Onchain Privacy for Institutions: Canton, Prividium, Zama, Railgun, Aleo, TEEs or Your Own Layer
An institution can keep amounts, counterparties or contract logic off the public record in nine ways, compared by who can read the data and who holds the key: Canton; private EVM ledgers such as Besu with Paladin; private chains and zones such as Prividium and Tempo Zones; Zama's encrypted tokens; confidential tokens on Solana, Avalanche and XRPL; Railgun and Privacy Pools; Aleo, Midnight and Aztec; hardware-enclave chains; and a layer built for one EVM chain.
Reviewed by Luis Medeiros, Field CTO at Protofire · Updated October 2026
Onchain privacy for institutions keeps amounts, counterparties or contract logic out of public view on a blockchain while a named party, such as the firm, an operator, an issuer or the user, can still show a supervisor the records it must see. No live product gives a supervisor its own key: an operator, issuer, app or user grants access. On permissioned designs like Kinexys and Canton, an operator or the firm's hosting node sees all the firm's data. Zama's encrypted tokens hide amounts, not addresses; Railgun leaves disclosure to users. DTC told SEC staff in December 2025 it must have "the ability to observe all transfers" in its pilot. From 10 July 2027, EU AMLR Article 79 bars banks and crypto-asset service providers from accounts allowing "increased obfuscation".
Shielded pools, contracts in which holders transfer privately, are what Protofire builds for EVM chains, so the privacy-layer option here is our commercial interest. Our public work in this area is the zkTelos wallet: we adapted the open-source zkBob wallet and client library to Telos EVM and published releases v0.0.1 to v0.0.6 from November 2025 to January 2026. We did not create zkBob. Protofire is an onchain engineering firm founded in 2016 that operates none of the networks, pools or decryption committees compared here, has no license to provide financial services and gives no legal advice here. Which network to use is covered in our institutional blockchains guide.
Who sees what, who holds the key, and how mature is each approach?
9 options side by side: scroll the table sideways to see all of them.
What does each approach hide, and who still sees everything?
Canton Network
- +Only the parties to a transaction, and the nodes hosting them, can decrypt its parts; a node hosting no party to it receives nothing
- +An auditor or regulator can be added to a contract as an observer party that sees it and every event affecting it but cannot change it
- +Used by market infrastructure, though neither release names privacy's role: DTCC's production trades of 15 Jul 2026 ran on Canton and on DTCC's private Besu network, and Broadridge says its DLR repo platform is built on Canton technology
- +A dedicated synchronizer, Canton's ordering and confirmation service, gives a group its own sequencer and mediator, run in a chosen jurisdiction for data residency
- −Your validator operator sees all your data: Canton's trust model says it "could block you", which matters for a party hosted on someone else's node
- −Sequencers see recipient lists and message sizes, mediators see informee lists, and Canton's docs say timing, sizes and activity patterns leak
- −Canton Coin balances and history are public, and Super Validators have full visibility of Canton Coin activity
- −Regulator access is designed into each workflow; Canton documents no network-level regulator node or master viewing key
- −Contracts are written in Daml, Canton's own contract language, and Zenith's EVM layer for Canton was still on testnet on 19 Oct 2026
Canton splits each transaction into views: "Each view is encrypted so that only its informees (and the participants hosting those informees) can decrypt it". Informees are the parties entitled to see that view, and a node that hosts none of them receives nothing. The ordering layer still handles metadata. Canton's protocol reference says sequencers see metadata, "recipient lists and message sizes", but not transaction content, and the mediator sees informee lists and confirmation outcomes. Its protocol specification adds that the topology state, which maps parties to nodes, is broadcast to every member of the synchronizer. Canton's privacy model page lists what timing reveals: when transactions occur, their sizes and patterns of activity.
The party that sees the most is a firm's own node operator. Canton's trust model puts it in one line: "Your validator sees all your data and could block you." Canton Coin is outside the private-by-default model: its balances and transaction history are public through the network's scan service. CIP-0086 says the Super Validators, "who validate all Canton Coin transactions", have full ledger visibility for it. The live network rules listed 13 of them on 19 October 2026. A supervisor gets in through the application: "You can grant audit access at the smart contract level by adding an auditor party as an observer". The auditor then "sees the contract and all events that affect it, without being able to modify it". A dedicated synchronizer adds a group's own sequencer and mediator and can run in a chosen jurisdiction.
