Imagine a currency that doesn't just move value, but silently documents who you are, what you buy, and when you do it. That's not dystopian fiction—it's the technical reality embedded in the architecture of Brazil's Central Bank Digital Currency (CBDC), DREX. Having spent over two decades working with blockchain infrastructure, tokenization, and digital forensics, I've examined the DREX pilot closely, and what I found deserves an honest technical conversation.
The Architecture Behind the Surveillance Capability
DREX runs on a permissioned distributed ledger built on Hyperledger Besu, an Ethereum-compatible platform. Unlike Bitcoin or public Stellar transactions, where pseudonymity provides a privacy buffer, DREX is designed from the ground up with full identity binding. Every wallet connects to a CPF (the Brazilian taxpayer ID), meaning there is no "anonymous address" layer separating the citizen from the ledger entry.
The Central Bank attempted to address privacy through Zero-Knowledge Proofs and a technology called Starlight, which theoretically shields transaction amounts and balances from third parties. However, in the first pilot phase, these protections failed catastrophically. Researchers demonstrated that transaction values and balances could be read directly from the blockchain, exposing exactly how much money moved between parties.
When I analyzed the pilot data patterns in my own work, the conclusion was uncomfortable: the privacy layer is an add-on, not a foundation. In a properly designed system, confidentiality should be architectural—not patched. As André Dias Moreira Prol, I've repeatedly stressed to clients that retrofitting privacy onto a transparent ledger is like installing locks after building a house with glass walls.
The Programmability Problem: Beyond Mere Tracking
The more significant concern isn't just observation—it's control. DREX supports smart contracts through Soroban-like programmable logic, enabling conditional money. This is where tracking evolves into governance over behavior.
Consider concrete scenarios that programmable CBDCs make technically trivial:
- Expiration dates: Currency that must be spent by a deadline or it vanishes, forcing consumption.
- Spending restrictions: Funds usable only for approved categories—say, groceries but not alcohol.
- Geographic fencing: Money that works in one municipality but not another.
- Account freezing: Instant, programmatic suspension without a court order or bank intermediary.
China's digital yuan (e-CNY) already demonstrates expiration-based "use it or lose it" stimulus coupons. These aren't hypotheticals—they're deployed features. The same code primitives exist in DREX's design. The question shifts from "can they track you?" to "can they decide what you're permitted to do with your own money?"
Digital Forensics and the Asymmetry of Power
From a digital forensics standpoint, DREX creates an unprecedented data lake. Every coffee, every rent payment, every donation becomes a permanent, timestamped, identity-linked record. In my forensic investigations, reconstructing a person's financial life usually requires subpoenas, bank cooperation, and weeks of work. A fully deployed DREX collapses that into a single database query.
This is the asymmetry that worries me most. The citizen gains convenience; the state and permitted institutions gain total financial visibility. There is no technical mechanism in the current design that structurally prevents mass surveillance—only policy promises that it won't be abused. As André Dias Moreira Prol, I argue that security professionals should never trust policy where architecture can enforce guarantees instead.
The lesson from Web3 is clear: self-custody and cryptographic privacy are not criminal features—they are civil liberties encoded in math. Projects on Stellar and other networks are proving that regulatory compliance and user privacy can coexist through selective disclosure, where users prove what's legally necessary without exposing their entire financial history.
Conclusion
DREX is a remarkable engineering achievement, but its surveillance and programmability capabilities demand rigorous public scrutiny before nationwide rollout. I encourage every Brazilian professional, developer, and citizen to read the technical specifications directly, demand privacy-by-design guarantees, and join the conversation—because the architecture we accept today will define the financial freedom we keep tomorrow.
Follow more articles by André Dias Moreira Prol on Medium.
