Privacy tokens: what they hide and what that breaks

Three facts every transfer publishes

A public blockchain is a very bad place to keep a secret. Every transfer publishes three facts: who sent it, who received it and how much moved. A block explorer shows all three to anyone, forever, and links them to every earlier and later transfer from the same address. "Privacy token" is the label for anything that hides at least one of the three, and it covers designs that have very little in common.

Two families are worth keeping apart from the start, because they break different things. Confidential designs hide the amounts and the balances: anyone can still see that Alice paid Bob, and nobody can see how much. Anonymous designs hide who: the amount may be visible (sometimes fixed on purpose), but the link between payer and payee is gone. Fully private designs hide both.

Where the privacy lives matters as much as what it hides. It can be a whole chain built for it, a privacy coin such as Monero or Zcash. It can be a layer on a public chain that ordinary tokens pass through, such as Railgun on Ethereum. It can be a single token contract with encrypted balances, the confidential tokens Ethereum got a standard for in 2025. Or it can be a chain where privacy is something applications program, which is what Midnight is.

Each corner of that map loses something different, and Midnight, whose token economy we designed, uses two of them at once.

How the hiding works

Four techniques do most of the work of hiding a transfer on a public ledger. Two hide you in a crowd, and two lock the data away, one in mathematics and one in hardware. Each moves the trust somewhere, and knowing where is the useful part.

Shielded pools are what Zcash's shielded addresses, Railgun and Aztec use. Let's say you deposit 10 USDC. The chain does not record "10 USDC to your address". It records a commitment, which works like a sealed envelope: proof that something went in, with no way to read what. To spend it, you publish a nullifier, a stub that says "one of the envelopes has been opened" without saying which, plus a zero-knowledge proof that the envelope existed, was yours and had not been opened before. If the pool holds 5,000 envelopes, an observer's best guess at which one was yours is 1 in 5,000. The trust sits in the mathematics and in the size of the pool.

Decoys are Monero's method. Every input is signed as one of a ring of possible senders: the real one plus 15 decoys picked from the chain's history, a ring of 16. An observer's naive guess is 1 in 16, or 6.25%, and analysis of how decoys get picked can narrow it further. Stealth addresses hide the receiver and RingCT hides the amount, and Monero applies all three to every transaction by default. Its FCMP++ upgrade would replace the ring with a proof of membership across every output on the chain; it is still on test networks, with a non-binding target of April 2027.

Encrypted balances work differently. The balance itself sits on-chain as a ciphertext, and the contract adds and subtracts without ever decrypting it. The research version, Zether, did this in 2019 with ElGamal encryption and zero-knowledge proofs, at about 7.2 million gas per transfer, nearly a whole Ethereum block at the time. The version live on Ethereum today uses fully homomorphic encryption (FHE), mathematics that lets a computer do arithmetic on encrypted numbers. Zama runs it: the heavy computation happens off-chain, and the key that can decrypt was split across 13 operators at launch, with the design staying safe as long as no more than 4 of them misbehave.

Trusted hardware is the fourth route. Secret Network keeps contract state private by running the computation inside secure enclaves on its validators' Intel processors, so the trust sits with the chip maker and with nobody finding a way into the enclave.

Getting in and out is where privacy leaks

A shielded pool is only as private as the crowd you hide in, and the crowd that matters is measured at two moments: when you go in and when you come out. Both are public, because the asset outside the pool is public.

Let's take an example. You deposit 13.37 ETH into a pool holding thousands of deposits. Twenty minutes later 13.37 ETH is withdrawn to a fresh address, and in that window only three other withdrawals happened. The pool held thousands of envelopes, your real crowd was four, and the unusual amount makes it one. Tornado Cash removed the amount fingerprint by accepting only fixed sizes of 0.1, 1, 10 or 100 ETH, which left timing as the tell.

Confidential tokens have the same edge. Wrapping 1,000 USDT into its confidential version is a public transaction, and so is unwrapping 1,000 a week later. In between, the balance is hidden.

The design lesson is simple to state and hard to follow: privacy improves when users have fewer reasons to cross the boundary. If you can pay fees, get paid and spend from inside the private system, you rarely have to come out, and every crossing you skip is a correlation nobody can draw.

