What Worldcoin actually is, and why it needs your eyeball
Worldcoin is a crypto project built around a single unusual idea: prove, with cryptographic certainty, that a wallet belongs to one real human who has never signed up before. The project was co-founded in 2019 by Sam Altman, the CEO of OpenAI, along with Alex Blania and Max Novendstern, under a company called Tools for Humanity. The pitch is that as AI gets better at pretending to be humans online, the internet will need a way to tell bots from people. That mechanism is called proof of personhood, and Worldcoin wants to be the largest deployment of it in the world.
To get that proof, you visit a Worldcoin operator, who scans your iris with a device shaped like a chrome bowling ball called the Orb. The scan is supposed to verify that you are a unique human and have not enrolled before. In return, you receive a World ID, a non-transferable on-chain credential, and historically a free allocation of the WLD token. As of late 2024, Worldcoin said more than 13 million people had verified across roughly 160 countries, though active monthly users are a much smaller subset.
The reason the iris matters at all is that it is one of the few biometrics that is both extremely hard to fake and extremely hard to revoke. A password can be changed. A fingerprint cannot, but it can be lifted off a glass. An iris, in theory, is unique enough across the entire human population that no two people should produce the same scan. That uniqueness is what makes it useful for one-per-person claims, and also what makes regulators nervous, because if that data ever leaks, you cannot issue yourself a new pair of eyes.
How the Orb generates and stores an iris hash
When you stand in front of the Orb, the device uses infrared cameras and a neural network to capture your iris pattern. The image is processed locally on the Orb itself. According to Tools for Humanity, the Orb then runs the iris image through a one-way function, a mathematical process that turns the image into a short string of numbers called an iris hash or iris code. Once the code is generated, the company says the original iris image is deleted from the device, leaving only the numeric hash.
That hash is the part that is interesting and the part that is often misunderstood. A one-way function is designed so that you cannot reverse it: given the hash, you cannot reconstruct the original iris image. So in a best-case scenario, even if the database of hashes leaked, attackers would not have a photograph of your eye. Tools for Humanity also states it uses a cryptographic technique called multi-party computation, or MPC, which splits the hash into fragments held by different parties, so no single server ever holds a complete, usable copy of your iris code.
The real-world caveat is that this is a private system run by a private company, and the public has to take most of it on faith. The Orb firmware is partly open source, which lets researchers audit the on-device processing, but the back-end storage and the operational security of Tools for Humanity's servers are not independently auditable in the same way. So the privacy claim is not that the system is impossible to breach, it is that the architecture is designed to make breaches far less catastrophic than, say, a leaked photo database would be.
World ID lives on-chain, but the iris stays off-chain
This split is the single most important thing to understand about Worldcoin's privacy model, because regulators keep treating the two as separate objects. The World ID itself is an on-chain credential. It is a kind of zero-knowledge proof, which is a cryptographic receipt that says 'I am a unique human verified by the Orb at some point in the past' without revealing which human you are. Apps that integrate World ID can ask a user to prove they are human and unique, and verify that proof on a blockchain, without ever learning the user's wallet address or any personal identifier.
The iris biometric, by contrast, is not stored on any public blockchain. Tools for Humanity says the iris hash is stored in encrypted form, with fragments distributed across the company and its partners. The point of the architecture is to keep the two things decoupled: even if someone de-anonymized your wallet and traced your on-chain activity, they should not be able to walk that back to a specific iris scan, and even if they stole the iris database, they should not be able to walk that back to a specific wallet.
That separation is also why a World ID is non-transferable. You cannot sell it, lend it, or hand it to a second account, because the proof is tied to a verification event, not to a wallet key. It is also why the system is hard to scale abuse. A user can rotate wallets, but they cannot rotate irises, which is precisely the property that gives the system its value and the property that makes biometric-data regulators reach for their red pens.
Where regulators have pushed back
Worldcoin has drawn more regulatory attention than almost any other crypto project of its size, and a meaningful share of that attention is not about the token. It is about whether scanning people's irises in exchange for money qualifies as informed consent, especially when the people being scanned often live in lower-income countries and may not fully understand what biometric data is or what it is worth.
Kenya was the most dramatic case. In August 2024, the Kenyan government suspended Worldcoin's local operations, and police raided the home of a local Worldcoin operator. Multiple government agencies, including the Directorate of Criminal Investigations, opened probes into data protection, financial activity, and whether users were adequately informed. Kenyan officials cited the country's Data Protection Act and questioned whether collecting iris scans from thousands of people in a single weekend at promotional events met the legal standard for consent. Worldcoin later paused in-person verifications in Kenya and the broader East African region, and a court case has dragged on since.
Germany, where Tools for Humanity is headquartered through its European entity, has been a recurring pressure point. The Bavarian State Office for Data Protection Supervision, which oversees the company under GDPR, has been investigating Worldcoin since 2023 over concerns about how the iris hashes are processed, stored, and transferred outside the European Union. In 2024 the office stated publicly that it had found deficiencies and was evaluating further steps, which could include fines or operational restrictions. Hong Kong's Office of the Privacy Commissioner for Personal Data launched a similar probe in 2024 and concluded that Worldcoin's operations in the city raised 'significant risks' around data privacy, though it stopped short of an outright ban.
