The fashionable pitch for decentralized identity is dangerously lazy: put credentials on-chain, let wallets become passports, and watch institutions migrate from paper compliance to programmable trust. That framing is wrong. A blockchain is excellent at ordering commitments, publishing revocation states, and settling disputes; it is terrible at storing personal data that must remain private, contextual, and sometimes legally erasable.
The market context matters because infrastructure costs have changed. With ETH around $1,719 after a 6.06% 24-hour move, investors still price identity as a derivative of chain activity, not as a core protocol primitive. EIP-4844 cut Layer-2 data costs by more than 90% in many periods, and Base, Optimism, Arbitrum, and zkSync now make attestations cheap enough to use at consumer scale. But cheap blockspace does not make public disclosure wise. The winning architecture for self-sovereign credentials on-chain will store proofs, nullifiers, schema registries, and revocation roots on-chain while keeping the credential payload off-chain under user control.
The identity problem crypto keeps misdiagnosing
Crypto does not have a wallet problem; it has an accountability problem. A public key can hold assets, vote in a DAO, claim an airdrop, or borrow from a DeFi market, but it cannot natively prove that the controller is a unique person, a licensed entity, an accredited investor, a sanctions-screened user, or a repeat borrower with a real repayment history. That missing trust layer is why protocols overpay for liquidity mining, DAOs get farmed by Sybil clusters, and institutions still route serious flows through custodians.
Self-sovereign identity, or SSI, is often misunderstood as identity without issuers. That is nonsense. Credentials still need issuers: governments, universities, KYC providers, employers, exchanges, device manufacturers, credit bureaus, and protocols. The sovereignty comes from who controls presentation. A user should be able to prove I am over 18, I passed KYC with a regulated provider, or I have never voted in this epoch without revealing a passport scan, home address, or their entire transaction graph.
The standards stack already exists. W3C Decentralized Identifiers, W3C Verifiable Credentials, JSON-LD and JWT credential formats, EIP-712 typed signatures, and emerging zero-knowledge credential systems provide most of the cryptographic grammar. What is missing is not another DID white paper. It is credible coordination around registries, revocation, wallet UX, and liability when issuers lie or credentials leak.
What actually belongs on-chain
The core architectural rule is simple: identity data should not be on-chain; identity state can be. A university diploma, biometric template, passport number, payroll record, or health credential belongs off-chain, preferably encrypted and stored in a user-controlled wallet, secure enclave, or decentralized storage layer with explicit retention rules. The chain should only see a commitment, an issuer signature verification path, a revocation accumulator, or a zero-knowledge proof output.
Ethereum Attestation Service is a useful reference point because it treats attestations as structured claims rather than permanent biographies. EAS has been deployed across Ethereum, Optimism, Base, Arbitrum, and other EVM networks, with millions of attestations proving the appetite for reusable claims. Coinbase Verifications on Base pushed the same concept toward exchange-grade credentials: a user can receive an attestation that their account or jurisdiction was checked without forcing every application to run a full compliance stack.
The pattern is stronger when paired with zero-knowledge proofs. Polygon ID, built on iden3 and Circom, lets users prove facts about credentials through circuits rather than raw disclosure. Semaphore-style nullifiers allow a user to prove membership in a group and take one action without linking all future actions. Merkle roots and cryptographic accumulators let issuers update revocation lists without posting every revoked credential as an individually readable record.
The decentralized identity endgame is not a universal public profile. It is selective disclosure with verifiable accountability.
Soulbound tokens, popularized after Vitalik Buterin, Puja Ohlhaver, and E. Glen Weyl's 2022 paper on decentralized society, are useful only in narrow cases. Non-transferability helps prevent credential markets, but a visible non-transferable token can still become a surveillance badge. If an employer, exchange, or DAO can infer religion, nationality, medical status, political affiliation, or wealth from a wallet, the system has failed even if it uses elegant Solidity.
The Sybil market is the first real battleground
The most immediate commercial use case is not national identity; it is Sybil resistance. Airdrops, quadratic funding, DAO voting, social networks, and DePIN reward systems all bleed value to industrial wallet farms. Gitcoin Passport has processed millions of passport holders and stamps because grant programs needed a better filter than one wallet, one vote. The same pressure is visible in Layer-2 ecosystems where points campaigns and token incentives attract scripted farming faster than organic communities.
Worldcoin is the most controversial proof point. By mid-2024, Worldcoin reported more than 5 million Orb-verified humans and more than 10 million World App users, demonstrating demand for proof-of-personhood at global scale. Its architecture, based on biometric uniqueness and zero-knowledge proofs, is technically more serious than most critics admit. Its governance and data-collection optics, however, create the exact trust problem decentralized identity is supposed to avoid: users must believe that biometric enrollment, hardware supply chains, and issuer incentives will not be abused.
The contrarian view is that biometric proof-of-personhood may remain a niche primitive, not the default identity layer. Most economic applications do not need to know that a user is biologically unique. They need risk scoring, reputation decay, credential provenance, and accountability under constraints. A lending protocol, for example, cares more about repayment history and legal recourse than iris uniqueness. A DAO cares more about contribution history and delegation integrity than one-human purity.