DTCC's production trades, on 15 July 2026 with more than 30 firms, tokenized DTC-held assets on Canton and on DTCC's private Besu network. Broadridge reports that its repo platform, which it says is built on Canton technology, processed $7.5 trillion in September 2026. Neither release describes the role of privacy, and Broadridge does not name the synchronizer. The uses that releases tie to privacy came earlier: Toku and Cantor8 ran one private stablecoin payroll for a multinational, by Canton's account of 10 February 2026, and Visa announced privacy-preserving payments on Canton on 25 March 2026. We found no Canton privacy breach or post-mortem.
Private EVM ledgers: Besu with Paladin, Rayls, bank-run ledgers
- +Paladin, Besu's privacy layer since Besu 25.6.0 removed Tessera, reached v1.0.0 on 25 Jun 2026 and runs on any EVM chain
- +Three privacy models in one framework: notarized tokens (Noto), ZK tokens that can hide sender, receiver and history (Zeto), and private EVM groups (Pente)
- +Supervisor access follows a named party: the Noto notary, an auditing authority fixed when a Zeto contract is created (for the token types that support one), or the Rayls operator
- +Bank-run ledgers carry large live volumes: J.P. Morgan says Kinexys has processed over $4T since inception, at over $7B a day (29 Jun 2026)
- −The Noto notary "has full visibility into all balances and transfers", and the Rayls operator "can read every transfer"
- −Rayls has "one audit key per network" and "no scoped view keys", and the proving keys in its repo come from a setup ceremony with two contributors so far
- −Zeto's bundled WASM prover adds 3 to 5 minutes to the first transaction in each session until replaced by a native prover, and its proving keys come from a trusted setup, run as a ceremony or by one trusted party, whose leftover secret could forge proofs
- −Project Agorá's real-value test is the only named Paladin case, and no public third-party audit of Paladin or Zeto was found
- −Parfin, Rayls' developer, was in Brazil's Drex pilot, where the central bank said in May 2024 that the privacy solutions tested had not shown the maturity needed
Besu 25.6.0, released on 4 June 2025, lists "Remove Tessera Privacy feature" among its sunset features. Besu's docs now describe Paladin as "an open-source privacy layer ... separate from Besu" that runs alongside each node, keeps private state in an encrypted local database and anchors commitments on the public chain. Paladin v1.0.0 shipped on 25 June 2026. In its Noto tokens "Every transfer must be co-signed by the notary, who has full visibility into all balances and transfers". Zeto can hide sender, receiver and history and offers "Non-repudiation with respect to a trusted auditing authority, specified at contract-creation time". In Pente, members share a private EVM, and only salted hashes of each transaction and its account states reach the public chain. A Linux Foundation Decentralized Trust report of 29 September 2026 says Project Agorá adopted the Noto model, with the issuer acting "as a trusted overseer with full visibility". The BIS reports a July 2026 real-value test of about CHF 800,000 by 28 institutions, without naming Paladin.
Rayls, from Parfin, links a "Rayls Sovereign" chain at each institution through a hub run by the operator. Its Enygma privacy layer "hides amounts, and who receives each payment, from the other members ... It doesn't hide who sends, and it is not private from everyone. The Private Network operator can read every transfer". Each member's view key, a read-only key that decrypts its records without the power to spend, is encrypted to the operator at registration, and "Registration can't complete without this step." For supervisors, "There is one audit key per network, and it belongs to the operator", and "There are no scoped view keys". Parfin was one member of the TecBan consortium, one of 16 participants in Brazil's Drex pilot, which has closed its second phase. The central bank wrote in May 2024 that the privacy solutions tested "não demonstraram a maturidade necessária" (had not shown the maturity needed).
