The Honeypot is Dead: World’s ProveKit Flips the Identity Playbook

The numbers blinked first: 153 million driver’s licenses, scraped from a single dark web service called Nexus, and sold to the highest bidder. That’s not a data “leak.” That’s the entire architecture of identity verification collapsing under its own weight. The charts blinked, but the data burden didn’t. And right on cue, World — the Sam Altman-backed network that famously asked the world to scan its irises — just dropped ProveKit. The tool lets developers verify facts about a user — age, nationality, humanity — without the user ever sending a passport photo or a driver’s license to a server. Proof is generated locally, on the phone itself. Only the cryptographic claim is transmitted. This is a major departure from the old playbook, and it deserves a forensic look beyond the press release. The context here is everything. We are in a bear market for trust. The FTX collapse exposed how fragile custodianship is. The Nexus breach exposed how fragile identity storage is. In both cases, the message is the same: the honeypot model — where you collect, store, and protect sensitive data — is fundamentally broken. You don’t need a better vault. You need a world where the vault doesn’t exist. ProveKit is trying to build exactly that. This isn’t just another dev tool release. It’s a strategic bet that the future of identity verification is zero-knowledge, not zero-trust-in-users. World, which has raised $52.5 million in its latest round with all tokens locked for a year, is positioning itself as the infrastructure layer for this shift, not just an app. The timing is deliberate. The Nexus breach, which the FBI is actively investigating, is the perfect narrative catalyst. But beneath the PR surface lies a complex stack of tradeoffs, dependencies, and a post-quantum promise that deserves scrutiny. Let’s dig into the core of what actually matters: the technical architecture. First, the key design decision: proof generation happens locally. Whether on an iPhone SE 3 or a low-end Android, the device does the heavy lifting. No upload. No server-side verification of raw documents. The verifier only receives a cryptographic confirmation of a specific claim. That’s a paradigm shift. Compare this to traditional KYC providers who store your driver’s license in a database that becomes a target. Compare it also to some Web3 competitors. Polygon ID, for instance, works with delegated generation paths and requires more on-chain orchestration. zkPass is limited to web-based contexts. ProveKit’s local-generation model shrinks the attack surface significantly. In my 2020 DeFi arbitrage work, I learned that execution speed and data minimization are the only edges that matter when the market turns against you. ProveKit applies that same logic to identity. It’s the fastest, leanest way to get a verifiable fact out of a user’s device without exposing the raw source. The performance metrics back this up. On an iPhone SE 3, the proof generation time is 2-3 seconds. On a low-end Android, it’s under 30 seconds. That’s a wide spread, and it’s a signal. The low-end Android number is a bottleneck that limits mass adoption in exactly the regions World’s mission targets: the unbanked, the underserved, populations using budget devices. You can’t ask a user in a developing nation to wait 30 seconds for a proof while they’re standing in a queue. It’s a UX killer. But the iPhone SE 3 number is excellent, proving that the architecture is sound and the v2 roadmap — which targets smaller proof sizes, faster generation, and more efficient on-chain verification — could close the gap. Smart contracts don’t hallucinate; they just execute. And right now, the execution speed on low-end devices is the missing link. The post-quantum angle deserves special attention. The promise is 128-bit post-quantum security, achieved without a trusted setup, using a WHIR commitment scheme. This is part of a newer wave of hash-based, FRI-friendly commitment schemes. The benefit is clear: identity claims might need to be verified decades from now. A government record you prove today shouldn’t be forgeable by a quantum computer in 2040. In that respect, ProveKit is ahead of almost every competitor. Semaphore doesn’t offer this. Polygon ID doesn’t offer this. But “we’re ahead” is not the same as “we’re right.” WHIR is still a relatively new primitive. The cryptographic community hasn’t had a decade to poke holes in it. Least Authority — a respected privacy-focused firm that audited Filecoin — did review the code. But an audit is a point-in-time review, not a proof of immortality. And there’s a risk here that is rarely discussed: a post-quantum claim is only as strong as the entire chain. You can’t just make the commitment scheme quantum-resistant. You need the circuits, the hash functions, the signing algorithms, and the transport layer to all be quantum-resistant. If any one of those still relies on older assumptions, the entire cloak is paper-thin. Another strategic choice I keep returning to is the use of Noir, the zkDSL from Aztec. I’m