Aztec Labs is bringing back zk.money, the privacy-focused, self-custodial Ethereum wallet it first launched in 2021 and shut down in 2023. The name is the same, but nothing from the old product has been carried over, including two deprecated contracts attackers drained for about $2.2 million each in June.
Inside the wallet, account balances and transaction details are not written to a public blockchain ledger. “Onchain transactions between two individuals shouldn’t mean publishing your financial history to the world,” said Joe Andrews, CEO of Aztec Labs, in a statement. For this relaunch, Andrews told Gizmodo, “On the assets: it’s actually stablecoins from the beginning.” The specific stablecoin in the system is DAI, which is intended to operate in a more decentralized manner than the more prominent offerings from Circle (USDC) and Tether (USDT).
A zk.money deposit is basically an ordinary Ethereum transfer to a new address. Enhanced anonymity is enabled after the funds move onto the Aztec Network, the Ethereum layer-two network the team spent the shutdown years building. Users claim a handle such as kyle.zk.money, powered by Ethereum Name Service (ENS), then pay or request payment by sharing a link. Aztec Labs says the wallet contracts have no admin key. The original version of zk.money drew more than 75,000 unique wallets and more than $100 million in volume in its first year, according to the company’s FAQ.
Is This Legal?
Whether a wallet like this is allowed to exist does not appear to be a settled question, at least in the United States.
Samourai Wallet co-founders Keonne Rodriguez and William Lonergan Hill were sentenced last November to five and four years in prison for enabling privacy features in a non-custodial bitcoin wallet. Tornado Cash, an Ethereum-based mixer, had its sanctions lifted in March 2025, but that did not end a criminal case associated with it. Co-founder Roman Storm was convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business, but the money laundering and sanctions charges resulted in a hung jury. Storm has not been sentenced on the count he lost, and a retrial on the hung counts is now set for April 2027. European police seized the CryptoMixer service during this same stretch of crypto privacy crackdowns.
Notably, the CLARITY Act, which is the crypto market-structure bill that included added protections for non-custodial developers, failed a Senate cloture vote this month. Coin Center, a Washington nonprofit that does policy research and advocacy for crypto developers and open-source software, had already warned that last-minute revisions stripped the bill’s explicit protection against criminal liability.
Asked whether building zk.money raised potential legal concerns in light of what’s happened with Samourai Wallet and Tornado Cash, Aztec Labs told Gizmodo it “doesn’t have a specific view” on those two projects. When pressed further about the climate around crypto privacy software, a spokesman for the company pointed to Sections 3 and 7 of the wallet’s Terms of Use, which cover things like the wallet’s non-custodial architecture and anti-money laundering representations.
The Wallet’s Fine Print
“The zk.money system, which is completely non-custodial, also has preventative measures built-in,” Andrews told Gizmodo. “The web wallet frontend screens for sanctioned addresses, and relayers, which are independent participants in the system, screen addresses against a sanctions policy using Predicate (both the wallet a deposit comes from and the address a withdrawal goes to). Beyond screening, there are also launch-phase limits – every deposit, payment, and withdrawal is capped at $2,500, and deposits have a system-wide daily ceiling.”
The wallet’s technical docs put that daily deposit ceiling at $50,000 across the whole system, not per account. Those limits are written into what’s referred to as the portal contract, and raising them would require the creation of a new portal and users choosing to move over to it.
The legal entity named in the wallet’s terms and conditions is Obsidion Labs Limited, not Aztec Labs. Section 3 says the software is non-custodial, that Obsidion is not a party to transfers, and that it does not operate or profit from relayers. Users also have to be 18, and anyone located or domiciled in the United Kingdom or New York is barred, along with the usual sanctioned countries. Of course, these sorts of restrictions on crypto apps are oftentimes trivially circumvented via the use of a VPN.
The design effectively tries to keep the builder off the money-transmission hook while still selling anonymous payments.
Will Stablecoins Get to Have True Privacy?
The level of transparency offered by crypto networks today can definitely be a serious safety hazard for users. Earlier this month, the group behind a Revolut customer-data leak, iamnotavillain, said it picked its targets with the help of blockchain analysis. It then demanded roughly $3 million worth of the privacy-focused altcoin Monero as a ransom, according to OCCRP. So-called “$5 wrench attacks,” where criminals use data leaks to target crypto holders with physical thefts in the real world, have also been on the rise over the past couple of years.
Crypto-native currencies like Monero, Zcash, and Bitcoin have no central issuer who can freeze funds. Although Bitcoin privacy is still a bit of a work-in-progress, a paper published last week sketched Zcash-style private transfers on Bitcoin that work as the network exists today and would not require a fork. Whether the kind of anonymity possible with those systems will be allowed for stablecoins is unclear at this time. Federal regulators have proposed letting stablecoins keep moving peer to peer without the issuer collecting real-world identification on every hop, but that point of view has always assumed the tokens were moving around on public, transparent blockchains.
The prominent stablecoins themselves also already come with backdoors. For example, Tether froze $182 million tied to a Venezuela investigation in January and another $344 million in addresses later tied to Iran. Circle CEO Jeremy Allaire has said Circle freezes only with a court order or direction from law enforcement. After last week’s Bitget hack, Circle and Tether froze about $318,000 in USDC and USDT in one exploiter wallet, a rounding error next to the roughly $387.5 million stolen.
On Monday, Tether said it has supported about $550 million in Iran-linked USDT freezes this year and more than $4.9 billion total in freezes over the life of the token. Senate Democrats on the Permanent Subcommittee on Investigations said in a report Monday that 84% of 846 sanctioned wallets tied to Iran and its proxies transacted exclusively, or nearly exclusively, in USDT. That is the double-edged sword Washington bought when it decided to promote stablecoins in an effort to increase demand for federal debt and the U.S. dollar more generally.
Again, zk.money uses DAI, long sold as the more decentralized digital dollar. However, the “decentralized” stablecoin is not what it once was. Over time, compromises toward centralization have piled up in its reserve assets in an effort to scale to more users. In other words, zk.money is enabling better privacy for a token that still largely answers to financial regulators, and as is the case with much of the crypto space more generally, there is a degree of decentralization theater going on here.
The concentration of activity in stablecoins more generally has created a cultural split in crypto that was put on display last year when Ethereum Foundation researcher Dankrad Feist moved to Tempo, the Stripe-incubated stablecoin chain. From this perspective, zk.money looks like an attempt to merge the two sides of a philosophical split in the crypto world. Whether regulators will allow this proposed merger to happen remains to be seen.
