Building a Web3 Identity Solution
TL;DR:  The European Blockchain Sandbox has concluded its second cohort, featuring IOTA Foundation’s Tokenized Know Your Customer Solution with IDnow, walt.id, and Bl...

<div><div>
<h2><strong>Building a Web3 Identity Solution  </strong></h2>
<p><strong>TL;DR:</strong><br/> <br/> The European Blockchain Sandbox has concluded its second cohort, featuring IOTA Foundation’s Tokenized Know Your Customer Solution with IDnow, walt.id, and Bloom Wallet. The Sandbox provided key lessons on compliant and privacy-preserving identity verification in Web3, including the use of off-chain verification, soulbound tokens, and GDPR-aligned wallet and node practices.</p>
<adv/><p>We’ve completed our participation in the <strong>European Blockchain Sandbox</strong>, a three-year initiative by the European Commission that gives innovative distributed ledger projects the chance to test their solutions with regulators across Europe. Each year, 20 projects are selected to join, and the IOTA Foundation was part of the second cohort, which ran from June 2024 to March 2025.</p>
<adv/><p>Our contribution focused on the <strong>Tokenized Know Your Customer (KYC) Solution</strong>, developed together with <strong>IDnow</strong><strong>, </strong><strong>walt.id</strong><strong>, </strong>and<strong>Bloom Wallet</strong>. This proof-of-concept solution lets users verify their identity off-chain and receive a tokenized proof in their wallet. This allows dApps, exchanges, and other services to confirm eligibility requirements (such as age verification) without exposing sensitive data on-chain.</p>
<div><iframe/></div>
<p>The close of the sandbox is marked by the European Commission’s <strong>Best Practices Report</strong> for the second cohort. The report shares <strong>recommendations and best practices </strong>from the program, offering <strong>valuable guidance for anyone developing DLT solutions and navigating their regulatory implications</strong>.</p>
<h3>Key Sandbox Takeaways: Sharing Customer Data</h3>
<p>A key focus in the Sandbox was how <strong>Anti-Money Laundering (AML) and KYC</strong> rules apply in practice. Regulators emphasized that crypto-asset exchanges and other service providers have a legal obligation to know their users’ identities. This is why our Tokenized KYC Solution enables the entity responsible for carrying out a KYC check to obtain access to verified personal data from the identity verification provider (in our case, IDnow). Similarly, authorities like the police can request personal data linked to a specific non-transferable (soulbound) token. </p>
<p>To make <strong>customer onboarding </strong>easier, companies can sometimes reuse KYC data that another entity has already collected. But the rules for doing this vary across Europe. In some countries, data can only be shared among the same category of entities, while broader sharing requires special approval from national authorities. Fortunately, the upcoming <strong>Anti-Money Laundering Regulation</strong> (AMLR) is expected to harmonize these rules regarding the use of customer information collected by other entities. </p>
<h3>Key Sandbox Takeaways: Soulbound Tokens</h3>
<p>The Report also highlighted key learnings on <strong>self-hosted wallets, KYC, and how data is classified on public permissionless DLTs</strong> like IOTA. In our Tokenized KYC Solution, only soulbound tokens are recorded on-chain. These tokens don’t contain personal data themselves but prove that the KYC process was completed, with the underlying KYC data stored securely off-chain. The Sandbox noted that such tokens may still be treated as pseudonymized personal data, meaning the GDPR applies. Because this classification may evolve with new case law and guidelines, it requires ongoing review. To minimize data protection risks, our solution follows a data protection by design approach by limiting the amount and type of data shared on-chain. This follows the principle of data protection by design.</p>
<h3>Key Sandbox Takeaways: Wallet Providers and Node Operators</h3>
<p>Another important topic in the Sandbox was howwallet providers and node operators are classified under the GDPR. </p>
<ul>
<li>The report concludes that <strong>self-hosted wallet providers</strong> <strong>are not considered data controllers or processors</strong> if the wallet runs solely on the user’s device without relying on an external backend. In our Tokenized KYC Solution, verified identity data stays off-chain with IDnow, while the user’s self-hosted wallet only holds a soulbound KYC attestation. This design aligns with the GDPR guidance: responsibility for personal data rests with the entities that actually access or use it – for example, IDnow for verification and off-chain data storage and, where applicable, an integrating service like a dApp or exchange when it lawfully requests or uses the data.</li>
<li>The GDPR classification of <strong>node operators</strong> needs careful nuance. As we recently commented on the European Data Protection Board’s <strong>European Data Protection Board’s guidelines</strong> for personal data in blockchains, nodes perform only technical functions; they neither determine nor control the purposes of data processing. Treating them as controllers would misrepresent their role and impose disproportionate obligations. Our Tokenized KYC Solution reinforces this distinction. Verified identity data stays off-chain with IDnow, while the chain records only a non-transferable KYC attestation without personal attributes. Nodes simply relay or validate this pseudonymised attestation and never access the identity dataset. Even if such attestations qualify as personal data, the design minimizes on-chain exposure and ensures accountability rests with the entities that actually process identity information. This provides a workable path to meet AML/KYC requirements while respecting rel="noreferrer"&gt;<strong>Transfer of Funds Regulation</strong> and Anti-Money Laundering Regulation require entities like cryptoasset exchanges to hold data about the user of a self-hosted wallet and to identify the owner of the self-hosted wallet. At the same time, dApps and DeFi operators are increasingly looking for ways to enable compliant identity checks without compromising privacy and security. <strong>There is an increasing need for on-chain identification tools to ensure smooth and compliant interactions in Web3 ecosystems</strong>. 
<p>Our proof-of-concept Tokenized KYC Solution brings together all the necessary steps into one easy-to-use tool: </p>
<ul>
<li>A trusted party witnesses an identification process and tokenizes it as a soulbound token, allowing dApps and other entities to have confidence in the identification process, without revealing the actual Personally Identifiable Information. </li>
<li>The soulbound token can be used for on-chain processes, allowing Web3 native interactions.</li>
<li>The trusted party can reveal the identity information if requested by an authorised party (e.g., law enforcement). </li>
<li>The trusted party can also revoke the token if an invalidation is needed (e.g., watchlist changes).</li>
</ul>
<p>Following the completion of this project, the rebased IOTA Mainnet has launched with a new architecture based on the Move Virtual Machine. To support use cases like the Tokenized KYC Solution, we’ve developed the <strong><u>IOTA Trust Framework</u></strong>, a suite of composable infrastructure components, each developed with privacy, compliance, and usability in mind.</p>
<hr/>
</li>
</ul>

