Zero-knowledge scaling company StarkWare has introduced a novel identity verification system called Private KYC on its Starknet platform. The system, announced as a demo, allows users to complete know-your-customer (KYC) requirements without revealing their complete personal information. By leveraging STRK20 privacy features and zero-knowledge STARK proofs, users can prove specific attributes—such as being over 18 years old, holding valid credentials, or meeting an eligibility rule—without disclosing their full passport details or home address.

“Whether you need to prove you’re over 18, hold a valid credential or meet an eligibility rule, verification should only confirm the precise fact,” StarkWare stated. The company emphasized that corporations should not collect the full identity behind these facts, “because every identity database becomes a liability the moment it exists.” This philosophy directly addresses a fundamental flaw in traditional KYC processes: the requirement to hand over extensive personal data and trust companies to safeguard it.

How Private KYC Works

The user experience begins with scanning a passport on a smartphone. Using the device’s camera and NFC chip, the system reads the passport and cryptographically confirms that the document is genuine and signed by its issuing authority. After verification, the user can encrypt their identity data directly to their Starknet wallet. From there, specific attributes are registered in a public onchain registry, and the user can submit zero-knowledge proofs for selective checks. Verifiers—such as exchanges or financial institutions—can confirm eligibility by reading the public registry without ever seeing the actual identity data. “Contracts check the proofs, not the passports,” StarkWare noted.

This approach is a significant departure from conventional KYC, where a company stores copies of passports, driver’s licenses, or utility bills. Even if a company implements strong security measures, the very existence of a centralized database creates a target for hackers. StarkWare’s self-custody model ensures that sensitive identity information never leaves the user’s control, drastically reducing the risk of large-scale data breaches.

The Growing Data Breach Problem

The introduction of Private KYC comes at a time when data breaches are reaching alarming levels. According to recent statistics, the United States recorded a historic 3,322 data compromises in 2025—a 79% increase over five years. Globally, the average cost of a data breach now stands at $4.4 million, as reported by StationX. In the healthcare sector, Axis Intelligence data shows that over 1 billion healthcare records have been breached, with an average cost of $7.42 million per incident. In 2025 alone, the US confirmed 772 large healthcare data breaches, the highest annual total ever recorded.

The cryptocurrency industry is not immune. One of the most damaging breaches occurred at hardware wallet provider Ledger in 2020, when a massive database hack exposed more than 270,000 customer records. That incident triggered a wave of phishing attacks that continue to plague the community years later. Such incidents underscore the critical need for identity verification solutions that minimize data collection and eliminate centralized honeypots.

Comparison with World ID and Self-Custody

StarkWare’s Private KYC bears similarities to Sam Altman’s World ID (Worldcoin), which uses zero-knowledge proofs to verify humanness through iris scans captured on hardware orbs. However, World ID faced significant backlash over its centralized custody of biometric data. Critics argued that storing iris scans in a central database, even with encryption, creates a single point of failure and potential privacy violations. StarkWare’s model directly addresses that concern by keeping identity data on the user’s device and wallet, not on a corporate server. The company’s emphasis on self-custody means users maintain full control over who sees what information and when.

“Identity checks today ask for your whole document when they only need one fact,” the Starknet team remarked. This principle applies to both traditional KYC and newer biometric verification systems. By decoupling the act of verification from the revelation of underlying data, StarkWare aims to create a system where privacy and compliance are not mutually exclusive.

Technical Foundations and Privacy Benefits

At the core of Private KYC is zero-knowledge STARK (Scalable Transparent Argument of Knowledge) technology. STARKs allow a prover to convince a verifier that a statement is true without revealing any additional information beyond the validity of the statement itself. Unlike earlier zero-knowledge systems, STARKs do not require a trusted setup, making them more transparent and secure. StarkWare has been a pioneer in bringing STARK-based scaling solutions to Ethereum, and now applies that same cryptographic rigor to identity verification.

The system uses the STRK20 privacy features of Starknet, which enable selective disclosure of attribute data. For example, a user can generate a proof that they are over 18 without revealing their exact birth date or name. A verifier—say a regulated crypto exchange—only sees the proof and the public onchain registry entry that confirms the attribute is valid. The actual identity data remains encrypted and is accessible only by the user’s wallet.

This architecture has several practical benefits. First, it reduces the legal and operational burden on companies: they no longer need to store and protect reams of identity documents. Second, it minimizes the attack surface for cybercriminals. Even if an exchange’s systems are compromised, the attacker would find only cryptographic proofs and registry entries, not raw passport scans. Third, users gain greater control over their personal data, aligning with emerging privacy regulations like the GDPR and California Consumer Privacy Act (CCPA).

Implications for the Crypto Industry

The crypto industry has long struggled with the tension between regulatory compliance and user privacy. Exchanges must perform KYC checks to meet anti-money laundering (AML) requirements, yet collecting personal data exposes both users and companies to risks. StarkWare’s Private KYC offers a middle path: verifiers can satisfy regulatory obligations without becoming custodians of sensitive data. If adopted widely, it could reshape how identity verification is conducted across decentralized finance (DeFi) and centralized crypto services.

Several major crypto firms have already explored privacy-preserving KYC solutions. Projects like Polygon ID and cheqd have proposed similar models using zero-knowledge proofs and verifiable credentials. However, StarkWare’s integration with the Starknet ecosystem—a zk-rollup that already processes millions of transactions—provides a practical testbed for such technology at scale.

The demo version of Private KYC is currently available on Starknet, with plans to expand to other chains and use cases. StarkWare has not announced any partnerships yet, but the company indicated that it is in talks with multiple financial institutions and crypto service providers. The success of Private KYC will depend on regulatory acceptance, user adoption, and the ability to integrate seamlessly with existing compliance workflows.

“Private KYC shows that verification and privacy aren’t a trade-off,” StarkWare said. “An institution can confirm exactly what it needs without assembling another copy of someone’s identity it then has to defend.” As data breaches continue to rise and regulatory scrutiny intensifies, solutions that reconcile compliance with privacy are likely to become increasingly valuable.

Source: Cointelegraph News