Beyond being non-transferable, what is the most fundamental difference between an SBT and an ordinary NFT?
Beyond the technical feature of non-transferability, the most fundamental difference is what the two actually represent. An ordinary NFT represents ownership, you own a digital asset, and that ownership can be proven and transferred to anyone, with the asset value set by market supply and demand. An SBT represents an attestation, an issuer, which could be an exchange, an institution, or a community, vouches for your specific wallet, certifying that you completed something, passed a particular verification, or hold a certain qualification.
This difference determines that the two serve entirely different purposes: NFTs suit collectibles, art, and game items, scenarios where what you own matters more than who you are; SBTs suit academic credentials, KYC verification, and community reputation, scenarios that must be bound to a specific individual and would lose all meaning the moment they became transferable, if a diploma could be sold to someone else, it would no longer prove that you graduated.
How is Binance BAB Token different from just completing KYC on Binance normally? Why not just keep it in a centralized database?
The difference is portability and composability. If a KYC verification result only lives in Binance own centralized database, that result only means something on the Binance platform itself, if you want to prove to another protocol that requires identity verification that you are a real, verified person, you would have to redo that protocol own separate KYC process from scratch, since your verification history is not directly readable or trustable by other systems.
The BAB token turns that verification result into a public, verifiable on-chain record that does not leak your actual identity documents, other protocols only need to check whether your wallet address holds this token to confirm this is a real person who passed Binance KYC, without Binance needing to open up database access, and without you needing to upload your ID documents again to another platform. This is exactly why the multiple Web3 projects mentioned in the article were willing to integrate BAB verification directly, they borrowed the verification work Binance had already done, instead of building their own identity verification system from scratch.
How exactly do the stamps mentioned in Gitcoin Passport work, and do they stop all sybil attacks?
The stamp system works by accumulating multiple independent signals into a composite trust score, rather than any single verification deciding pass or fail. Users can obtain individual non-transferable stamps through various means, linking social accounts like Twitter or GitHub, demonstrating on-chain activity history, or completing biometric verification, and the system aggregates the types and number of stamps held into a score, where a higher score indicates a greater likelihood that a real, distinct human is behind that wallet.
But the mechanism itself does not claim to be one hundred percent foolproof, an attacker willing to invest enough time could theoretically still forge social account history or build an on-chain activity trail that looks natural enough to obtain some stamps and inflate their score. This is exactly why platforms like Gitcoin continuously update their detection methods and even combine the stamp system with other on-chain analysis approaches, like clustering detection, sybil attacks and defenses are fundamentally an ongoing arms race, not a one-time, permanently effective solution.
If my wallet gets lost, is my SBT really completely unrecoverable? Is there any way to prevent this in advance?
It depends on whether the issuer has implemented a recovery mechanism. The social recovery model mentioned in the article is a proposed direction, not something every SBT actually implements, some issuers, particularly institutional credential systems, may offer an issuer-led recovery process where you can contact them and obtain a new Token by re-verifying your identity; but for a fully decentralized SBT with no central issuer intervention mechanism, if the wallet Private Key is genuinely lost, it is likely a permanent loss with no way to fix it after the fact.
Preventing this in advance follows the same logic as protecting any important asset: use a Hardware Wallet, properly back up your Seed Phrase, avoid using a wallet that holds important SBTs for high-risk daily operations like frequently interacting with unaudited contracts, and before obtaining any SBT, consider how important that token is likely to become to you and whether it is worth raising this specific wallet security standard accordingly. In other words, an SBT directly ties the importance of wallet management to your identity and reputation, meaning the custody standard for that particular wallet should be higher than one you use for ordinary daily transactions.
Most NFTs sitting in your wallet can be sold, a digital image, a game item, a ticket, they are fundamentally transferable assets. A Soulbound Token (SBT) asks the opposite question: what if a token value came precisely from the fact that it can not be transferred? The answer has already been running in the real world for more than three years, from exchange identity verification to stopping the same person from farming an Airdrop with dozens of fake wallets, SBTs have quietly become one of Web3 tools for answering a hard question: is this the same person.
