StarkWare introduced Private KYC on Starknet on Tuesday, a demonstration that lets users prove specific identity attributes without surrendering their full passport details to the institution that checks them.
The system runs on STRK20, Starknet's privacy capability for ERC-20 assets, and generates zero-knowledge STARK proofs that confirm an attribute without exposing the document behind it. A verifier reads the on-chain registry to confirm an account is eligible, then gates an action to it without ever accessing the underlying personal data.
"Identity checks today ask for your whole document when they only need one fact," the Starknet team said.
The conventional KYC process hands a full document to a verifier who copies it and stores it. Each verification adds another copy to another database. StarkWare framed the issue in structural terms.
"Whether you need to prove you're over 18, hold a valid credential or meet an eligibility rule, verification should only confirm the precise fact," the company said, adding that corporations should not collect the full identity behind a check "because every identity database becomes a liability the moment it exists."
1/ KYC is broken.
— StarkWare 🥷 (@StarkWareLtd) June 23, 2026
To prove one simple thing about yourself, you still have to hand over everything: name, date of birth, nationality, document number…
We’re building a better model with Private KYC powered by STRK20s 🧵 pic.twitter.com/gvRXdEs5ua
What happens when a user scans their passport
StarkWare's model takes a different path from the document-copy approach that KYC has relied on for years. A user scans their passport on their own phone. The NFC chip read confirms the document is genuine and signed by its issuing authority. No third party handles it. The app then encrypts the identity directly to the user's own Starknet wallet. No central verifier collects or warehouses the raw file.
Registered attributes such as over-18 status go into a public on-chain registry. Smart contracts check proofs rather than passports. Each passport can register only once, which binds one verified identity to one account. Verifiers read the registry and confirm eligibility. The identity behind the account stays encrypted and, according to StarkWare, is never decryptable.
A demo feature in the release shows a gated private transfer: verified accounts can claim from a shielded payout pool while unverified ones cannot. The same eligibility signal can be read by other contracts on the network. The identity data is never exposed in that process.
The breach record that gives the demo its context
The cost side of centralized identity storage has become difficult to dismiss. The US recorded 3,322 data compromises in 2025, a 79% increase over five years, according to StationX. The global average cost of a single data breach stands at $4.4 million. Axis Intelligence put the total number of breached health care records above 1 billion as of 2026, with an average breach cost per incident of $7.42 million. US authorities confirmed 772 large health care data breaches in 2025 alone, the highest annual total on record.
The crypto sector carries its own example of this exposure. In 2020, hardware wallet provider Ledger suffered a database breach that exposed more than 270,000 customer records. The leak fed a wave of phishing attacks that continued well past the original incident.
How it differs from World ID
Private KYC shares some architectural ground with Sam Altman's World ID, the identity layer behind Worldcoin, which uses zk-proofs to verify humanness through iris scans on hardware orbs. World ID faced criticism over centralized biometric custody, where the biometric data is held by hardware infrastructure outside the user's control.
StarkWare's model keeps the encrypted identity inside the user's own wallet. There is no central verifier that warehouses the raw document, and the encrypted data carries no viewing key.
"Private KYC shows that verification and privacy aren't a trade-off," StarkWare said. "An institution can confirm exactly what it needs without assembling another copy of someone's identity it then has to defend."
StarkWare described the release as a proof-of-concept to walk government and institutional teams through ZK-identity on Starknet. The company did not provide a timeline for a full deployment beyond the demo.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