</div></div>

European Blockchain Sandbox: Lessons Learned

構建 Web3 身份解決方案
TL;DR：歐洲區塊鏈沙盒已完成其第二批項目，其中包括IOTA基金會的代幣化“瞭解您的客戶”解決方案（採用 IDnow）、walt.id 和 Bl...

<div><div><h2><strong>構建 Web3 身份解決方案</strong></h2><p><strong>TL;DR：</strong><br/><br/>歐洲區塊鏈沙盒第二期項目已結束，主要內容包括IOTA基金會的代幣化“瞭解你的客戶”解決方案，以及 IDnow、walt.id 和 Bloom 錢包。沙盒項目提供了關於 Web3 中合規且隱私保護的身份驗證的關鍵經驗，包括鏈下驗證、靈魂綁定代幣的使用以及符合 GDPR 標準的錢包和節點實踐。</p><adv/><p>我們已完成對<strong>歐洲區塊鏈沙盒</strong>項目的參與。該項目由歐盟委員會發起，為期三年，旨在為創新型分佈式賬本項目提供與歐洲各地監管機構測試其解決方案的機會。每年，歐盟委員會都會選出20個項目加入， IOTA基金會是第二批項目之一，該項目將於2024年6月至2025年3月期間啟動。</p><adv/><p>我們的貢獻主要集中在與<strong>IDnow</strong> <strong>、</strong> <strong>walt.id</strong><strong>和</strong><strong>Bloom Wallet</strong>共同開發的<strong>代幣化“瞭解你的客戶 (KYC)”解決方案</strong>上。該概念驗證解決方案允許用戶在鏈下驗證身份，並在錢包中收到代幣化證明。這使得 dApp、交易所和其他服務能夠確認資格要求（例如年齡驗證），而無需在鏈上暴露敏感數據。</p><div><iframe/></div><p>歐盟委員會發布的第二批<strong>最佳實踐報告</strong>標誌著沙盒項目的結束。該報告分享了該計劃的<strong>建議和最佳實踐</strong>，<strong>為開發DLT解決方案並應對其監管影響的人員提供了寶貴的指導</strong>。</p><h3>沙盒關鍵要點：共享客戶數據</h3><p>沙盒測試的重點是如何在實踐中應用<strong>反洗錢 (AML) 和 KYC</strong>規則。監管機構強調，加密資產交易所和其他服務提供商有法律義務瞭解其用戶的身份。因此，我們的代幣化 KYC 解決方案使負責執行 KYC 檢查的實體能夠從身份驗證提供商（在我們的案例中是 IDnow）獲取已驗證的個人數據。同樣，警方等機構也可以請求獲取與特定不可轉讓（靈魂綁定）代幣相關的個人數據。</p><p>為了簡化<strong>客戶入職流程</strong>，公司有時可以重複使用其他實體已收集的 KYC 數據。但歐洲各地對此的規則各不相同。在某些國家/地區，數據只能在同一類別的實體之間共享，而更廣泛的共享則需要獲得國家主管部門的特別批准。幸運的是，即將出臺的<strong>《反洗錢條例》</strong> （AMLR）預計將協調這些關於使用其他實體收集的客戶信息的規則。</p><h3>沙盒關鍵要點：靈魂綁定代幣</h3><p>報告還強調了關於<strong>自託管錢包、KYC 以及數據在</strong>IOTA等公共無許可 DLT 上如何分類的關鍵經驗。在我們的代幣化 KYC 解決方案中，只有靈魂綁定代幣才會記錄在鏈上。這些代幣本身不包含個人數據，但證明 KYC 流程已完成，底層 KYC 數據安全地存儲在鏈下。沙盒指出，此類代幣仍可能被視為假名個人數據，這意味著適用 GDPR。由於這種分類可能會隨著新的判例法和準則而演變，因此需要持續審查。為了最大限度地降低數據保護風險，我們的解決方案遵循數據保護設計方法，通過限制鏈上共享的數據量和類型。這遵循了數據保護設計的原則。</p><h3>沙盒關鍵要點：錢包提供商和節點運營商</h3><p>沙盒中的另一個重要主題是錢包提供商和節點運營商如何根據 GDPR 進行分類。