The SBT concept was formally proposed by Ethereum co-founder Vitalik Buterin along with E. Glen Weyl and Puja Ohlhaver in a 2022 paper titled Decentralized Society: Finding Web3 Soul, borrowing its name from role-playing games where equipment becomes untradeable once bound to a character. Technically, an SBT is usually a modified ERC-721 (the NFT standard) or a dedicated new standard, such as EIP-5484 (a consensual soulbound token requiring holder approval to mint) or EIP-5192 (a minimal soulbound NFT standard). The core difference comes down to one thing: once minted to a wallet address, the token can not be transferred, sold, or gifted, it either stays put or gets burned by the issuer. It represents not what you own, but who you are, what you have done, and who vouches for you.
Binance Account Bound (BAB) tokens, launched in October 2022, were the first large-scale SBT deployment: after completing Binance KYC process, users receive a non-transferable BAB token as an on-chain credential, letting other protocols confirm a real verified person without requiring users to repeatedly upload identity documents. More than 14 Web3 projects announced exclusive perks for BAB holders at the time, and platforms like PancakeSwap and Galxe integrated BAB verification directly into their product logic. A larger-scale case is Gitcoin Passport, now rebranded as Human Passport, built to address the persistent sybil-attack problem plaguing Gitcoin quadratic funding mechanism, where a single person creates many fake wallets to inflate matching contributions. Users collect a series of non-transferable stamps by verifying social accounts, on-chain activity history, and biometric checks, aggregated into a trust score that determines whether a wallet likely represents a genuine, distinct human. The system now runs on an Actively Validated Service (AVS) on EigenLayer, secured by more than $1.4 billion in restaked assets, a concrete example of the SBT concept combining with other infrastructure.
The most recent SBT deployment showed up in an unexpected field: online gambling. New gaming regulations that took effect in Curaçao in April 2026 explicitly list blockchain-based identity attestation mechanisms as an acceptable KYC method, provided the issuer holds appropriate certifications and revocation can be executed within 24 hours of a regulatory request. This made Curaçao the first major gambling licensing jurisdiction to formally accommodate SBT verification in its regulatory framework, marking a shift from pure technical experiment to something now formally recognized by concrete regulation.
The biggest structural risk of an SBT comes directly from its core feature: non-transferability. If you lose the Private Key to an ordinary NFT, you lose the asset monetary value; but an SBT is bound to identity and reputation, so if the wallet private key is lost or stolen, you theoretically permanently lose every credential and reputation record accumulated on that wallet, with no way to move them to a new wallet, because non-transferability is the entire point of the token existing. Buterin and his co-authors proposed a social recovery model as a solution in the original paper: users designate a set of guardians, who could be friends, institutions, or other trusted entities, who collectively confirm identity and assist recovery when a wallet is lost, requiring a qualified majority of that group to consent. But this mechanism remains heavily dependent on the reliability of social networks, has not become a unified industry standard, and different projects implement recovery differently, so interoperability problems persist.
If you are considering participating in a product or activity that requires obtaining an SBT credential first, such as a KYC credential or a community reputation stamp, two things are worth confirming beforehand. First, is the wallet this SBT gets bound to one you already have properly backed up with a Seed Phrase and plan to keep using long-term, because if something goes wrong with that wallet, you will likely need to redo the entire verification process rather than simply transferring the credential to a new wallet like an ordinary asset. Second, it is worth understanding whether the SBT issuer offers any recovery mechanism and what triggers it; if there is no recovery path at all, you are effectively pinning a credential you may need long-term to a single point with no backup. SBTs solve the hard problem of proving this is the same person, but they bet everything on whether you can properly safeguard a single wallet over the long run, a tradeoff worth thinking through before you start using one, not something you discover only after something goes wrong.