Bank-run ledgers get their privacy from access control: only admitted members can read them. J.P. Morgan describes Kinexys Digital Payments as "a permissioned blockchain system that functions as a payment rail and deposit account ledger" and says Kinexys has processed over $4 trillion since inception (29 June 2026). Partior "operates on a global private permissioned ledger" for member banks. Neither publishes a privacy specification, so the operator's own view is our inference from the permissioned design. DTCC's production trades of 15 July 2026 used DTCC's private Besu network as well as Canton, and the release does not describe the role of privacy. A permissioned token on a public chain is a different thing: J.P. Morgan says JPMD on Base records "all transactions ... on a shared ledger with full traceability, but only vetted, approved counterparties can participate", and its two holders and transfer amounts were readable on Base's explorer on 19 October 2026. Whether a bank should issue such a deposit token or a stablecoin is covered in tokenized deposits vs stablecoins.
Private validiums and zones: ZKsync Prividium, Tempo Zones, Base Ledgers
- +Prividium posts only state roots and zero-knowledge proofs to Ethereum: "No transaction inputs, addresses, or calldata are visible or inferable from public data"
- +STARK proofs stop a Prividium operator from forging state, and its permissioning engine has been open source under Apache 2.0 since 8 Sep 2026
- +Scoped, view-only auditor roles, plus optional selective-disclosure endpoints that prove named balances against the commitment on Ethereum
- +Tempo says Zones keep "full access to Tempo's global liquidity", and that Deel pays contractors from one "without revealing who gets paid or how much" (14 Oct 2026)
- −The operator holds all the data: Prividium keeps it in an operator-controlled database, a Tempo Zone's sequencer "can see all transactions", and Coinbase runs Base Ledgers in Managed mode
- −Prividium permissioning sits at the RPC layer, the interface apps call to read and write the chain, and "does not imply confidential execution inside contract code", by Matter Labs' own security page
- −Tempo's docs say Zones are in limited preview with general transfers disabled, and its reference verifier "still returns true without checking execution"
- −Bank use is a pilot: the Cari Network, with six design-partner banks, is "in pilot and operating in sandbox only" (18 Oct 2026)
- −Deposits and withdrawals stay visible on the public chain, and Base Ledgers was still in early access on 18 Oct 2026
ZKsync Prividium is a validium, a chain that posts proofs to Ethereum but keeps its transaction data offchain, run by the institution itself. Matter Labs' overview says "Only the state roots and zero-knowledge proofs are posted to Ethereum. No transaction inputs, addresses, or calldata are visible or inferable from public data", while deposits and withdrawals "remain visible on the receiving chain". Transaction data and state sit in an operator-controlled database, the institution runs its own sequencer and prover, and the deployment model page says "Only Sequencer and Prover have DB access".
Matter Labs documents Prividium's limits. Its security limitations page lists multicall bypass, gas-estimation and timing side channels, adding "The limitations described in this document are not bugs". For disclosure, "Auditors can be granted scoped roles through the Permissioning System, enabling view-only access", and the Cari white paper describes a regulator key "granting read-only ability to decrypt and examine all Network transactions". Prividium's SOC 2 Type I examination covers its controls as of 29 May 2026.
Cari, a bank network on Prividium with six design-partner banks, is not live. Its status page said on 18 October 2026 that "The Cari Network is currently in pilot and operating in sandbox only". The banks are First Horizon, Huntington, KeyBank, M&T, Old National and SouthState, and Cari raised $32.5 million from banks on 2 September 2026. Matter Labs' Q3 2026 report does not mention Cari and says the multi-institution Organizations feature is not yet enabled on customer mainnets. Germany's central bank, the Deutsche Bundesbank, is testing the open-source Prividium Core, and UBS completed a gold proof of concept on ZKsync's validium in a test environment, as ZKsync reported in January 2025.
Tempo's blog said on 14 October 2026 that "Zones are generally available for enterprises", with Deel first in production, and that "The Zone operator, however, can see activity inside a Zone and can pause transfers". Tempo's developer docs read on 19 October 2026 say "Zones is in limited preview" and "General TIP-20 transfers and user contract deployment are disabled". The proving page adds that the reference verifier "still returns true without checking execution", that "ZK proof generation is not implemented" and that "Forced exits remain unfinished"; a sequencer signature quorum "does not independently prove correct execution". Base Ledgers is in early access: its operator "decides how to authorize withdrawals", and in Managed mode "Coinbase runs the Ledger and the compliance". Base documents no named user and no auditor key.
