Aztec Labs buying zkPassport and pledging to keep both the protocol and the iOS app open-source is the smallest news in privacy infrastructure this quarter. Hear me out. The acquisition release is doing the work the technology has not. Open-source has never been the bottleneck. The bottleneck is the regulated counterparty on the other side of the proof — the exchange that has to accept a zk attestation in place of a passport scan. Of the five largest CEX onramps I track in the grounding for this desk, the count accepting zk identity at deposit today is zero. That is the article.
Open-Source Pledge
An open-source pledge is a license commitment. It is not a maintenance commitment, not a security-audit commitment, and not a roadmap commitment. Aztec can publish every line of the zkPassport repo under Apache 2.0 tomorrow and still quietly shrink the team that was actually fixing the NFC parser bugs.
The pledge matters less than the funding line item underneath it. I have seen this movie. A protocol gets acquired, the codebase gets dutifully mirrored on GitHub, and twelve months later the issue tracker has 340 open items and the last meaningful commit is from someone who left for a bigger token grant elsewhere. The license stays open. The project stops moving.
The right question is not whether the source is public. The right question is whether the integration surface — passport readers, mobile SDKs, verifier contracts — is being actively maintained against the operating systems and chains that change underneath it. That is a budget question. An open license does not pay for it.
Privacy Protocol
A privacy protocol, in the zkPassport sense, is a cryptographic pipeline that turns a physical identity document into a verifiable claim without leaking the underlying document. You scan your passport's NFC chip. The phone reads the signed data structure. A zero-knowledge circuit proves you possess a valid passport — and optionally that some attribute of it is true — without revealing the document itself.
The architecture is sound. The architecture has been sound for years. Sismo published similar primitives in 2022. Polygon ID shipped a comparable stack. Worldcoin's orb proof was a wilder variant of the same idea. None of these protocols have meaningfully displaced traditional KYC at any regulated venue I track.
Why? Because the protocol does the easy half of the job. The hard half — convincing a compliance officer at a CEX that a 200-byte hex string is an acceptable substitute for a Jumio-style document scan with liveness check — is a procurement and legal conversation, not a cryptography conversation. The protocol does not get you that meeting.
Zero-Knowledge Proof
A zero-knowledge proof lets one party convince another that a statement is true without revealing why it is true. In zkPassport's case, the statement is roughly "the holder of this device possesses a passport whose data is signed by a government-issued certificate", and the proof reveals nothing else about the passport.
The cryptography here is mature. Groth16, PLONK, Halo2 — pick your scheme. The proving times on a modern phone for circuits this size sit in the seconds-to-tens-of-seconds range. That is good enough. The user-experience tax is not the math.
The user-experience tax is the verifier. Every party that wants to consume the proof has to run code that interprets it. For a smart contract on Aztec, fine — that is what Aztec exists for. For Binance's deposit flow? Binance is not running an Aztec verifier in its KYC pipeline. Nobody has shipped that integration. The proof is sound. The reader is missing.
Selective Disclosure
Selective disclosure is the feature that makes zkPassport interesting commercially: the protocol can answer narrow questions — "is the holder over 18?", "is the holder a citizen of a non-sanctioned jurisdiction?", "is the holder unique within this protocol?" — without exposing the document. You release one bit. You keep the other 4,000.
This is the right primitive for the regulatory framing exchanges actually face. A CEX does not, in most contexts, need to know your full passport. It needs to satisfy specific compliance tests: age, sanctions, jurisdiction-of-residence, source-of-funds tier. Selective disclosure maps cleanly onto each of those tests.
The mismatch is operational. Compliance teams at Binance, Bybit, OKX, Bitget, MEXC have been buying from the same three or four vendors — Jumio, Sumsub, Onfido, Au10tix — for years. The audit trail at every regulator they answer to is built around those vendors' artifacts. A zk proof produces a different artifact. Different artifacts mean a new compliance review cycle, and compliance review cycles at CEXs are 12-to-18-month projects on the ones who are fastest.
iOS Mobile App
The iOS app is the part of zkPassport that touches real users, and it is also the part most exposed to a platform Aztec does not control. NFC passport reading on iOS requires Apple's CoreNFC entitlements. The app is a binary in App Store Connect. Apple decides whether the next major iOS version breaks anything.
