Starknet shipped Shadow Accounts on October 14, 2026, giving DeFi users persistent pseudonymous identities that are cryptographically unlinked from their main wallets. The feature sits atop STRK20, a privacy standard launched in June 2026 that encrypts ERC-20 balances using STARK proofs while emb...
"Compliance-ready does not mean STRK20 itself determines legal compliance or guarantees regulatory approval." — Eli Ben-Sasson, Co-founder and CEO, StarkWare Industries
Starknet shipped Shadow Accounts on October 14, 2026, giving DeFi users persistent pseudonymous identities that are cryptographically unlinked from their main wallets. The feature sits atop STRK20, a privacy standard launched in June 2026 that encrypts ERC-20 balances using STARK proofs while embedding a compliance layer — viewing keys that allow selective disclosure to regulators under lawful request. As of October 11, the unified privacy pool had processed over $2 million across 56 assets.
The timing is not accidental. The U.S. Treasury delisted Tornado Cash from its SDN list on March 21, 2025, following a Fifth Circuit ruling that OFAC could not sanction immutable smart contracts. The EU is set to ban non-compliant privacy tokens from regulated exchanges by 2027 under its anti-money-laundering package. Between the legal opening in the U.S. and the regulatory closing in Europe, a narrow window exists for privacy solutions that can satisfy both sides. Starknet, Sui, and Railgun are each building toward that target. The question is whether $2 million in pool deposits constitutes traction or a proof of concept.
STRK20 launched on March 10, 2026, as a privacy-native token standard for Starknet. The system uses a note-based privacy pool: users deposit public ERC-20 tokens into a unified pool, where balances are stored as encrypted notes. Private transfers consume existing notes and create new ones. Zero-knowledge STARK proofs — generated client-side using Stwo and verified at the sequencer level — confirm ownership, prevent double-spending, and enforce balance conservation.
The architecture differs from Tornado Cash's fixed-denomination mixing model. STRK20 supports multiple token types in a single pool, handles arbitrary amounts, and operates continuously rather than in deposit-withdraw cycles. The underlying cryptographic protocol was described in an academic paper by nine StarkWare researchers (Goldberg, Dotan, Dror, Kaempfer, Levi, Oved, Reder, Veredgorn, Wolfgor) published on the IACR Cryptology ePrint Archive (2026/474) on March 8, 2026.
Three properties define the system:
The system does not encrypt all on-chain data. Account balances, transaction amounts, and contract calls executed from a Shadow Account remain publicly visible. The privacy guarantee is specifically about unlinking — preventing observers from tracing activity back to a user's primary wallet.
Shadow Accounts, launched October 14, 2026, extend STRK20 from a transfer-level privacy tool to a DeFi interaction model. A user funds a Shadow Account from their shielded STRK20 balance, creating a persistent, app-specific address. That address can hold lending positions, provide liquidity, or execute trades — all without a visible on-chain link to the funding wallet.
The mechanism works in three steps:
StarkWare exposed the feature through the Wallet API, with the primary integration call being shadow_account_invoke. DApp developers do not need to rewrite smart contracts or modify liquidation logic. Integration requires Starknet Wallet API v0.10.4 and starknet.js v10.8.0 or later.
The limitation: Shadow Accounts provide identity separation, not transaction privacy. A whale providing $5 million in liquidity through a Shadow Account still shows $5 million on-chain — an observer simply cannot link it to the whale's known wallet.
The central design choice in STRK20 is the viewing key system. When a user joins the privacy pool, they register an encrypted viewing key on-chain. Under a lawful regulatory request — tax audit, AML investigation, sanctions check — a designated auditing entity can decrypt that specific user's key and trace their complete transaction history, forwards and backwards.
Ben-Sasson characterized this as a "risk-based model in which privacy is conditional rather than absolute." Screening occurs at pool entry. Disclosure is available under lawful request, but StarkWare does not itself perform compliance checks or determine legal status.
This architecture creates a clear separation:
The IACR paper describes the auditing entity as a parameter of the system, not a fixed actor. Different jurisdictions could designate different auditing entities. The protocol provides the cryptographic infrastructure; it does not encode jurisdictional compliance rules.
This stands in contrast to Tornado Cash, which had no compliance mechanism and was sanctioned by OFAC in August 2022 for allegedly facilitating $7 billion in laundering. It also differs from Railgun, which requires users to prove they are not sanctioned before interacting with the system — a front-end gate rather than a protocol-level disclosure mechanism.
Adoption data is sparse. As of October 11, 2026, the unified privacy pool had processed $2 million across 56 assets. During Starknet's "Shield rush" campaign, the pool reached 5,000 transactions per day, $500 in daily revenue, and onboarded 100 new users per day. StarkWare did not disclose post-campaign retention metrics or set public adoption targets.