FHE confidential tokens: Zama Protocol
- +Live on Ethereum mainnet since 30 Dec 2025, with $131.1M locked on DefiLlama on 18 Oct 2026, mostly in confidential wrappers of Morpho vaults
- +Access to each encrypted value follows the contract's access list, and delegated decryption lets a custodian, compliance provider or regulator decrypt specific values
- +Stays next to public liquidity on the same chain: confidential Morpho vaults route deposits into public Morpho vaults
- +Nearly 70 audit-weeks, by Trail of Bits, Zenith, OpenZeppelin and others, according to Zama (Nov 2025)
- −Hides amounts, not addresses: Zama says "we do not hide the sender and recipient", and the first wrap into a confidential token is public
- −Decryption runs through a 13-node threshold key network in AWS Nitro Enclaves, safe while at most a third of nodes act maliciously, and any protocol operator can pause the protocol
- −The underlying issuer can freeze the wrapper that holds the deposits: a US court ordered Circle to freeze Zama's cUSDC contract on 29 May 2026 in an unrelated dispute, and the freeze was lifted about 1 Jun 2026
- −Production throughput is over 20 transactions per second on CPU; Zama's 1,040 TPS is a compute benchmark on one GPU node
- −ERC-7984, the confidential token standard, is still a Draft, and OpenZeppelin's confidential contracts library is pre-1.0 (v0.5.3)
Fully homomorphic encryption (FHE) lets a contract compute on values that stay encrypted. Zama announced on 30 December 2025: "The Zama Protocol is on mainnet. We just completed the first confidential stablecoin (cUSDT) transfer on Ethereum." It hides contents only: "we do not hide the sender and recipient of a financial transaction, only its contents such as balances, amounts, trade direction". ERC-7984 tokens "hide amounts, not addresses", and "the initial wrap transaction remains publicly observable". ERC-7984 itself was still a Draft on 19 October 2026.
Decryption goes through Zama's key management service, a 13-node threshold network that needs, for example, "9 out of 13" and holds up "as long as at most 1/3 of the nodes act maliciously". Each node runs in an AWS Nitro Enclave, and the operators are 13 firms, including Fireblocks, Ledger, Figment, OpenZeppelin and Zama itself. Who may decrypt a value is set by the contract, and delegated decryption lets "a custodian, compliance provider, or regulator decrypt specific encrypted values". "Any operator can trigger any of these on their own to pause parts of the protocol", and unpausing needs a governance vote. On 29 May 2026 a US court ordered Circle to freeze Zama's cUSDC contract in an unrelated dispute. After the freeze was lifted, Zama said confidential tokens would mirror freezes of the underlying asset and that it would appoint a compliance council; we could not confirm the appointment. Production throughput is "over 20 transactions per second on CPU" in the litepaper, and a confidential transfer costs "$0.008 to $0.8" in protocol fees.
DefiLlama counted $131.07 million in Zama on 18 October 2026, mostly confidential wrappers of Morpho vault shares curated by Steakhouse, Armitage by Wintermute, Flowdesk, RockawayX and Bitwise. Of the 12 vaults that already existed publicly, Zama says "Only the entry becomes confidential". Named institutional use is small: a GSR OTC trade announced on 12 March 2026, which Zama's post also calls a proof of concept, and Bron paying its own staff in cUSDT, announced in January 2026. Fhenix, a second FHE network, said on its homepage on 19 October 2026 that its mainnet on Ethereum and Arbitrum was planned for 21 October. Its docs placed decryption that day in one Intel TDX enclave that rebuilds the key from 3-of-6 shares. Inco Lightning, live on Base since 15 June 2026, decrypts inside trusted execution environments (TEEs), the hardware enclaves of the TEE option below.
