Transfer confirmation · TX-88412Copy for: The market
Private credit note, partial sale
- Date
- 14 Oct 2026, 10:42 ET
- Instrument
- Seller
- Buyer
- Nominal
- Price
No stamps on this copy
A field guide to privacy on Ethereum.
Privacy on Ethereum rests on some of the most advanced mathematics in use today. Using it well starts with something simpler: saying clearly who should see what.
A note before you start
I spent four years at a cryptography research startup, where I oversaw projects that were among the first to generate zero-knowledge proofs directly in a web browser, using WebAssembly. I’ve worked in technology my whole career. Even so, the first time someone explained zero-knowledge proofs to me, I didn’t get it. It took hundreds of hours reading about KZG commitments, talking it through with AI assistants and checking my understanding with cryptographer friends before a different mental model made it click. The good news is that you don’t have to do the same.
When science is this hard to explain, it starts to feel like magic. It doesn’t have to stay that way. Twenty years ago, encrypting an email or proving that a website was really yours sounded like specialist work. Today people ask for a secure connection and look for the padlock. Nobody needs to understand the cryptography underneath.
Privacy on Ethereum should get there too. An asset manager shouldn’t have to master ZK, FHE, MPC or TEE. What matters is being able to state your requirements in your own language, and to know what the technology can deliver. This primer offers one shared way to do that, so we all work from the same picture.
Redwan Meslem, Executive Director, Enterprise Ethereum Alliance
See the ideas in actionZooko Wilcox, founder of Zcash: What are zero-knowledge proofs? And why do they matter beyond crypto?
01
Know what you’re hiding.
“Private” can mean three different things. Each one is a separate choice.
BuyerHalden Pension
Nominal
Price
Date14 Oct
What was agreed
Amounts, prices, terms, and the logic behind them. The parties are known; the details aren’t.
Buyer
Seller
Nominal4,000,000
Date14 Oct
Who was involved
The identities behind a transaction, and whether two transactions link to the same party.
BuyerHalden Pension
Nominal4,000,000
Date
Happened?
Whether it happened
The date and the fact of a trade can tip off a market on their own.
Takeaway
Institutions usually need confidentiality, with known counterparties. Anonymity is what worries compliance teams.
02
Everyone gets a different copy.
One transfer of a private credit note, and the copy each party receives. Pick a party.
Transfer confirmation · TX-88412Copy for: Bank
Private credit note, partial sale
- Date
- 14 Oct 2026, 10:42 ET
- Instrument
- CN-2031 · 6.25% senior · due 2031
- Seller
- Buyer
- Nominal
- Price
Buyer on approved listNot sanctioned
Each party receives its own copy of this record.
Transfer agent
Bank
Approves the transfer by checking the stamps. It never learns who traded or for how much.
Aa
ReadsDate, Instrument
Confirms, without the detailsBuyer on approved list, Not sanctioned
Can’t seeSeller, Buyer, Nominal, Price
Takeaway
Compliance doesn’t need everything in the clear. The bank and the regulator work from stamps, and the regulator holds a sealed envelope.
The question is the same in every use case: what goes behind a black bar, and for whom.
Private payments
The transaction details between the parties, and payment patternsPrivate stablecoins
Amounts, counterparties, and workflow details, from non-participantsPrivate bonds
Volumes, prices, and positions. Issuer and investor names stay publicPrivate repo
Counterparties and amountsPrivate FX
Trading intent, positions, and executionPrivate identity
Who you are. You prove a claim without revealing your identityCases from the EthSystems use-case library, where each one lists what’s hidden, what’s public, and what regulators can access.
03
See how the copies are made.
The copies can look the same under every technology. What changes is behind the page: who else ends up reading the full record, beyond the parties entitled to it.
Access controls
The original sits in a records room. A clerk reads it and makes each person’s copy by hand, with a black marker.
Also reads the full record
Operator
The clerk is usually the operator.- You trust
- The clerk, and the lock on the records room.
- Where it breaks
- The clerk leaks or alters the original, and nobody outside can tell.
- Opens the seal
- The clerk pulls the original from the files.
Private groups
A small group of members each keep the full original in their own binder. Everyone outside gets a receipt with a fingerprint of the page.
Also reads the full record
Bank
And every other member of the group.- You trust
- Each member, individually.
- Where it breaks
- Any one member photocopies their binder.
- Opens the seal
- A member, or an auditor inside the group, hands over their copy.
Zero-knowledge proofs (ZK)
The original never leaves its owner’s desk. A machine reads it and prints a stamp: “this meets the rules.” Anyone can check the stamp. No bars were drawn, because nothing was shown.
Also reads the full record
Nobody else
As long as proofs are made on the owners’ side, not by an outside service.- You trust
- That the machine’s rulebook is written correctly. It needs an independent audit.
- Where it breaks
- A mistake in the rulebook lets the machine stamp a page that doesn’t meet the rules.
- Opens the seal
- Whoever holds a viewing key: the owner, or a party named in advance.
Fully homomorphic encryption (FHE)
Imagine numbers in invisible ink that clerks can still update, for example subtracting a payment, without ever seeing them. Only a special lamp makes the ink visible, and a panel of trustees controls the lamp.
Also reads the full record
Nobody else
Unless enough key holders cooperate to decrypt.- You trust
- That the trustees won’t switch on the lamp together without permission.
- Where it breaks
- Enough trustees collude. Or a clerk’s arithmetic is wrong, and nobody sees it unless the work is checked.
- Opens the seal
- The trustees shine the lamp on specific lines, for an authorized viewer.