Two DeFi integrations are confirmed:
Starknet's overall DeFi TVL provides context. According to DefiLlama, Starknet TVL was $395 million as of October 28, 2026, though tracked DeFi TVL dropped to $38.65 million by November 2, with $4.15 million in 24-hour DEX volume. The $2 million in privacy pool deposits represents a fraction of network activity.
Starknet is not alone in pursuing compliance-ready privacy. The broader trend is a convergence: general-purpose L1s and L2s are building privacy as a standard feature, not a niche product for dedicated privacy chains.
Sui launched a public beta for confidential transfers on its Devnet in June 2026, concurrent with STRK20's launch. Sui's approach encrypts transaction amounts and balances while keeping sender and receiver addresses visible. This inverts Starknet's model: Sui hides how much, Starknet hides who. Both allow authorized parties to access information for compliance.
Railgun uses a proof-of-innocence system where users demonstrate they are not on sanctions lists before entering the privacy pool. RAIL surged over 117% following the Tornado Cash delisting, reflecting market interest in privacy tokens with compliance features.
Zcash completed its NU7 upgrade (covered in a separate webthreepedia report) with fee-burning and Sprout pool freezing. Zcash provides full transaction privacy but without built-in compliance disclosure mechanisms, placing it in a different regulatory category.
Aztec on Ethereum is building a programmable privacy L2 with selective disclosure, though it remains in development.
The competitive dynamic is not about which system is most private. It is about which system can achieve sufficient privacy for institutional use while meeting minimum compliance thresholds for regulators. This is an economic optimization problem, not a cryptographic one.
The regulatory environment for privacy technology has shifted materially since 2022:
United States: OFAC delisted Tornado Cash on March 21, 2025, following the Fifth Circuit's November 2024 ruling that OFAC exceeded its authority in sanctioning immutable smart contracts. Developer Roman Storm's trial was scheduled for July 14, 2025. The SEC hosted a Crypto Task Force roundtable on "Financial Surveillance and Privacy" on December 15, 2025. The signal: regulators are not opposed to privacy technology per se — they are opposed to privacy technology that cannot accommodate oversight.
European Union: The EU's anti-money-laundering package, including MiCA-related provisions, will require full authorization for exchanges by July 2026 and ban privacy tokens that cannot facilitate compliance from regulated platforms by 2027. DAC8 reporting requirements add a tax transparency layer.
Academic framing: The IACR paper and a separate April 2026 arxiv paper ("A Private Smart Wallet with Probabilistic Compliance") both treat compliance and privacy as simultaneous design constraints rather than opposing forces. This represents a shift from the 2022-era framing where privacy and regulation were positioned as fundamentally incompatible.
The practical implication: any privacy system that wants institutional adoption must provide an auditable compliance path. Systems without one face exchange delisting in the EU and potential enforcement risk in the U.S.
From an economic-value-distribution perspective, STRK20 raises specific questions:
Value capture: Privacy is a feature, not a protocol. STRK20 generates revenue through the Starknet sequencer's transaction fees, not through a separate privacy toll. The $500/day revenue figure from the Shield rush campaign suggests minimal direct economic value at current scale.
Infrastructure cost: ZK proof generation is computationally expensive. Client-side proof generation using Stwo shifts this cost to users but creates UX friction. The economic sustainability of the privacy layer depends on whether users value unlinkability enough to pay the computational overhead.
Institutional demand: The value proposition for institutions is straightforward — use public blockchains for settlement without exposing positions, counterparties, or salary data. Institutional custody providers are reportedly adding privacy layers for this purpose. But institutional demand has not yet materialized in the $2 million pool figure.
Competitive moat: Privacy features are relatively replicable across ZK-enabled chains. Starknet's advantage is being first with a fully deployed compliance-ready system, but Sui and others are months, not years, behind.
STRK20 and Shadow Accounts represent a technically sound answer to a real problem: institutional users need privacy on public chains, and regulators need disclosure mechanisms. The cryptographic architecture, peer-reviewed and deployed, satisfies both constraints on paper.
The gap is adoption. Two million dollars in pool deposits, 56 supported assets, and two confirmed DeFi integrations do not constitute market validation. The Shield rush campaign showed transient interest that has not yet compounded into sustained usage.
The competitive window is finite. Sui's confidential transfers are in public beta. Railgun's proof-of-innocence model is live. The EU's 2027 deadline will force exchanges to make binary decisions about which privacy systems they support. Starknet has a first-mover advantage in compliance-ready privacy, but first-mover advantages in infrastructure are measured in quarters, not years. The data will determine whether STRK20 becomes the standard or a footnote.