a fan of good developer experience, and Noir’s Rust-like syntax is approachable. It’s a step up from hand-rolled circuit definitions. But this is also a dependency. A big one. ProveKit’s long-term evolution is tied to Aztec’s roadmap. If Aztec pivots, delays, or loses funding, ProveKit’s advancement slows with it. That’s a single point of failure embedded in the architecture. I’m not saying it’s a bad bet — Aztec has a strong team and the Noir ecosystem is growing — but it’s a risk that needs to be on the table. The ecosystem dependency is real. We traded floor prices for floor stability in the NFT markets; in ZK, we trade proprietary flexibility for ecosystem velocity. ProveKit’s team understands this: they could have built a custom language. They chose Noir to gain instant access to Aztec’s tooling and community. That’s exactly the kind of strategic speed I respect, but it’s also a leash. The competitive landscape makes this more interesting. This identity space is not yet consolidated. There’s no clear leader. The primaryWeb3 players are Polygon ID, zkPass, Semaphore, and now ProveKit. Each has a different tolerance for tradeoffs. Polygon ID is tightly bound to the EVM and leverages the existing Ethereum ecosystem, which helps with liquidity but also means their proof generation is often more complex and less mobile-friendly. zkPass shines in web-based contexts where data is already present in a browser. Semaphore offers a minimal, elegant primitive for anonymous votes and signals, but it’s not designed for rich attribute verification like age or nationality. ProveKit’s advantage is a combination of local generation, a reasonable performance profile on high-end devices, and the post-quantum forward-looking design. That’s a solid moat, but it can be crossed. The market response so far is muted. The WLD token did not wick up on the announcement. You’d expect this in a bear market. Price action is lagging, but that’s not the right metric to watch. Volatility is just velocity without direction. The direction here is developer adoption. The signal to track is how quickly Web2 and Web3 teams actually integrate ProveKit into their production stacks. The code has been public on GitHub since November 2024 under an MIT license. The v1.0.0 tag landed in May. That’s a nine-month window between first code and formal release. That’s not a red flag — it suggests polishing, testing, and hardening — but it also suggests the velocity is measured, not blistering. The strategic question is whether a slower, more careful rollout can win the mindshare race against more plug-and-play alternatives. Speed eats strategy for breakfast in most markets. But in cryptography, a bug discovered after deployment devours strategy, product, and trust all at once. Now for the contrarian angle. This is where the narrative gets uncomfortable. ProveKit’s technical quality is genuinely impressive. But it is hosted under the World umbrella. And World’s core business — collecting iris scans — is a massive privacy honeypot. The optics are paradoxical: the same organization that asks users to agree to biometric storage also creates a tool to avoid storing any data at all. Some call this a pivot. I call it a hedged bet. ProveKit could be World’s long-term survival plan if the iris scanning model gets regulated out of existence. Multiple countries have already pushed back on World ID’s biometric data collection, including Spain, Portugal, and Kenya. The regulatory pressure is mounting. If ProveKit becomes the standard, it doesn’t matter if the iris model tanks. World becomes the identity layer, and the iris scanners can be repurposed as a secondary onboarding option, not the primary path. That’s a hedge, but it also raises a fundamental concern: can you trust the infrastructure if the parent company’s other arm is still a honeypot? Brand toxicity is sticky. The exit liquidity was already gone for the old model; ProveKit might be the new escape route. But investors and developers need to be clear-eyed: the technical and the political within World are not fully separated. The company’s governance structure remains opaque, and this centralization of power is a potential vulnerability. ProveKit might be open-source and MIT-licensed, but the project’s direction is still heavily influenced by a central foundation and a star CEO, Sam Altman. That’s a governance overhang that matters. The second contrarian blind spot is the threat model shift. A world with robust ZK identity verification will not mean zero identity fraud. It means attackers will pivot. They won’t try to hack a central server full of driver’s licenses. Instead, they’ll target the client device itself. They’ll attempt to extract the private key from a compromised phone. They’ll execute social engineering attacks to fool a user into generating a proof on an attacker-controlled device. Or they’ll attack the verification process at the point of consumption, manipulating an app into accepting a forged proof via a logic bug in the verifier. None of these are solved by ProveKit’s local-generation design. ZK is not a