 3: Deepfake Video to Bypass Liveness Detection​

A static passport photo isn't enough. Almost all KYC providers require selfies with head movement, blinking, or speaking numbers. Deepfake videos automate this process.

3.1. Tools for generating deepfake videos​

DeepFaceLab (DFL) is the industry standard for video face replacement. It requires a powerful GPU (RTX 4090) and training time (4-12 hours). However, in 2026, ready-made models for many scenarios appeared.
ROPE is a lighter alternative that works in real time. It uses the inswapper_128.onnx model. Face replacement takes seconds, but the quality is lower.
DeepFaceLive allows you to replace faces live from a webcam. This is ideal for live verification.
InsightFace (ROPE) is a one-shot face replacement without lengthy training. You upload a single photo of the AI face and superimpose it on a video of a real person (pre-recorded or broadcast).

3.2. Creating a KYC Video (Step-by-Step)​

1. Record a reference video of a real person (you can buy a recording on the dark web or use a disguise). The video should include: head turns left and right, eyebrow raising, blinking, smiling, and random numbers (e.g., "1, 2, 3, 4").
2. Train the DeepFaceLab model on several frames of an AI face (50–200 images). The more frames, the better the quality of the replacement.
3. Replace the face in the reference video with an AI face. The output is a video where the person with the synthetic face meets all liveness detection requirements.
4. Prepare your video for submission. Some KYC systems check video metadata (codec, bitrate). Convert it to a standard-compliant format (H.264, 720p/1080p resolution).

3.3. Deepfake video injection into webcam (live verification)​

Some exchanges require live verification via webcam rather than video uploads. This is where the "virtual camera" technique comes in handy.

Tools:

• OBS Studio + VirtualCam plugin creates a virtual video capture device. You upload a pre-recorded deepfake video to OBS, and the virtual camera streams it to your browser. The KYC system sees it as a real webcam.
• ManyCam is a paid alternative with more functionality.
• A custom Python script with OpenCV that generates video on the fly and replaces the stream via v4l2loopback (Linux).

Important: Live verification may require random actions (e.g., "turn your head to the right and say 'orange'"). Your pre-recorded video should contain all possible variations. Some systems use AI to verify that the video was not pre-recorded (analyzing pupil movement and eye reflections). Deepfakes are often detected by the lack of micro-movements. To evade this, use models trained on high-FPS videos with added natural noise.

3.4 Bypassing Liveness Detection via API Injection (Advanced Method)​

Instead of replacing the video, the carder can inject a pre-made deepfake frame directly into the KYC provider's API request. Many banking apps use an SDK that encrypts the data when sending photos and videos. If you've hacked or patched the app, you can intercept the request and replace the binary data with a deepfake video.

This method is more complex, but it allows you to bypass the protection of virtual cameras, which some systems have learned to detect. In 2026, hackers demonstrated an attack on the KYC provider Sumsub using a modified app that sent a pre-recorded deepfake instead of a real selfie.

Part 4. Automation of mass registration and verification​

Creating one account manually takes 15–20 minutes. For 100 accounts, everything needs to be automated: from document generation to submitting for verification.

4.1. Infrastructure for mass pharma​

• Anti-detection browser with API (Dolphin Anty, Octo, GoLogin). Each account is a unique fingerprint. The API allows for programmatic profile creation.
• Residential proxy pool (50–200 IPs). Each account is its own proxy, and the country must match the document (US proxy for a US passport).
• Email and phone number database. Use a catch-all domain (for example, create random@yourdomain.com ) and SMS activators (SMS-activate, 5sim) for verification.
• A warehouse of fake documents. Passports, selfies (photos), and deepfake videos for each account. Generated on the fly.
• An orchestrator script (Python, Selenium/Playwright) that manages the entire process.

4.2. Binance Registration Process (Example)​

import time
from playwright.sync_api import sync_playwright

def register_binance(identity, proxy, fingerprint):
with sync_playwright() as p:
browser = p.chromium.launch(
headless=False,
proxy={"server": proxy},
args=[f"--window-size={fingerprint['width']},{fingerprint['height']}"]
)
context = browser.new_context(
user_agent=fingerprint['user_agent'],
viewport={"width": fingerprint['width'], "height": fingerprint['height']}
)
page = context.new_page()
page.goto("https://www.binance.com/en/register")
page.fill("#email", identity['email'])
page.fill("#password", identity['password'])
page.click("button[type='submit']")
# Email confirmation (automatic interception via catch-all)
time.sleep(5)
# Profile completion
page.goto("https://www.binance.com/en/user/center/profile")
page.fill("#firstName", identity['first_name'])
page.fill("#lastName", identity['last_name'])
page.fill("#dateOfBirth", identity['dob'])
# Upload passport photo
with page.expect_file_chooser() as fc_info:
page.click("#uploadPassport")
file_chooser = fc_info.value
file_chooser.set_files(identity['passport_path'])
# Upload selfie
# ... same as above
# KYC verification (requires deepfake video or Live camera)
# ...
browser.close()

To bypass live verification via webcam, a combination of OBS VirtualCam and pre-recorded video is used. However, this is difficult to automate. Advanced farmers use an API that directly sends deepfake video to the verification service.