Confidential token features: Solana Confidential Balances, Avalanche eERC, XRPL
- +Solana's Confidential Balances have been live on mainnet again since 17 Jun 2026, when Solana's Token-2022 program followed the proof program re-enabled at slot 424,224,000 on 4 Jun, after audits by Code4rena, Least Authority, zkSecurity, Trail of Bits and Qedit
- +One auditor key per token, set by the issuer: per mint on Solana, a single rotatable key on eERC
- +On Solana a mint created with the extension stays in Token-2022, with no wrapper, separate chain or decryption committee
- +Mints created with the extension can switch it on later: PYUSD, USDG and AUSD have it initialized
- −Who transacts stays public: Solana keeps "the mint, token accounts, account owners, and transaction participation" public
- −Solana's auditor key decrypts transfer amounts only, not an account's full balance, and a new key applies only to future transfers
- −No issuer had announced live confidential use since the June 2026 return: on 18 Oct 2026 the PYUSD, USDG and AUSD mints were configured with no auditor key
- −eERC costs about 947,000 gas per transfer, roughly 15 times an ERC-20 transfer, and has no named production issuer
- −XRPL Confidential Transfers were not enabled on 19 Oct 2026 (19 of 32 validator votes on XRPScan, 25 needed), and Stellar's Confidential Tokens are testnet-only
Solana's privacy docs set the boundary: "Private: token balances and confidential transfer amounts. Public: the mint, token accounts, account owners, and transaction participation." An issuer can add an auditor key, an ElGamal encryption key, that "can decrypt transfer amounts. It does not reveal an account's full balance or grant authority to move tokens." The feature was switched off after a bug reported on 10 June 2025, as Solana's post-mortem describes. It came back once its proof program was re-enabled at slot 424,224,000 on 4 June 2026 and Token-2022 was redeployed with confidential transfers on 17 June. On 18 October 2026 the PYUSD, USDG and AUSD mints had the extension initialized, with no auditor key and manual approval of accounts. That shows configuration; none of the three issuers had announced live confidential use since the return.
Avalanche's encrypted ERC-20, eERC, encrypts balances and amounts "while senders, receivers, and timestamps stay public". A transfer uses about 947,000 gas, "roughly 15×" an ERC-20, and "a single, rotatable auditor key can decrypt all amounts and balances". Hexens audited it in January and April 2025, and its repository, which says eERC "Can be deployed on any EVM-compatible blockchain", reached v0.0.5 on 26 June 2026. No production issuer is named. A permissioned Avalanche L1 is not private to read by default either: Avalanche's node docs say "Avalanche Subnets are public by default", and every validator must set validatorOnly to make one private.
On the XRP Ledger, Confidential Transfers for multi-purpose tokens (XLS-96) had 19 of 32 validator votes on XRPScan on 19 October 2026, against 25 needed to enable them. In that design counterparties stay public, every balance is also encrypted under the issuer's key, so the issuer always sees balances, and an optional auditor is fixed at issuance. Stellar's Confidential Tokens are "live on testnet" and "not yet approved for mainnet"; its X-Ray upgrade of 22 January 2026 added zero-knowledge building blocks only. Confidential payments on Plasma and Stable were still in development.
ZK shielded pools on public EVM: Railgun and Privacy Pools
- +Railgun hides sender, receiver, token, amount and balances inside the pool and held $112.0M on 18 Oct 2026
- +Railgun users can call DeFi from inside the pool through Adapt Modules, so private balances reach public liquidity on the same chain
- +Privacy Pools adds an admission check: an Association Set Provider decides which deposits can be withdrawn privately, after a review its app estimates at up to 7 days
- +Privacy Pools' circuits and contracts were audited by Oxorio in 2025, and its V2 trusted-setup ceremony ran in July 2026
- −Entering and leaving are public: Railgun's shield and unshield are ordinary transactions, and Privacy Pools hides only the link between a deposit and a withdrawal
- −Disclosure rests with users: Railgun viewing keys are irrevocable once shared, and its Private Proofs of Innocence are optional
- −No named bank, asset manager, payment firm or corporate treasury used either pool on 19 Oct 2026
- −Railgun's site lists audits from 2021 to February 2023 only, and its official deployments cover only Ethereum, Polygon, BNB Chain and Arbitrum
- −The Ethereum Foundation's Kohaku wallet SDK is unaudited and partly not ready for production, with a placeholder Railgun package and a Sepolia-only reference wallet
Railgun's docs give the "Live contract version: RAILGUN V2, on Ethereum, Polygon, BSC, and Arbitrum". Inside the pool, sender, receiver, token, amount and balances are hidden; shielding in and unshielding out are public transactions, each charged 0.25%. Users can reach DeFi from the pool through Adapt Modules. DefiLlama counted $112.0 million in Railgun on 18 October 2026, $107.6 million of it on Ethereum. Its Private Proofs of Innocence check funds against lists from providers including Elliptic, ScamSniffer, PureFi, SlowMist and the Chainalysis Sanctions Oracle, but "PPOI is optional and separate from RAILGUN's core smart contracts. It does not make RAILGUN's privacy conditional". Viewing keys, Railgun's main tool for showing a supervisor the records, are "irrevocable, meaning that whoever holds the key can see private interactions forever"; limiting a key to a block range is listed as an upcoming update. The proofs are Groth16 zero-knowledge proofs, with a multi-party (MPC) trusted setup for each of its 54 circuits.