silver bullet; it’s a cryptographic arrow. A fast, sharp arrow is worthless if the archer is blind. Identity providers still need to solve the onboarding trust problem: proving that the device’s owner is actually the person they claim to be before the key is issued. ProveKit minimizes the damage if that initial trust is broken — the attacker can’t extract the original document — but they can still abuse the generated proof’s validity period. There’s no perfect solution, but we need to stop pretending the attack surface is just a server we can delete. The third contrarian point is about the token. WLD has no obvious function inside ProveKit’s architecture. It’s not a payment token for verification fees. It’s not a staking token for the cryptographic protocol. It’s not a governance token for deciding which circuits get approved. In the current version, ProveKit is simply a developer tool. It lowers the barrier to entry for building user-controlled identity verification, but the economic flywheel is unclear. If the tool is free, the developers can use it without touching WLD. The value might accrue to World ID itself if more apps demand World ID’s proof format, but that’s a circuitous path to token value. A one-year lock on all tokens from the recent funding round reduces selling pressure, but it doesn’t create demand. If ProveKit is the product and WLD is the asset, the bridge between them is still missing. The market hasn’t priced in ProveKit’s launch because there’s nothing to price. This is a long-term strategic asset, not a liquid catalyst. Looking at the bigger picture, what does this mean for the infrastructure narrative? I believe ProveKit represents a smart reflex: the market’s demand for minimal data collection is winning. Regulatory frameworks like GDPR and eIDAS 2.0 in Europe are pushing exactly in this direction. Data minimization is not just a good principle; it’s becoming a legal requirement. If ProveKit can demonstrate that ZK verification is a legitimate alternative for KYC and age checks without the heavy data handling, it could become the poster child for regulatory-compliant privacy. That’s a powerful position. But the timeline for regulatory acceptance is measured in years, not weeks. The immediate question is whether the developer ecosystem will adopt ProveKit’s primitives at scale. Adoption is the only metric that matters. In the absence of that, the launch is just a sophisticated press release. Let me be specific about what I’d watch for in the next twelve months. First, the v2 roadmap promises significant improvements in proof size, generation time, and memory. If v2 can bring the low-end Android proof time below 10 seconds, then the world’s long-tail devices become viable. That would open the door to billions of potential users. Second, the Coinbase partnership on AI agent toolkits is a sleeper. If ProveKit becomes the standard verifier for AI agents — proving that a given agent is operating on behalf of a verified human — that’s a distinct market with explosive growth potential. The AI-trust narrative is real, and World has a first-mover shot at owning it. Third, keep an eye on independent cryptographic reviews of the WHIR scheme. If the community blesses it, the post-quantum claim gains credibility. If there’s any hint of weakness, the entire frame shifts. There’s also a strategic timing observation. World is shipping ProveKit now, in a bear market, when attention is scarce and capital is defensive. That’s not a mistake. That’s the strategy of a team that understands infrastructure is built in the downcycle so it’s ready for the upcycle. Bitcoin miners learned this. Layer 2s learned this. The ones who built when no one was looking became the rails when everyone came back. ProveKit is a bet that identity is the next middleware battle, and the players who win that battle will not be the ones who make the most noise, but the ones who make the fewest trust assumptions. Panic is a lagging indicator for the prepared. The bear market is precisely the time to be preparing. Now, let’s talk about the elephant in the room: the FTX-style lesson about bling before substance. I’ve seen more than a few projects with beautiful designs that amount to beautiful fiction. ProveKit, at its core, is not fiction. The code is open. The benchmarks are provided. The audit is on record. The tradeoffs are identifiable. This is more than most Web3 projects will ever provide. But the real question is not whether the technology works in a test environment. It’s whether it can survive the messy contact with reality. Can it survive a state actor that wants to break the post-quantum claims? Can it survive a developer who misuses the API and leaks metadata? Can it survive the brand itself, indebted to the iris scanning that triggered regulatory alarms? ProveKit has the architecture of a David, but it carries the baggage of Goliath. That is its ultimate test. The regulatory dimension is a bigger lever than most crypto-native analysts realize. Age verification online is a nightmare for social platforms. The Nexus breach that exposed 153 million