Privacy costs are part of the protocol
Privacy in Web3 is not mainly a cryptography problem. Privacy is an ongoing infrastructure funding problem that includes proof generation, relay bandwidth, state scanning, anti-spam defenses, node operation, governance, and incident response. If those functions are not funded, the privacy layer either recentralizes, degrades under load, or survives only as a niche tool for highly technical users.
The market still talks about privacy as a feature. The protocols that last treat privacy as an always-on cost center. Monero’s documentation is unusually explicit here: dynamic block size and fee competition can compress miner revenue, so a perpetual tail emission exists because miners need an incentive to mine or security falls.
That framing matters for tokenomics design. A privacy system can have elegant zero-knowledge proofs and still fail economically if nobody is paid to sequence, prove, relay, filter spam, or maintain the codebase. From a security-budget perspective, the central question is simple: who pays for the hidden work required to keep information hidden?
What Web3 privacy actually means
Web3 privacy is not one thing. It sits across at least three layers: transaction graph privacy, application-state privacy, and network or metadata privacy. Most systems cover one or two of those layers, not all three.
Transaction graph privacy tries to hide sender, recipient, amount, or linkability between deposits and withdrawals. Monero does this by default through ring signatures, stealth addresses, and RingCT, and its docs explicitly distinguish sender privacy, recipient privacy, and amount privacy as separate properties. Monero also stresses that it is not a mixer or mixing service because privacy is integrated into the base transaction flow rather than offered as an opt-in pool.
Application-state privacy is harder. It means users can interact with smart contracts without exposing balances, contract inputs, function calls, or user identity at every step. Aztec’s model is the clearest current expression of that design: private function execution and proof generation happen in the client-side Private Execution Environment, and private inputs do not leave the user’s device.
Network and metadata privacy is different again. End-to-end encryption protects message content, but it does not automatically hide who contacted whom, when, how often, or from which IP address. XMTP focuses on client-side encryption and decentralized message delivery, while Nym’s mixnet is explicitly built to defeat traffic analysis by delaying, reordering, and padding traffic with cover traffic. That distinction is critical for Web3 wallets, social layers, and agent systems that may protect content while still leaking behavioral metadata.
Where current systems actually sit
| System | Primary privacy scope | How the security budget is handled | Constraint that matters most |
|---|---|---|---|
| Monero | Sender, recipient, amount by default; some network-layer protections via Dandelion++ and optional Tor wrapping. | PoW mining plus perpetual 0.6 XMR per 2-minute block tail emission; development relies heavily on community funding through CCS. | Privacy is strong by default, but sender ambiguity remains probabilistic and endpoint OPSEC still matters. |
| Zcash Orchard | Shielded transfers in a dedicated pool using Halo 2; unified addresses improve wallet routing into shielded storage. | Consensus-level mining security plus repeated protocol-level development funding debates and funding streams. NU6.1 activated on November 24, 2025 and the ZIP repository records deployment of ZIP 1016 and ZIP 271. | Anonymity depends on shielded pool usage. Orchard is a separate anonymity set, and moving funds from Orchard to a non-Orchard address reveals transaction value. |
| Ethereum stealth addresses and privacy pools | Recipient privacy via stealth addresses and pool-based unlinkability via private withdrawal systems. | No default L1 privacy budget. Costs are pushed to wallets, relayers, proving systems, and in some cases external compliance providers. ERC-5564 even anticipates tolls or staking to counter announcement spam. | Adoption fragmentation. Privacy is optional, so anonymity sets and operational support can remain thin unless wallets integrate it by default. |
| Aztec | Private smart contract execution with hybrid public/private state. | Explicit sequencer and prover roles. Sequencer participation requires a minimum stake of 200,000 AZTEC, and block rewards are split between sequencers and provers. | Privacy depends on client-side proof generation and still has leak points at the node-query layer unless users run their own nodes. |
| XMTP + Nym | XMTP protects message content and consent flows; Nym targets metadata privacy and unobservability. | XMTP charges developers network fees, initially about $5 per 100,000 messages in Phase 1. Nym uses tokenized staking, rewards, and fee flow, with the whitepaper expecting fees eventually to overtake mixmining rewards. | Metadata privacy is expensive. Cover traffic and mixing improve anonymity but impose latency and bandwidth trade-offs. |
Security budgets decide whether privacy survives contact with reality
Monero is the cleanest example of privacy aligned with a durable security budget. The protocol hides sender, receiver, and amount by default, and it keeps miner incentives alive with a perpetual tail emission after the main emission ended in May 2022. That is inflationary by design, but it is also intellectually honest: long-run privacy and long-run chain security are treated as costs that users and holders must bear.
