Private stablecoin payments are now possible through an Ethereum layer-2. What nobody has settled yet is whether the software making them possible is protected infrastructure or an unlicensed financial service. Aztec Labs relaunched zk.money on September 29, 2026, into a legal environment where two developers are serving prison sentences for building privacy features into a non-custodial Bitcoin wallet.
What zk.money Does, and What It Doesn’t Hide
The wallet conceals payment activity inside Aztec Network, but the initial deposit onto Ethereum remains publicly visible.
Aztec Network, a privacy-first Ethereum layer-2, powers the new wallet. The system is designed to keep balances, payment amounts and counterparties off the public Ethereum ledger. Users get human-readable handles, such as kyle.zk.money, instead of standard hexadecimal addresses.
DAI is the wallet’s internal asset. Users can deposit USDC or USDT from Ethereum, and those assets reportedly convert to DAI on entry. Aztec Labs CEO Joe Andrews said, according to Gizmodo: “On the assets: it’s actually stablecoins from the beginning.”
One critical boundary applies throughout: the deposit itself remains visible on Ethereum. The originating address and amount are publicly observable before funds enter the Aztec environment. “Private” and “confidential” accurately describe what happens inside Aztec; “anonymous” is not the right descriptor for the full payment path.
Compliance Controls, Caps and the VPN Caveat
Launch-phase limits and sanctions screening define the wallet’s compliance posture, though some restrictions carry practical enforcement limits.
Launch-phase controls cap individual deposits, payments and withdrawals at $2,500. The system-wide daily deposit ceiling is reportedly $50,000 across all users, not a per-user allowance. Increasing those limits would require a new portal contract and user migration, according to technical documentation cited by Gizmodo.
The wallet’s frontend screens addresses against sanctions lists. Independent relayers are also expected to screen deposit and withdrawal addresses using Predicate, according to Andrews’ statement reported by Gizmodo. The legal entity behind the service is Obsidion Labs Limited, which describes the system in its terms as non-custodial and states that it is not a party to transfers.
Geographic exclusions cover users under 18, those located or domiciled in the United Kingdom or New York, and users in sanctioned jurisdictions. Users can attempt to bypass those restrictions with tools such as virtual private networks. That is a practical limit on enforceability, not evidence that the controls are absent.
The Law Hasn’t Caught Up, and Courts Are Still Deciding
Recent prosecutions and stalled legislation leave the legal status of non-custodial privacy software genuinely unresolved.
U.S. law on non-custodial privacy software remains unsettled. Samourai Wallet co-founders Keonne Rodriguez and William Lonergan Hill were sentenced to five and four years in prison respectively for enabling privacy features in a non-custodial Bitcoin wallet, according to court records and Department of Justice reporting. Developers of both products raised the non-custodial structure as relevant to their defense against money-transmission liability.
The Tornado Cash trajectory is equally instructive. The U.S. Treasury lifted sanctions on Tornado Cash in March 2025, but Roman Storm was subsequently convicted in August 2025 of conspiracy to operate an unlicensed money-transmitting business. The money-laundering and sanctions counts resulted in a hung jury, and a retrial on those counts has been reported as scheduled for April 2027, though that date should be confirmed against the federal docket before being treated as final.
Congress has not resolved the gap. The CLARITY Act, which included proposed protections for non-custodial software developers, was scheduled for a Senate cloture vote in September 2026; its outcome should be verified against the official Senate record. Coin Center warned that revisions to the bill had removed explicit criminal liability protection for developers of non-custodial and open-source software before the vote.
These cases do not establish that zk.money is illegal. They help explain why the wallet’s architecture, relayer relationships and degree of developer control are legally significant.
Aztec selected DAI partly for its positioning as more decentralized than USDC or USDT, according to Gizmodo’s reporting on the relaunch. That positioning carries its own tensions, given that DAI’s collateral arrangements have grown more complex over time. Governments that rely on issuer-level controls to enforce sanctions face a genuine policy conflict when stablecoins move through systems designed to conceal transaction details from public observers. Europe’s approach to restricting access to financial and legal data illustrates how regulators elsewhere are drawing similar boundaries around sensitive information flows.
The wallet had not undergone a full independent security audit at launch. The real test ahead is whether courts, regulators and stablecoin issuers collectively treat privacy-preserving software as protected infrastructure or as a regulated financial service.