Multi-party computation (MPC)
The original is split across clear sheets, one per trustee. Each sheet alone looks like static. Stack enough of them and the text appears. Trustees can also act together, for example to sign, without stacking.
Also reads the full record
Nobody else
Unless enough share holders collude.- You trust
- That not enough trustees meet to stack their sheets.
- Where it breaks
- Enough trustees collude. Or too few show up, and nothing can be done.
- Opens the seal
- The agreed number of trustees stack their sheets, under supervision.
Trusted execution environment (TEE)
The original goes into a windowless room inside someone else’s building. A machine inside reads it and passes copies and stamps out through a slot. A manufacturer’s seal certifies which machine is inside.
Also reads the full record
Nobody else
As long as the hardware holds.- You trust
- The walls, and the company that built the room.
- Where it breaks
- A hardware flaw lets someone peek. Or the machine is faulty and its copies still carry the seal. The owner can lock the door.
- Opens the seal
- The room releases a copy under its own rules.
Real products often combine these. An FHE network may split its decryption key using MPC; a private chain may add zero-knowledge proofs to access controls.
Takeaway
Go deeperAsk every provider who else reads the full record. Then check the answer against the copies you decided on.
State of Privacy on Ethereum for Enterprise
The EEA Privacy Working Group report on these technologies.
Related EEA article: EY, Consensys and Fellow EEA Members Map Enterprise Privacy on Ethereum
04
Take three questions to any provider.
What does each party’s copy show?
For every party: text, black bar, stamp, or sealed envelope.
Who else reads the full record?
An operator, other group members, or nobody. That is who you trust.
Who can open the sealed envelope?
Who authorizes it, how it’s scoped, and whether every opening is logged.
Takeaway
Then ask for an integration story where all three answers match yours. A product claim alone doesn’t show fit.
05
Privacy is moving into Ethereum itself.
Ethereum’s developers are building privacy closer to the base layer.
EIP-8182: Private ETH and ERC-20 transfers
A shielded pool built into Ethereum. In review; not included in the Hegotá upgrade.
Ethereum Foundation privacy roadmap
Private writes, reads, and proving, end to end.
EthSystems use cases
How institutions apply privacy, case by case.
EIP Matrix
Which Ethereum proposals matter for institutions.
Status as of October 2026: EIP-8182 is listed as declined for inclusion in the Hegotá upgrade meta EIP. Proposals change as they move through review; check the source before relying on a date.
EEA Ethereum Intelligence
Turn this into a decision for your institution.
Briefings, workshops, and forums that help institutions track what’s changing on Ethereum, privacy included, and what it means for them.
Key terms
- Confidentiality
- Keeping the details of a transaction, such as amounts, prices and terms, from anyone who is not party to it. The parties themselves can be known.
- Anonymity
- Keeping the identities behind a transaction hidden, including whether two transactions involve the same party.
- Selective disclosure
- Showing a party only the fact it needs, such as “not sanctioned”, without the rest of the record. On this page, a stamp.
- Viewing key
- A key that lets a named party, such as an auditor or supervisor, read a private record later. On this page, the sealed envelope.
- Zero-knowledge proof (ZK)
- A proof that a statement about private data is true, such as “this transfer meets the rules”, that anyone can check without seeing the data.
- Fully homomorphic encryption (FHE)
- Encryption that lets a system compute on data, such as subtracting a payment from a balance, without decrypting it. Key holders control decryption.
- Multi-party computation (MPC)
- A method that splits data or a key across several parties, so no single party holds it, while they can still compute or sign together.
- Trusted execution environment (TEE)
- An isolated area of a processor that runs code on private data and attests to what ran. Its protection depends on the hardware and its manufacturer.
- Shielded pool
- A contract that holds assets for many users and records transfers between them privately. The more users and value share a pool, the stronger its privacy.
Questions
Does blockchain privacy conflict with AML rules?
It does not have to. Confidentiality hides transaction details from the market, not from the parties that must check them. In the example above, the buyer’s compliance team reads its own customer’s activity, and the bank and regulator confirm sanctions and eligibility through stamps. Anonymity, where the parties themselves are hidden, is what raises AML concerns. Whether a specific system meets a given regime depends on its design and the rules that apply.
Can regulators see private transactions?
That depends on the system. In the example above, the regulator sees today that the rules were met and can open the full record later, with authority, through a viewing key or an equivalent mechanism. Ask each provider who can open that record, how access is authorized and scoped, and whether every opening is logged.
How do ZK, FHE, MPC and TEE differ?
They differ in who else can read the full record and what you trust. With zero-knowledge proofs, data stays with its owner and only a proof is shared; you trust that the rules being proved are written correctly. With FHE, a system computes on encrypted data; you trust that key holders won’t decrypt together without permission. With MPC, data or keys are split across parties; you trust that not enough of them collude. With a TEE, data is processed inside protected hardware; you trust the hardware and its manufacturer. Products often combine them.
What is EIP-8182?
EIP-8182 proposes private ETH and ERC-20 transfers on Ethereum through a shielded-pool system contract. According to the proposal, it adds no new precompile, opcode or transaction type beyond installing that contract at a network upgrade. As of October 2026 it is in review, and the Hegotá upgrade meta EIP lists it as declined for inclusion in that upgrade. It is a proposal, not a deployed feature.
A primer from the Enterprise Ethereum Alliance. Parties, copies, and names in the example are illustrative. The metaphors simplify: each technology’s real guarantees depend on its design and configuration. This page is not legal advice.