4.3. Using ready-made KYC as a Service (PhaaS)​

There are services on the darknet that offer "ready-made verification" for $10–50: you submit your information, they perform KYC for you using their deepfake tools, and return a ready-made account. This is more expensive, but doesn't require technical knowledge.

Examples (found on forums, names vary): Verified.mn, KYCDone, Passus. They operate via API.

Beware: many of these services are scams. Check their reputation on forums.

Part 5. Bypassing Additional Checks: Social Media and Residential Address​

Some exchanges require proof of address (a utility bill) or a social media account. These can be faked.

5.1. Forgery of address documents​

• Electricity bills, bank statements – use PSD templates. Insert your name and address. Add your company logo, fonts, and QR codes.
• Letter Photo - Take a photo of the printed invoice with your phone, add a shadow and some distortion to make it look realistic.

5.2. Creation of synthetic social networks​

• Register accounts on Facebook, Instagram, LinkedIn under the name of a synthetic personality.
• Add 10-20 friends (bots or drops are possible).
• Post several posts (photos, texts) from the last 2-3 months.
• Log in to your accounts periodically to stay active.

Some KYC providers check social media presence as an additional trust factor. An account with friends and posts is easier to verify.

Part 6. Monetization of verified accounts​

6.1. Selling accounts on the darknet​

• Price: Binance Level 2 account - 50-150, Bybit Level 2 account - 50-150, Bybit Level 2 account - 40-100, Kraken Level 2 account - 80-200, Coinbase account with extended limit - 100-300.
• Sales channels: Telegram bots (automatic delivery), forums (Exploit, XSS, Carder.su), marketplaces (Torzon, Kraken DNM).
• Guarantees: For large sales, use escrow.

6.2. Using for cashing out cryptocurrency​

A verified Binance account allows you to withdraw $100,000+ per day. You can sell USDT for rubles or dollars via P2P without fear of being blocked, as your account is "clean."

6.3. Account Rental (Mule-as-a-Service)​

Some carders rent out verified accounts to other carders temporarily. Price: $10–30 per day. This is passive income.

Risks: The renter may take actions that will lead to account blocking. Therefore, take a deposit or work only with verified clients.

Part 7. OPSEC and the Farmer's Checklist​

• Isolation. Each account has its own proxy, its own anti-detection profile, its own phone number, its own email. No mixing.
• Document generation. Use only high-resolution AI faces. Do not duplicate the same face across multiple accounts.
• Deepfake videos. Test on KYC providers using demo accounts before mass deployment. Practice on smaller exchanges.
• Warm up your account. After verification, don't withdraw large amounts at once. Make several small transactions to simulate trading.
• Rotation. Don't use your account for more than 2-3 months. "Burn" it (sell it or stop using it).
• Cover your tracks. After creating an account, delete all generated documents from your local drive (or store them in an encrypted container). Delete deepfake videos.

Disclaimer: Creating fake documents and bypassing KYC is a scam. I'm describing the technical aspects here. You are responsible for how you use them.

Summary​

Farming verified crypto exchange accounts is a high-tech business. AI-powered face generation, fake passports, deepfake videos, and automated registration make it possible to create hundreds of "synthetic people" who successfully pass KYC. The cost of one account is 10-20, with a selling price of 50-300. Profitability ranges from 500% to 2,000%.

In 2026, KYC providers (Sumsub, Onfido, Jumio) are actively implementing AI-powered deepfake detection and liveness analysis of micromovements. But the arms race continues. The winner is the one who invests in the best generative models and is not greedy.

A quick one-line reminder:
"StyleGAN generates a face, OnlyFake creates a passport, DeepFaceLab animates it in video, OBS VirtualCam streams the deepfake to KYC. The synthetic identity is ready." Binance gives you Level 2. Sold your account for 100. Repeat 100 times. 100. Repeat 100 times. 10,000 in your pocket. The main thing is not to use the same face twice."