Open-sourcing the iOS app helps developers fork it and run it elsewhere. It does not help non-developer users. Non-developer users install whatever is in the App Store. If Aztec slows the release cadence — or, more likely, lets the certificate expire on the bundle ID during some org reshuffle — the app is gone from millions of phones in a single update cycle.
This is the structural fragility of mobile-first privacy infrastructure. The protocol can be perfect, the source can be public, the cryptography can verify on any chain. The distribution sits inside a walled platform that does not care about either, and where the entire user surface can be revoked through one administrative decision.
KYC Onramp
The KYC onramp is the point at which fiat or stablecoin enters an exchange's custody and the exchange is legally required to know who is depositing. This is where every privacy-preserving identity scheme either gets accepted or gets bypassed by the user falling back to a regulated alternative. So far, the universal answer has been the second one.
Look at the grounding. Binance — daily volume $18.5B, KYC required at deposit per the fact DB, tier-2 licenses in Dubai (VARA), France (AMF, limited), Italy (OAM, limited). Every dollar through that funnel passes a traditional KYC gate. Bybit, $9.2B daily volume, has KYC-required-at-deposit set to false in the same fact DB, but its CySEC and VARA licenses both mandate identity verification before the customer crosses tiered withdrawal limits. OKX, Bitget, MEXC the same shape.
Five exchanges. Combined daily volume north of $42 billion per the grounding. Zero advertised support for zk identity attestations at the moment of deposit. That number has not moved in two years.
Proof of Personhood
Proof of personhood is the assertion that a unique human stands behind an account, independent of whatever else that human's identity may be. It is the property you want for sybil resistance — one human, one account — and it is distinct from KYC, which asks who the human is in a state-recognized sense.
zkPassport can supply proof-of-personhood without supplying KYC, because the passport's nullifier can prove uniqueness without revealing identity. This is a clean primitive for governance, airdrops, anti-bot gating on DeFi protocols. The actual demand for it has been thinner than the conference-talk volume suggests.
The reason: CEXs do not particularly want proof of personhood. They want documentary KYC because regulators audit documentary KYC. DeFi protocols that do want personhood mostly accept weaker signals — wallet age, transaction patterns, gas-token burn — because the strong signal is friction that kills onboarding. So the cleanest use case for selective-disclosure passports has the smallest funded buyer base.
Custodial Identity
Custodial identity is the model where a third party — a CEX, a bank, a government-adjacent identity provider — holds the canonical record of who you are, and proves things about you on your behalf. It is the opposite of what zkPassport is trying to enable. It is also what every regulated CEX in the grounding actually operates today.
This is the part of the conversation Crypto Twitter keeps skipping. Self-sovereign identity is not the default model. It is an aspiration imposed on top of a regulated stack that defaults to custodial. Binance's proof-of-reserves audit dated 2025-03-01 in the fact DB does not extend to its KYC database, and the customer cannot move that KYC record. Bybit's last PoR audit, 2025-03-12, same story. The identity is custodial. The user does not own it.
A zk attestation flips that. Aztec acquiring the protocol does not flip the buyer's preference. Buyers prefer custody. They were built around it.
Regulated Counterparty
A regulated counterparty is any actor — exchange, broker, custodian, bank — whose operations are subject to a financial-services license that prescribes how identity is verified and stored. The grounding lists the relevant ones for this desk: Binance under VARA, AMF, OAM. Bybit under CySEC and VARA. Bitget under Lithuania's FCIS and Poland's KNF. OKX under VARA (provisional) and the Bahamas SCB. MEXC under Seychelles FSA, which is a tier-3 offshore licensing posture.
Every one of those frameworks specifies acceptable forms of identity verification. None of them, as of the most recent text I have surveyed, names zero-knowledge proof of a passport as an accepted form. The compliance officer at any of these exchanges who proposed accepting a zk attestation in place of the existing flow would be asking their regulator to sign off on a control they have not reviewed.