</p><ul><li>報告得出結論，如果<strong>自託管錢包提供商</strong>僅在用戶設備上運行且不依賴外部後端，則<strong>其不被視為數據控制者或處理者</strong>。在我們的代幣化KYC解決方案中，已驗證的身份數據保留在IDnow的鏈下，而用戶的自託管錢包僅持有綁定的KYC證明。此設計符合GDPR指南：個人數據的責任由實際訪問或使用數據的實體承擔——例如，用於驗證和鏈下數據存儲的IDnow，以及在適用的情況下，合法請求或使用數據的集成服務（如dApp或交易所）。</li><li> GDPR 對<strong>節點運營商</strong>的分類需要謹慎處理。正如我們最近評論歐洲數據保護委員會<strong>（European Data Protection Board）關於區塊鏈個人數據的指南時所說</strong>，節點僅執行技術功能；它們既不決定也不控制數據處理的目的。將它們視為控制者會歪曲其角色，並強加不成比例的義務。我們的代幣化 KYC 解決方案強化了這種區別。經過驗證的身份數據在 IDnow 中保留在鏈下，而鏈上僅記錄不可轉讓的 KYC 證明，不包含個人屬性。節點只需傳遞或驗證此假名證明，而不會訪問身份數據集。即使此類證明符合個人數據的條件，這種設計也能最大限度地減少鏈上風險，並確保實際處理身份信息的實體承擔責任。這為滿足反洗錢 (AML)/瞭解你的客戶 (KYC) 要求提供了一條可行的途徑，同時又符合《<strong>資金轉移條例</strong>》和《反洗錢條例》的要求。這些條例要求加密資產交易所等實體持有自託管錢包用戶的數據，並識別自託管錢包的所有者。與此同時，dApp 和 DeFi 運營商越來越多地尋求在不損害隱私和安全的情況下實現合規身份檢查的方法。<strong>對鏈上身份識別工具的需求日益增長，以確保 Web3 生態系統中順暢且合規的交互</strong>。<p>我們的概念驗證標記化 KYC 解決方案將所有必要的步驟整合到一個易於使用的工具中：</p><ul><li>受信任方見證識別過程並將其標記為靈魂綁定令牌，從而使 dApp 和其他實體對識別過程充滿信心，而無需洩露實際的個人身份信息。</li><li>靈魂綁定代幣可用於鏈上流程，允許 Web3 原生交互。</li><li>如果授權方（例如執法部門）提出要求，受信任方可以透露身份信息。</li><li>如果需要使令牌無效（例如，監視列表更改），受​​信任方還可以撤銷令牌。</li></ul><p>隨著該項目的完成，基於 Move 虛擬機的全新架構， IOTA主網現已上線。為了支持代幣化 KYC 解決方案等用例，我們開發了<strong><u>IOTA信任框架</u></strong>，這是一套可組合的基礎設施組件，每個組件的開發都充分考慮了隱私、合規性和可用性。</p><hr/></li></ul></div></div>

歐洲區塊鏈沙盒：經驗教訓

1849 年，加州淘金熱，無數懷著暴富夢的人湧向美國西部。
德國移民李維·斯特勞斯原本也想加入淘金大軍，但他敏銳地發現了另一個商機：礦工們的褲子經常破損，急需更耐用的工作服。
於是，他用帆布製作了一批牛仔褲，專門賣給淘金工人，從此誕生了一個名為“李維斯”的服裝帝國，而當年那些真正參與淘金的人，絕大多數卻血本無歸。
2024 年 11 月 20 日，英偉達英偉達又一次交出“逆天”的財報。
Q3 營收...

從英偉達到幣安，賣鏟才是最強商業模式

由於市場對美聯儲在 12 月份下降的預期持續下降，加密貨幣市場繼續經歷劇烈波動，大多數主要資產價格下跌。

比特幣價格跌至 87,000鎂，加密貨幣市場持續暴跌

歷史不會簡單重複，但總是驚人地相似。在知名Youtube播主David Lin本期節目中，見證了互聯網泡沫與2008年金融危機的27年資深交易員Gareth Soloway，將為我們解讀當前市場與歷史頂部的相似之處。他認為，在AI概念的驅動下，市場估值已極度透支未來，一個關鍵的轉折點已經到來，回調10%至15%僅僅只是開始。
Gareth不僅對股票市場發出預警，還對比特幣和黃金的短期走勢持謹慎態度...