Confidential tokens on a public chain

A token on Ethereum whose balances nobody can read is possible, and since late 2025 it is live. It cannot be a plain ERC-20, because ERC-20's balanceOf returns a plain number and its Transfer event publishes the amount. So it has its own standard, ERC-7984, the confidential fungible token, still a draft, written by authors from Zama and OpenZeppelin. It mirrors ERC-20 function for function and replaces every plain number with an encrypted one, and OpenZeppelin ships a wrapper that turns any ERC-20 into a confidential version, one for one when the token has 6 decimals, as USDC does.

Zama's protocol went live on Ethereum mainnet on 30 December 2025, with a confidential USDT transfer as its first. Circle and Inco published a confidential ERC-20 framework in October 2024: a design for a confidential USDC that hides balances and amounts, keeps wallets visible and lets a holder grant viewing access to an auditor or regulator. Circle has not shipped it as a product. Fhenix runs a competing FHE design; its Ethereum and Arbitrum mainnet was announced for 21 October 2026.

Solana has the same model built in as a token extension: amounts and balances hidden, addresses public. It was switched off in June 2025 after a flaw in its proofs was found, and switched back on in June 2026. Solana reported no exploit, and the feature still stayed off for a year.

Here is what a block explorer shows when Alice sends Bob 250 confidential USDT out of her 1,000: a transfer from Alice to Bob at a given block, an amount that is an encrypted handle (a string of hex, not a number), and both their encrypted balances changing. The observer learns that the two transacted and when. They do not learn the 250, the 750 Alice has left, or even whether the transfer went through. The contract cannot see whether Alice had enough, so it computes "send 250 if the balance covers it, otherwise send 0" on the encrypted values, and a failed transfer looks exactly like a successful one.

Three consequences matter to whoever issues one. The first is a ceiling. In OpenZeppelin's implementation balances are encrypted 64-bit integers, and 2⁶⁴ is about 1.8 × 10¹⁹ base units. At the 18 decimals most ERC-20s use, that caps the whole token at about 18.4 whole units; at 6 decimals the cap is 18.4 trillion, which is why confidential tokens default to 6. A wrapped 18-decimal token is converted down to 6 decimals, and anything smaller than a millionth of a token stays behind; a token issued natively has to pick its decimals with the ceiling in mind.

The second is where the trust sits. Privacy rests on the operators who jointly hold the decryption key: on Zama, on no more than 4 of the 13 misbehaving. That is a different promise from Monero's, and a holder should know which one they are relying on.

The third is that compliance still works. Addresses stay visible, so freezing, blocklists and allowlists work as they do on ordinary tokens, and OpenZeppelin ships them as extensions. That is why Circle chose confidentiality over anonymity: everything a regulator screens on is still there.

Can you swap a privacy token?

Yes, and in most cases the swap itself is public. The privacy comes from hiding who traded, while what was traded stays on display. Four routes carry most of it.

The first goes from a private pool to a public exchange. Railgun lets a shielded balance call ordinary DeFi contracts through a relay contract, and charges 0.25% on the way in and again on the way out. A swap made that way happens in the exchange's public pool, so the pair, the size and the price are visible to everyone, while the exchange sees Railgun's contract and not you. That is the anonymous corner of the map, for one trade.

The second is intents. Since October 2025 the Zcash wallet Zashi (renamed Zodl in February 2026) has let users pay in BTC, SOL or USDC and receive ZEC through NEAR Intents. You state the outcome you want, competing third parties called solvers fill it, and the ZEC now lands at a fresh shielded address. The payment leg is still visible on its own chain. Cake Wallet added NEAR Intents swaps, including swaps of shielded ZEC, in January 2026.

The third is atomic swaps. Bitcoin and Monero can be swapped with no exchange and no trusted party in the middle. Monero has no scripts and no timelocks, so the swap splits the Monero key between the two parties and uses an adaptor signature on the Bitcoin side: the BTC is locked in a Bitcoin script, the XMR goes to an address neither party can spend alone, and claiming the BTC reveals exactly the key share the other side needs to take the XMR. Neither side can cheat. It takes from half an hour to a few hours, because Bitcoin confirmations set the pace.