Privacy Pools, run by 0xbow, has been on mainnet since 31 March 2025, with pools on Ethereum, Optimism, Arbitrum and BNB Chain. It held $9.40 million on 18 October 2026, not counting its BNB Chain pools, up from $2.78 million a year earlier. It hides only the link between a deposit and a withdrawal. The Association Set Provider (ASP) "controls which deposits can be privately withdrawn", with review the Privacy Pools app estimates at up to 7 days, and one BNB Chain pool uses an ASP run by Brevis. A depositor the ASP rejects keeps an exit: "Ragequit ... allows the original depositor to publicly withdraw their funds without needing ASP approval". There is no viewing key. Oxorio audited the circuits in February 2025 and the contracts in March and May 2025.
The Ethereum Foundation's Kohaku, a wallet SDK and reference privacy-preserving wallet announced on 8 October 2025, packages Privacy Pools among others. Its repository says some parts are "NOT READY FOR PRODUCTION USE. Packages contain UNAUDITED CODE"; its Railgun package is a placeholder, and the reference wallet supports only the Sepolia testnet. EthSystems, the company the Foundation's Institutional Privacy Task Force became on 14 July 2026, rates viewing keys and ZK predicate proofs at "testnet" maturity for regulatory disclosure. The rule in the EU Anti-Money Laundering Regulation (AMLR) on accounts that allow "increased obfuscation of transactions" applies from 10 July 2027. For an EU bank or crypto-asset service provider (CASP), it bears hardest on this route, as the FAQ below sets out.
Privacy-native chains: Aleo, Midnight, Aztec
- +Aleo has run since 18 Sep 2024 and carries live private stablecoins: USDCx ($4.6M on DefiLlama, 18 Oct 2026) and Paxos Labs' USAD
- +USAD shows an issuer-side disclosure model on a privacy chain: one compliance service holds its asset view key
- +Midnight apps must call disclose() for any private data they reveal, and Midnight says this selective disclosure lets banks disclose data required for regulatory purposes
- +Aztec hides private state, private functions and even private-function bytecode on an Ethereum L2
- −Aztec Alpha, live since 31 Mar 2026, is "early, unaudited software", and a critical V5 proving bug disclosed on 7 Aug 2026 was still open on 19 Oct 2026
- −Midnight's blocks come from a permissioned federation of node operators, its NIGHT token is unshielded, and Monument Bank's deposit tokens there are only announced
- −Small ecosystems: Aleo's total value locked (TVL) across the chain was $1.95M and Aztec secured $52.7K (18 Oct 2026), with 0.08 user operations per second on 17 Oct
- −Disclosure sits with users and apps; none of the three offers a protocol key that a supervisor holds
- −Bridged USDCx loses its privacy: Aleo says USDCx on other chains "will not have these privacy features"
Aleo launched its mainnet on 18 September 2024 and had a 23-member validator committee in mid-October 2026. Private records hide sender, receiver and amount, and an account's view key decrypts its records. USDCx is "a wrapped representation of USDC on the Aleo Network", backed by USDC locked in a Circle-managed contract on Ethereum through Circle's xReserve, live since January 2026 with $4.6 million in circulation on DefiLlama on 18 October 2026. Aleo adds that "USDCx that is bridged to or exists on other blockchain networks will not have these privacy features". USAD is issued by Paxos Labs, a Paxos spinout, backed by USDG from Paxos Trust Company and announced live on 11 February 2026. Aleo's page says "The asset-specific view key is held by a trusted compliance service as the sole party in possession of the view key."