This is where on-chain credentials become economically powerful. A wallet could prove it has held a Gitcoin Passport score above a threshold for six months, received payroll attestations from a payroll provider, repaid loans through a credit delegation market, and passed sanctions screening through a regulated issuer. None of those facts requires publishing the user's name. Each does require credible issuers, revocation, anti-correlation design, and insurance or penalties for fraudulent attestations.
Why regulation will force privacy, not kill it
Many crypto founders assume regulators hate privacy-preserving identity. The opposite is more likely. The European Union's eIDAS 2.0 framework and the EU Digital Identity Wallet are pushing verifiable credentials into mainstream policy. The problem for blockchains is not that regulators reject cryptographic credentials; it is that regulators will not accept immutable doxxing, weak revocation, or issuerless compliance theater.
GDPR is the hard constraint. Public chains are append-only systems, while European privacy law includes purpose limitation, data minimization, and erasure rights. If a protocol stores passport hashes, biometric commitments, or employment details directly on-chain, it may discover that a hash of personal data can still be personal data when linkable to a person. That legal reality is why on-chain identity must be commitment-based and revocable without exposing underlying attributes.
Institutions will demand auditability. A bank, broker, or payment company using tokenized deposits or real-world asset rails cannot rely on anonymous wallet signatures alone. It needs evidence that a user met policy at the time of transaction, that sanctions checks were current, and that a credential issuer can be subpoenaed or removed if compromised. That favors hybrid trust: decentralized verification, but regulated issuance for regulated activities.
The best systems will separate three roles. Issuers create signed credentials and accept liability. Holders store credentials and generate presentations. Verifiers check proofs, revocation status, issuer trust lists, and policy compliance. Blockchains coordinate registries and timestamp state transitions. This separation is boring compared with cypherpunk slogans, but it is the only model that survives both adversarial markets and courts.
Infrastructure winners will look less like identity apps
The investable layer is not necessarily the consumer wallet with the best DID landing page. It is the plumbing: schema registries, proof marketplaces, credential storage, revocation networks, issuer reputation, wallet-to-wallet presentation protocols, and compliance APIs that can verify zero-knowledge proofs without forcing developers to become cryptographers. The identity stack will monetize through verification volume, issuer tooling, enterprise integration, and risk scoring, not through speculative identity tokens alone.
Layer-2 networks have an advantage because identity requires frequent low-value writes: attestations, revocations, epoch roots, and proof anchors. Posting these on Ethereum mainnet at $5 to $50 per interaction was irrational. Posting them on Base or Optimism for cents changes the design space. ZK rollups add another angle: they can eventually verify credential proofs and batch state updates with stronger privacy guarantees, though proof generation latency and mobile hardware constraints remain real UX bottlenecks.
Interoperability is the underrated risk. A credential that works only inside one wallet, one chain, or one issuer marketplace is just another silo with a token. The industry needs common credential schemas for age, jurisdiction, accredited investor status, education, employment, device integrity, and entity verification. Without schema discipline, verifiers will drown in incompatible claims and default back to Web2 vendors such as LexisNexis, Experian, Trulioo, Sumsub, and Onfido.
- Do not store personal attributes on-chain: store commitments, roots, issuer registries, and revocation state.
- Design for unlinkability: use pairwise DIDs, nullifiers, and selective disclosure to prevent wallet-wide profiling.
- Make revocation first-class: stale credentials are worse than no credentials in lending, compliance, and governance.
- Separate identity from reputation: identity proves attributes; reputation measures behavior over time and should decay.
- Assume issuer failure: build trust lists, slashing, insurance, and migration paths for compromised credential authorities.
The next identity cycle will be pragmatic, not ideological
Decentralized identity will not arrive as a single universal login. It will arrive as hundreds of narrow credentials that reduce fraud, lower compliance cost, and let users prove less rather than more. The first winning use cases will be Sybil-resistant airdrops, private KYC for DeFi front ends, age-gated applications, undercollateralized credit, enterprise wallet permissions, and machine identity for DePIN networks.
The losers will be projects that treat identity as a public NFT collection or a vanity profile. Public identity graphs create honeypots for surveillance, phishing, discrimination, and coercion. The internet already proved that persistent identifiers become monetized by the most aggressive data brokers. Blockchains should not rebuild that failure with better cryptography and worse reversibility.
My base case is that the most valuable on-chain identity systems by 2027 will be nearly invisible to users. A wallet will request a credential, a device will generate a proof, a verifier will check an on-chain root, and an application will unlock a feature without learning unnecessary data. That is not as theatrical as scanning eyeballs or minting soulbound badges, but it is the architecture that scales.
The self-sovereign credential thesis is still correct, but only after stripping away the ideology. Users need control, issuers need accountability, verifiers need policy assurance, and chains need to do what they do best: publish tamper-resistant state. Put identity itself on-chain and the industry builds a permanent surveillance machine. Put verifiable credential state on-chain and crypto finally gets a trust layer worthy of global markets.