The fourth, centralised exchanges, is shrinking. Binance and OKX delisted Monero in early 2024 and Kraken did so for the European Economic Area that October, the only one of the three to cite regulation. In the EU the anti-money-laundering rules bar crypto service providers from handling privacy coins from July 2027.

Private trading venues are rare. Zama sold its own token in a sealed-bid auction: each bid's size was encrypted while its price was public, and the clearing price, US$0.05, was computed over the encrypted bids and then published. What does not exist is a confidential token in an ordinary automated market maker. Why? A pool like Uniswap's prices every trade from its two reserves, and with encrypted reserves there is no price to quote. Confidential trading therefore runs as auctions, where the price is the one number that has to be made public.

What works with what

Hiding amounts breaks anything that prices or manages risk: exchange pools, lending and liquidations all need the number. Hiding identities breaks anything that screens: sanctions checks, blocklists and exchange listings all need the address. Set against what a token is usually expected to do, the four corners of the map come out like this.

So a confidential token fits compliance and struggles with DeFi, and an anonymous design fits public DeFi through a relay contract and struggles with compliance. A fully private token fits neither unless it steps out of its pool, and stepping out turns it back into an anonymous design for that one moment.

No design keeps everything. Which losses a token can afford is a design question, and it has to be answered before anyone writes a contract.

What we learned designing Midnight's token economy

Midnight is a privacy blockchain built by Input Output, the team behind Cardano, and live since the end of March 2026. We designed its token economy over a year-long engagement. Midnight wanted to be private and compliant at the same time, and it took us several iterations to make the two work together.

The way the problem was framed set the direction. There had to be privacy and private transactions. There also had to be a way to fund the blockchain and to operate it: staking, block rewards, governance, a treasury. Ask one token to do both and it lands in the fully private corner of the map, where screening, listings and most of DeFi stop working. So the two jobs went to two assets, each in the corner its job needs.

• NIGHT is always public. Its balances and transfers are visible, it is transferable, and it is used for staking and governance (Midnight's token documentation). Everything that needs visibility works for it.
• DUST is shielded and cannot be transferred. It is the resource that pays for transactions, generated by holding NIGHT up to a cap (5 DUST per NIGHT under the initial parameters), and it decays to zero once the NIGHT behind it is spent. DUST sits in the fully private corner but never needs what that corner breaks: it cannot be sent to another wallet, so there is no market to list it on, no pool to price it in and nothing for a sanctions screen to stop.
• Applications choose per token. A token minted on Midnight is either shielded or unshielded, the two live in separate pools, and nothing moves a token from one to the other.

Our part was how users get DUST, and it came down to the swap question from earlier. A user can get a token in only a handful of ways: buy it on an exchange, swap for it on-chain, receive it from a faucet, convert it from another asset, or earn it. We scored each against nine constraints, among them decentralization, censorship resistance, accessibility, resistance to spam attacks, and a hard rule that DUST could not be pegged to NIGHT. Swaps scored 0.72 out of 1.0: an atomic swap needs a third party to match the two sides, and a party that can refuse makes access censorable. Faucets scored 0.61. A variable conversion from NIGHT scored 0.75 and pushed the no-peg rule to its limit. Generation, where holding NIGHT continuously produces DUST, scored 0.94, and the case study has the full matrix.

Seen from the boundary problem above, the winner is also the most private option on the list. A fee resource bought on a market would send every user across the public boundary each time they needed fees, which is the 13.37 ETH problem in another shape. Generated DUST never crosses it.

Two more lessons from that engagement apply to any privacy design. Transaction pricing on Midnight is variable and tied to the complexity of each operation, because a fixed fee cannot respond to congestion without creating arbitrage. And a good part of the work was removing things: several proposed countermeasures guarded against attacks no rational attacker would pay for, and taking them out left a simpler protocol with a smaller surface to audit.

The general lesson I take from it is to decide which functions need visibility and give them to an asset, or a layer, that can be seen. Asking one token to be private, liquid, listable and compliant at once is asking it to sit in all four corners of the map.

