With the rise of decentralized finance, fiat-to-cryptocurrency exchange platforms have become popular entry points into the cryptocurrency ecosystem. However, these platforms frequently fail to ensure adequate privacy protection, as evidenced by real-world breaches that exposed personally identifiable information (PII) and crypto addresses. Such leaks enable adversaries to link real-world identities to cryptocurrency transactions, undermining the presumed anonymity of cryptocurrency use. We propose FC-GUARD, a privacy-preserving exchange system designed to preserve user anonymity without compromising regulatory compliance in the exchange of fiat currency for cryptocurrencies. Leveraging verifiable credentials and zero-knowledge proof techniques, FC-GUARD enables fiat-to-cryptocurrency exchanges without revealing users' PII or fiat account details. This breaks the linkage between users' real-world identities and their cryptocurrency addresses, thereby upholding anonymity, a fundamental expectation in the cryptocurrency ecosystem. In addition, FC-GUARD complies with key regulations over cryptocurrency usage, such as know-your-customer requirements and auditability for tax reporting obligations by integrating a lawful de-anonymization mechanism that allows the auditing authority to identify misbehaving users. This ensures regulatory compliance while defaulting to privacy protection. We implement our system on both desktop and mobile platforms, and our evaluation shows its feasibility for practical deployment.

翻译：随着去中心化金融的兴起，法币-加密货币兑换平台已成为进入加密货币生态系统的重要入口。然而，这些平台往往未能确保充分的隐私保护，现实世界中的数据泄露事件（暴露了个人身份信息与加密货币地址）便证明了这一点。此类泄露使攻击者能够将现实世界身份与加密货币交易关联起来，从而破坏了加密货币使用所预设的匿名性。本文提出FC-GUARD，一种隐私保护的兑换系统，旨在保障用户匿名性的同时，不损害法币兑换加密货币过程中的监管合规性。通过利用可验证凭证与零知识证明技术，FC-GUARD实现了法币-加密货币的兑换，而无需披露用户的个人身份信息或法币账户详情。这切断了用户现实世界身份与其加密货币地址之间的关联，从而维护了匿名性——这是加密货币生态系统中的基本预期。此外，FC-GUARD通过集成合法的去匿名化机制，允许审计机构识别行为不当的用户，从而遵守了加密货币使用方面的关键监管要求，例如了解客户规定和税务申报义务的可审计性。这确保了在默认保护隐私的同时满足监管合规。我们在桌面和移动平台上实现了该系统，评估结果表明其在实际部署中具有可行性。