Passport? Nah. StarkWare Just Yelled "ZK or It Didn't Happen" at KYC 🛂

Zero-knowledge scaling firm StarkWare unveiled a "Private KYC" demo on Starknet on Tuesday, pitching a system that lets users satisfy know-your-customer checks by proving narrow facts — such as being over 18 or holding a valid credential — without handing over full passport data or home addresses. The setup leans on STRK20 privacy features and zero-knowledge STARK proofs to register encrypted attributes in a public onchain registry and let verifiers confirm eligibility without ever viewing the underlying identity record. "Whether you need to prove you're over 18, hold a valid credential or meet an eligibility rule, verification should only confirm the precise fact," StarkWare said, arguing that "every identity database becomes a liability the moment it exists."

Users begin by scanning a passport with their phone, using the camera and the document's NFC chip to confirm it is genuine and signed by its issuing authority. They then encrypt the identity data to their Starknet wallet, register selected attributes publicly, and submit zero-knowledge proofs for the checks a counterparty actually needs. "Identity checks today ask for your whole document when they only need one fact," the Starknet team said, adding that "an institution can confirm exactly what it needs without assembling another copy of someone's identity it then has to defend." Contracts verify the proofs, StarkWare noted, not the passports.

The rollout lands against a backdrop of mounting breach costs: the US recorded 3,322 data compromises in 2025, a 79% increase over five years, with a global average breach cost of $4.4 million, according to StationX. Healthcare has been hit harder still, with more than 1 billion records exposed and an average breach cost of $7.42 million as of 2026 per Axis Intelligence, including 772 large US healthcare breaches in 2025 — the highest annual total on record. In crypto, hardware wallet provider Ledger suffered the largest industry breach in 2020, leaking more than 270,000 customer records and fueling phishing campaigns that continue today.

The design echoes Sam Altman's World ID, also known as Worldcoin, which uses zk-proofs and iris scans on hardware orbs to verify humanness, though it drew backlash over centralized biometric custody — a model StarkWare says its self-custody architecture is built to avoid. StarkWare framed Private KYC as part of a broader privacy push alongside Sui's work on compliance-ready confidential transfers, arguing that compliance and confidentiality no longer have to be opposites on public ledgers.