Zcash takes a different route. Orchard and Halo 2 materially improved the trust model by removing reliance on trusted setup ceremonies, and the protocol design contains potential counterfeiting failures within the Orchard pool through a transparent turnstile. But Zcash also shows that privacy R&D does not pay for itself. The ecosystem has had to repeatedly formalize development funding in protocol governance, first through ZIP 1015 and then again through NU6.1-era funding changes.
Ethereum privacy remains more modular and therefore more fragile. Stealth addresses standardize recipient privacy, but the proposal explicitly recognizes off-chain parsing burdens and anti-spam needs, including tolls or staking for announcement providers. That is a useful reminder that even “just” hiding recipients can create a service layer that needs incentives and abuse resistance.
Private smart contract systems raise the cost curve again. Aztec’s architecture keeps private inputs client-side and pushes proof generation to the user device, which is the right direction for confidentiality. But Aztec’s own docs are candid that node queries can reveal what world state a user is interested in, and that users can mitigate this by running their own node. Privacy, in other words, is not binary. It depends on how much infrastructure the user or the network can afford to operate.
Messaging shows the same pattern for decentralized social networks. XMTP can offer client-side encryption and decentralized message distribution, but network reliability still has a price and the protocol states that apps pay it through usage fees. Nym goes further by trying to hide metadata itself, yet the whitepaper is explicit that privacy depends on mix nodes, rewards, cover traffic, and trade-offs between latency, bandwidth, and anonymity. Real privacy infrastructure is expensive because surveillance is cheap.
Regulation changed the design space, not the demand
The regulatory environment for onchain privacy shifted materially on March 21, 2025, when the U.S. Treasury removed the economic sanctions against Tornado Cash. Treasury did not soften its posture on illicit finance, however. In the same statement, Treasury said it remained deeply concerned about DPRK-linked hacking and would continue monitoring transactions that may benefit malicious cyber actors.
The policy implication is not that privacy won. The implication is that protocol designers now have stronger incentives to separate privacy from indiscriminate commingling. The Privacy Pools literature explicitly frames the problem as enabling withdrawal without linkage while allowing proof-carrying disclosures, and 0xbow’s production framing centers association sets and transaction vetting before deposits enter the privacy set.
That creates a real trade-off. Compliance-oriented privacy systems can expand the addressable market for onchain privacy, especially for institutions and mainstream wallets. But they also introduce governance power over set membership, operational review processes, and new forms of dependency outside the base protocol. From a security-budget lens, that means fewer censorship risks than a fully centralized mixer operator, but more policy surface than a privacy-by-default base asset.
The evidence does not support a simple pro-privacy versus anti-compliance binary. It supports a more practical conclusion: privacy tools that want broad distribution will need selective disclosure, auditable set construction, or other mechanisms that lower external risk without collapsing the privacy guarantee. That is not philosophically pure. It is probably where the market is heading.
What this means for token economy design
Privacy-first token economy design should begin with a blunt inventory of operating burdens. Those burdens usually include prover incentives, sequencer economics, anti-spam costs, note discovery or scanning costs, relay or bandwidth compensation, wallet integration work, governance overhead, and legal resilience. If the token model funds only growth incentives and ignores those lines, the protocol is assuming somebody else will subsidize privacy later.
- Default privacy beats optional privacy on anonymity quality. Monero’s mandatory design avoids the thin-anonymity-set problem that optional systems often face. Optional privacy can still work, but only if wallets route normal activity into the private path by default.
- Proof systems change trust assumptions, not cost assumptions. Halo 2 removed trusted setup for Zcash. Aztec’s proving stack pushes privacy-preserving execution to the edge. Neither development makes privacy free. They mostly change who bears the cost and where the trust boundary sits.
- Metadata privacy is a separate budget line. End-to-end encrypted content without traffic protection still leaks behavior. Systems that promise real communications privacy need to fund cover traffic, mixing, or other anti-correlation mechanisms.
- Perpetual issuance can be rational. Monero’s tail emission is unpopular with hard-cap maximalists, but it directly addresses the possibility that fees alone may not support long-run security. Lower short-term holder dilution can mean weaker long-term resilience.
- Governance design has to budget for maintenance, not just launch. Zcash’s repeated funding ZIPs and XMTP’s explicit network fees are both examples of protocols refusing to pretend infrastructure runs itself.
At FinDaS Tokenomics, the recurring mistake we see in tokenomics consulting around privacy systems is treating confidentiality as a UX toggle instead of a production system. Privacy changes fee design, reward routing, validator economics, device requirements, compliance exposure, and governance cadence. Any tokenomics expert or token economy advisor who ignores those costs is usually understating both dilution needs and operational risk.
The strongest Web3 privacy systems will not be the ones with the most elegant marketing around zero knowledge. They will be the ones that can keep paying for miners, validators, provers, relays, developers, and governance after speculation cools down. In privacy, as in every other part of crypto, the security budget is the product.