Regulators do that work eventually. They are not doing it on the timetable Aztec's press release implies.
Acquisition Lock-In
Acquisition lock-in is the soft outcome of these deals. The acquired team gets absorbed. The roadmap gets bent toward the acquirer's chain. The independent commercial path the protocol could have walked — sell verifier integrations to NetEnt-tier KYC vendors, white-label the app to a bank — gets quietly closed because the acquirer prefers protocol composability with its own L2 over commercial revenue from outside it.
Open-source is the lock-in defense against this. It works imperfectly. It works for forkers who can fund their own continuation. It does not work for end users who pulled the app from the App Store and now find it stops getting updates.
I do not think Aztec acquired zkPassport in bad faith. I think the structural gravity of being inside an L2 ecosystem pulls every acquired primitive toward serving that ecosystem first. The press release said "open-source". The 18-month outcome will be measured by whether a meaningful integration ships at any of the five exchanges in this fact DB, and the prior I would write down today is: no.
Watch three things over the next four quarters. One, whether any of the five CEXs in the grounding — Binance, Bybit, OKX, Bitget, MEXC — names zkPassport in a regulatory filing or compliance disclosure, in either direction. Two, the iOS app's release cadence and whether it survives the next two major iOS versions without being pulled. Three, the commit frequency on the verifier-side smart contracts on chains other than Aztec, because that is the only honest signal that the protocol is being maintained as ecosystem-neutral rather than absorbed.
FAQ
Does the Aztec acquisition mean zkPassport will stop working on non-Aztec chains?
Not immediately. The protocol's verifier circuits are chain-agnostic by construction — anywhere with a compatible proving system can verify the same proofs. What changes over time is engineering attention. Acquired teams ship the integrations that matter to the acquirer first. A year out, the EVM-mainnet or Solana verifier paths may exist but lag the Aztec-native path by a release or two. Watch the commit graph on the non-Aztec adapters, not the headline.
Has any major CEX integrated zk identity attestations at deposit as of mid-2026?
Per the grounding I work from for this desk, none of the five exchanges I track — Binance, Bybit, OKX, Bitget, MEXC — has shipped a zero-knowledge identity option at the deposit step. KYC at those venues runs through traditional documentary verification flows owned by vendors like Jumio and Sumsub. That does not preclude a future integration; it does mean the announcements and the reality are far apart.
Is open-sourcing the iOS app meaningful if Apple controls distribution?
Partially. Open source lets independent forks emerge, which protects against the acquirer pulling the official app. It does not protect end users who installed the App Store binary from losing updates if the official build slows or the certificate is allowed to lapse. CoreNFC entitlements also have to be re-issued per fork, which is a non-trivial Apple-side step. The license is necessary. It is not sufficient.
Why does selective disclosure not solve the CEX KYC problem on its own?
Because the bottleneck is auditability of the compliance trail, not the strength of the identity assertion. Regulators auditing a CEX want to see a documentary chain — what was checked, by which vendor, against which database. A zero-knowledge proof produces a different kind of artifact. Until a major regulator explicitly accepts that artifact in writing, CEX compliance teams stick with the documentary flow they already cleared in prior reviews.
What is the practical difference between proof of personhood and KYC?
Proof of personhood asserts uniqueness — one human, one account — without claiming to know which human. KYC asserts a specific state-recognized identity, name, date of birth, jurisdiction. CEXs need the second to satisfy AML rules. DeFi governance and airdrop sybil resistance can survive on the first. zkPassport can supply both flavors, but the demand sides differ: the CEX side wants the harder thing and is slowest to accept the cryptographic substitute.
Which exchanges in the grounding require KYC at deposit specifically?
Binance is the only one in the fact DB I work from with the KYC-required-at-deposit flag set to true; daily volume $18.5B, licenses including Dubai VARA tier 2 and limited AMF and OAM tier 2. Bybit, Bitget, OKX and MEXC have the flag set to false, which does not mean KYC-free — it means KYC is enforced at withdrawal and at higher transaction tiers rather than at the first deposit. Tier-3 offshore venues like MEXC, under Seychelles FSA, sit at the looser end.