Midnight, a Cardano partner chain, created its genesis block on 17 March 2026. Its launch post names nine federated node partners: Worldpay, Bullish, MoneyGram, Pairpoint by Vodafone, eToro, AlphaTON Capital, Google Cloud, Blockdaemon and Shielded Technologies. They run infrastructure; none is shown using Midnight for its own payments, and anyone could deploy contracts only from 28 September 2026. NIGHT is "the unshielded utility token". Apps must call disclose() for any private data they publish, and Midnight says its "selective disclosure allows banks, for example, to disclose data required for regulatory purposes". Since 30 September 2026 Blockfrost has run the public indexer. Wallet sync passes the wallet's viewing key to the indexer, so in our reading an indexer operator can see that wallet's shielded activity unless the firm runs its own indexer. Monument Bank's plan to tokenize up to GBP 250 million of deposits on Midnight was announced on 25 March 2026.
Aztec's Alpha network has carried user transactions on Ethereum since 31 March 2026. On 19 October 2026 its own Alpha page called it "early, unaudited software where bugs, including critical ones, are expected", said "Some circuits are still under-constrained, meaning that soundness is not fully guaranteed" and told users "Do not store meaningful secrets". On 7 August 2026 Aztec disclosed a critical V5 bug: an attacker could construct "a proof that passes verification for a transaction the network should reject", with the fix planned for V6. L2BEAT put the value secured at $52.67 thousand on 18 October 2026. Public functions, L2 to L1 messages and timing leak, a user's master viewing key opens all of that user's private data, and Aztec has no protocol regulator key.
TEE confidential computing: Oasis Sapphire and Secret Network
- +Oasis Sapphire, a confidential EVM, has run on mainnet since Dec 2022
- +Ordinary Solidity contracts keep their state encrypted, with no circuits or special encrypted types: Sapphire's state model is like Ethereum's "except for all state being encrypted"
- +Oasis documents mitigations for its leaks: gas padding, encrypted events and oblivious storage patterns for access traces
- +Oasis said on 2 Oct 2025 that its SGX v1 key manager and Sapphire were unaffected by Battering RAM and WireTap (its own assessment)
- −Sapphire leaks access patterns: a token "would be traceable from sender address to receiver address", and event data is not encrypted by default
- −Physical attacks with under $1,000 of parts broke Intel SGX, Intel TDX and AMD SEV-SNP in 2025 and 2026, and Intel and AMD treat them as out of scope
- −TEE.fail extracted the consensus seed of Secret Network's testnet (published Oct 2025), a secret its authors say allows them to decrypt all confidential transactions; rotating the seed does not protect history
- −SCRT Labs ended official support for Secret Network on 1 Sep 2026
- −Neither chain has a regulator key; Sapphire apps build their own disclosure and Secret holders can share viewing keys
A trusted execution environment (TEE) is an enclave inside a processor that keeps data encrypted in memory, so only attested code sees it in clear. Oasis Sapphire uses one for a confidential EVM. Its developer docs warn that "Contract state leaks a fine-grained access pattern", so an ERC-20 transfer "would be traceable from sender address to receiver address", and that event data is "not encrypted" unless the developer encrypts it. Its security page offers gas padding, and the concept page points to encrypted events and an oblivious RAM (ORAM) implementation that hides access patterns. No regulator key is built in. Sapphire had 40 active nodes and 987 to 3,224 transactions a day between 11 and 17 October 2026.
Four memory attacks published in 2025 and 2026 broke these enclaves with physical access. Battering RAM used $47.62 of parts on DDR4 to break Intel SGX and AMD SEV-SNP with "only brief one-time physical access", and its authors answer "Can this be fixed by software or firmware updates? No." WireTap extracted an SGX attestation key with a passive interposer costing under $1,000.
Two later attacks worked on servers with newer DDR5 memory. TEE.fail (October 2025) extracted keys from Intel TDX and AMD SEV-SNP for under $1,000, and DDRop (September 2026) used $159 of parts to "put a confidential VM into debug mode and forge attestation reports" on Intel TDX. AMD does not plan to provide mitigations for TEE.fail. Because each attack needs the server in hand, the trust assumption becomes the CPU vendor plus whoever physically controls the machines.