Spain, Portugal, South Korea, and Argentina have also opened investigations or issued temporary suspensions. The pattern across all of these actions is similar: regulators are not necessarily denying that the privacy architecture is clever. They are asking whether the consent process is meaningful, whether users in promotional settings truly understand what they are trading, and whether the cross-border data flows comply with local law. This is a normal regulatory posture for biometric systems, but it is unusually active for a crypto project, and it is one of the main reasons a beginner should think twice before signing up.
The WLD token, airdrop economics, and unlock schedule
Privacy and personhood are the front-story of Worldcoin, but the token is the reason most people first hear about it. WLD launched in July 2023 and was distributed as a free airdrop to anyone who had verified their iris at the Orb before launch. That airdrop was unusual in size: depending on when you signed up and your country, early users received allocations that were worth real money at peak prices in early 2024, when WLD traded above $10.
As of late 2024, WLD trades well below those highs, and the tokenomics explain a lot of that pressure. The total supply is capped at 10 billion WLD, but the circulating supply at launch was a small fraction of that. The remainder unlocks on a schedule that runs for years, with the heaviest unlocks concentrated in the first four years. The Foundation, team, and early backers received the largest share of the allocation, and they are subject to lockups that have been gradually expiring. Tools for Humanity has published a real-time dashboard of the unlock schedule, and the takeaway is that selling pressure from insider unlocks has been a consistent feature of the WLD chart.
From a beginner's perspective, the practical effect is that WLD is not just a governance or utility token in any deep sense. It is a free token given to verifiers, paid by a company that is also the largest holder, on a network where new verifiers keep joining. That does not make WLD a scam, but it does mean the price depends heavily on demand for the token relative to the steady flow of new supply. Anyone signing up today is signing up to receive a token whose future price is genuinely uncertain and which has historically been extremely volatile.
What proof of personhood does and does not solve
It is worth separating the pitch from the engineering, because the pitch often overstates what the technology actually delivers. Proof of personhood, as implemented by Worldcoin's World ID, answers exactly one question: is this wallet controlled by a unique human who has not verified before? It does not answer whether that human is honest, whether they are a known scammer, whether they are over 18, or whether they have a good reputation. It is a uniqueness proof, not a reputation proof.
That distinction matters for the use cases Worldcoin pitches. The system genuinely does solve a real problem: stopping one person from running thousands of fake accounts on a social network, or stopping a single attacker from claiming a thousand airdrops. For those problems, World ID is one of the more elegant solutions on the market. The Orb is harder to spoof than a CAPTCHA, and a biometric cannot be phished the way a phone number can.
What it does not solve is anything that requires trust, history, or accountability. A scammer can verify once, just like an honest user can, and then use that single World ID to do as much damage as one person can do. World ID also does not, by itself, prevent Sybil attacks on token airdrops: it makes them more expensive and slower, but a determined attacker can run a hundred Orbs, or pay a hundred real people in lower-income regions to verify, and still manufacture a hundred fake humans. This is the same problem crypto airdrops have always faced, and biometric verification raises the cost of cheating but does not eliminate it.
Risks worth weighing before you scan
Putting everything together, a beginner considering Worldcoin should weigh at least four distinct risks. The first is the regulatory risk. Tools for Humanity is currently operating under active investigation in multiple jurisdictions, and the legal status of the Orb in your country can change quickly. Kenya, for example, has effectively paused operations for more than a year. If you live in a country where regulators have not weighed in, that is not the same as approval; it is simply that they have not looked yet.
The second is the operational security risk. Even if the privacy-by-design claims are accurate, they are claims, not guarantees. A company that holds biometric data on millions of people is a high-value target for state-sponsored hackers, and a future bug, a future leadership change, or a future acquisition could weaken the protections in place. You are not just trusting the code, you are trusting that Tools for Humanity will exist and behave as advertised for the rest of your life.
The third is the consent and asymmetry risk. Worldcoin's sign-up events are often run in countries where users may be drawn by the promise of free money and may not fully understand what an iris hash is or how biometric data can be misused. If you are an early signer in a promotional setting, ask yourself whether the operator fully explained the trade-off, and whether you would still sign up if no token were offered. If the answer to the second question is no, that is information worth keeping.
The fourth is the token risk. WLD is a volatile asset, and the unlock schedule means selling pressure is structural for years. The free airdrop is a real benefit, but the value of that benefit at the moment you receive it is rarely the value it will have a year later. Treat any WLD you receive as a small speculative position, not as a meaningful income source, and never let the lure of free tokens push you into a privacy decision you would not otherwise make.
How to follow Worldcoin and WLD the smart way
Worldcoin sits at the intersection of AI, identity, and crypto, which is exactly the kind of story that generates loud takes on both sides. The project is genuinely interesting from a technical standpoint, and the regulatory pushback is genuinely serious. Tracking the difference between those two things, by hand, is hard. Zippfeed surfaces Worldcoin and WLD headlines with sentiment scoring (bullish, neutral, or bearish) and an importance rating, so you can separate real regulatory news from hype cycles and make sense of when the story is moving on the technology versus the token.
CryptoSlate