driver’s licenses is a gift to ProveKit’s marketing team, but it’s also a gift to regulators who need to justify data minimization. ProveKit’s model is aligned with data minimization. It doesn’t store the document. It doesn’t even see the document. The proof is valid for one specific claim, and you can’t repurpose it. That is a cleaner privacy story than any web2 KYC provider can tell. If a major jurisdiction actually accepts zero-knowledge proofs as a legal method of age or identity verification, World and ProveKit’s compliance story will command an enormous first-mover advantage. But the key word is if. The gap between crypto-native privacy and state-accepted compliance is still vast. Proving that you’re over 18 is one thing. Proving that you’re not a terrorist financier is another. Regulators will want a response to the law-enforcement problem: can an anonymous proof be linked to a real person in a court of law? ProveKit doesn’t offer that answer yet. And until it does, the most valuable use cases will be limited to those where the stakes are low — age gates, simple access controls, and fan communities. Financial compliance at scale will wait. And that is precisely where the contrarian opportunity hides. Most coverage will focus on ProveKit’s potential within crypto-native settings. But I think the real adoption curve will first accelerate in Web2 applications, where the friction of building ZK circuits is already being abstracted away, and the regulatory pressure is far more immediate. A social media platform connecting ProveKit to age-gate its users without holding their birth certificates is the killer proof-of-concept. That is exactly the kind of real user case that a tiny Web3 dev community of 10,000 can’t provide. If ProveKit wants to win the identity game, it has to move the discussion from “what can we do on EVM chains?” to “what can we do for the next billion people who use the internet?” There’s a huge curve in between, and the team must run it. Speed eats strategy for breakfast, but strategy determines the race you’re running. One thing that needs to be said about the trust assumption with zk-proofs: it depends on the validity of the user’s device, the security of their key, and the math of the scheme. ProveKit reduces the trust required in a central server, but it increases the trust required in the user’s device. This is a tradeoff, not a miracle. The phrase “zero knowledge” makes people think that privacy is a binary state. It’s not. It’s a spectrum, and ProveKit sits on a promising but still imperfect point. The moon-shot scenario is that this tool becomes the foundation for user-controlled identity for the entire internet. The realistic scenario is that it becomes a niche tool for privacy-preserving checks, serving thousands of users, not billions. The job of an analyst is to assess both scenarios without losing your bearings. The numbers look right. The technical team is strong. The timing is solid. The token link is unproven. The brand baggage is real. The v2 roadmap is essential. The threat model has shifted but not disappeared. The decision to use Noir is sensible but risky. The post-quantum claim is a differentiator but unverified at scale. The Foxconn factory floor of the digital age is being wired up, and ProveKit just hired a good foreman. But let’s not call the building complete before the foundation has had time to settle. This is a rare case where the technical architecture is ahead of the product narrative. ProveKit is doing the right thing. The question is whether the world is ready, and whether the market is fast enough to reward a project that considers the long game. If I were a Web3 developer looking for an identity solution, I’d be reading through the GitHub code right now. If I were a DeFi protocol looking for a KYC framework that doesn’t sling passports around, I’d be queuing up a test integration. But if I were an investor looking at WLD, I would hesitate until the token’s utility is clear. The chart will not tell you what you need to know. The hash of the next block will not whisper the answer. The truth is being recorded in the elegant, cryptographic whisper of a proof generated on a phone, proving a fact about a person without revealing who they are. It’s a paradox. It’s technology. And it’s a framework for the future that’s worth watching. The only question left is whether the market will do the same. Takeaway? The honeypot is dead. The old way is burning, and we’ve got a front-row seat to the funeral. ProveKit doesn’t just offer a better trap. It offers a world without traps. But the transition will not be smooth. Developers will adopt slowly. Regulators will hesitate. The token will wobble. The tech will improve. And in the end, the winner will be the one who can turn the poetic ideal of self-sovereign identity into the boring, reliable infrastructure that the real world can build on. In this game, speed matters, but precision matters forever. ProveKit has both. The question is whether it has the patience to wait for the world to catch up. Stay sharp. Stay humble. And stay anonymous.