Supply nobody can count

On a public chain anyone can add up the balances and check them against the supply the protocol claims. Anyone can run that audit for free, and hiding amounts removes it. If nobody can see balances, nobody can sum them, and a bug that mints coins out of nothing can go unseen.

This has happened. In March 2018 a cryptographer at the company behind Zcash found a flaw in the proving system of its original shielded pool that could have let an attacker create Zcash without being detected. It was fixed in the October 2018 upgrade and disclosed in February 2019, and the company said it found no evidence that anyone else had discovered it or that counterfeiting had occurred. The protection that matters most sits at the boundary: Zcash nodes track how much value each pool holds and reject any block that would take one below zero, so counterfeit coins cannot leave a pool unnoticed.

For confidential tokens it depends on how the supply was created. A wrapped token's supply equals the public collateral locked in the wrapper, so anyone can still count it. A token minted natively under ERC-7984 keeps its total supply encrypted unless the issuer chooses to disclose it.

The rule I give clients: keep minting and burning public even when transfers are private, publish the supply as a number, and give auditors a viewing key rather than an assurance. Midnight follows the first half by construction. NIGHT's supply is fixed at 24 billion and every unit is public, so the asset that carries value can be counted, while the private asset is a capped resource that cannot be moved.

A tokenomics audit of a privacy token therefore starts with a question an ordinary audit never needs to ask: what, exactly, can anyone outside the team count?

Regulation, and choosing a design

Regulators draw the same line as the table above, from the other side. Article 79 of the EU's Anti-Money Laundering Regulation bars banks, financial institutions and crypto-asset service providers from keeping anonymous accounts or accounts that allow anonymisation, including through "anonymity-enhancing coins", from 10 July 2027. The definition covers coins that anonymise transfers "either systematically or optionally", so Zcash is in scope as well as Monero. It binds the service providers, not people holding coins in their own wallets. In the US, Tornado Cash was sanctioned in August 2022 and taken off the sanctions list in March 2025, and in August 2025 a jury convicted its developer Roman Storm of conspiring to run an unlicensed money transmitting business while deadlocking on the money laundering and sanctions charges.

None of this settles the middle ground. A confidential token with visible addresses and a viewing key for auditors is a different thing from a privacy coin, and Circle's framework was built on that distinction. Whether a regulator reads it the same way is a legal question for each jurisdiction, to put to a lawyer before launch rather than after. In the EU, MiCA already governs how a token is classified and disclosed, so the two regimes have to be read together.

For a new token, the right design depends on the problem it is trying to solve. Four questions get most teams to an answer:

1. What has to be private: the amounts, the counterparties, or the data the application processes? These are three different designs.
2. What has to stay visible: price discovery, collateral value, sanctions screening, the supply? Each one rules out a corner of the map.
3. Do both have to live in one asset? If the first two answers conflict, split them across two assets, as Midnight did.
4. Who holds the key to look: the holder alone, an auditor, a regulator, a committee of operators? That is where the trust in a privacy design actually sits.

Further reading

• Midnight tokenomics: how we designed the NIGHT and DUST economy, step by step, including the scoring behind DUST generation.
• Privacy is fungibility: our review of a paper arguing that tokens native to a public ledger behave more like credit than money.
• Single-token vs two-token tokenomics: when splitting roles across two tokens pays off.
• DEX, CEX and market makers: how liquidity gets supplied when a token is public.
• Token supply 101: what supply means and how it is reported.
• RWA: Classification is an output: why a token's design, not its label, decides how it is regulated.

Hristo Piyankov

Lead token economist

Hristo is one of the best-known tokenomics designers in the industry. He is a top Web3 LinkedIn voice and a mentor in several high-profile accelerators such as Brinc and HyperNest. Hristo teaches a university masters degree in Cryptoeconomics and Decentralised Finance (DeFi). Having worked on over 300 tokenomics projects, he knows the ins and outs of token economies, what works and what does not.

Prior to working in crypto, Hristo was an Analytics Director and a Data Scientist for 12+ years in TradFi.