TEE.fail's authors extracted the consensus seed of Secret Network's testnet: "This secret allows us to decrypt all confidential transactions on the network." Secret derives all keys from that one seed, and rotating it does not re-protect past transactions. Secret had already made its validator set permissioned after WireTap. SCRT Labs ended official support on 1 September 2026, after holders voted down its plan to move the token to Arbitrum; the chain still produced blocks on 18 October 2026. Oasis's statement that its SGX v1 key manager and Sapphire were unaffected by Battering RAM and WireTap dates from 2 October 2025, before TEE.fail. The same hardware trust sits under Arc's planned privacy, whose docs describe a master key rebuilt only inside attested enclaves, under Inco Lightning, and under Fhenix's decryption as documented on 19 October 2026.
A privacy layer built for your EVM chain or productProtofire's model
- +Runs on an EVM chain the live products skip: Railgun has four official mainnets, Privacy Pools four, and Zama lists confidential tokens on Ethereum and Polygon only
- +The firm picks the key model: who holds a view key, whether it covers one asset or all transfers, and when access to future transfers ends; Paladin's Zeto fixes at most one auditing authority per contract at creation
- +Admission rules are the firm's own: who may deposit, limits per account and a freeze path agreed with the stablecoin issuer; in Privacy Pools the ASP decides which deposits can be withdrawn privately, and Railgun's screening lists come from PPOI providers
- −Every trust point is yours: circuits, a trusted setup or transparent proof system, the relayer, indexer, wallet and screening vendor
- −Build time and a circuit audit, priced apart from the contract audit, come before the first private transfer: four privacy systems had circuit or proving failures reported in 2026
- −A new pool starts with few users, so each transfer hides among fewer others than in Railgun's $112.0M pool (18 Oct 2026)
- −An EU bank or CASP offering accounts on it must square the design with AMLR Article 79 from 10 Jul 2027, and supervisors' reading of selective disclosure there is untested
- −Existing products already deploy on any EVM chain: Paladin's Zeto, with at most one auditing authority fixed per contract, and Avalanche's eERC, which hides balances and amounts but not addresses; where Zama or Railgun already runs, integrating it is faster than a build
A build is the route when a chain foundation, payment product or stablecoin issuer needs private transfers on an EVM chain where Railgun, Privacy Pools and Zama do not run. The same holds when a regulated firm needs a key model none of the products above gives on its chain. Paladin's Zeto, with at most one auditing authority fixed per contract, and Avalanche's eERC, with one rotatable auditor key that decrypts amounts and balances, already deploy on any EVM chain and cover the nearest cases. USAD on Aleo shows a per-asset model, with one compliance service holding the asset's view key. A build has the parts of any shielded pool: pool contracts and circuits, with a trusted setup or a transparent proof system; a relayer that submits transactions and screens deposits; an indexer that rebuilds each user's balance; a wallet; and deposit limits. The Travel Rule still applies offchain, as covered in our EU Travel Rule guide.
The design document lists each party, from user and issuer to operator, auditor and supervisor, with what it can decrypt and from which date. A view key opens every record it covers for as long as the holder keeps it, so a design can end access to future transfers by rotating keys per period, but not to records already shown. Freeze powers and privacy from the issuer pull against each other: to freeze a shielded balance, someone must be able to identify it, through an issuer key or a block at exit, and the document says which.
Four privacy systems had circuit or proving failures reported in 2026, from a Zcash soundness bug reported on 29 May to a V5 proving bug Aztec disclosed on 7 August. Zcash briefly disabled its Orchard pool as a result. A contract audit covers circuits only when they are in its scope, so a build budgets a circuit audit next to the contract audit and ships a withdraw-only mode in its first release.
Which institutions use onchain privacy, and at what stage?
How we counted: a named institutional user is a bank, asset manager, payment firm, market infrastructure, corporate or regulated issuer named in its own dated release or the vendor's, read between 18 and 19 October 2026. Firms that only run infrastructure, such as Midnight's block producers or Zama's key-network operators, are not counted as users. Live means real value in production use, even a single trade or payroll; pilot means a sandbox, test chain, test-asset proof of concept or a real-value test inside a test program; announced means an intent, agreement or code release with no use found. A status says nothing about size: the Scope column gives a size only where one is published. Broadridge and DTCC appear because they run on Canton technology, DTCC also on its private Besu network, though neither release describes the role of privacy. Sizes come from DefiLlama and L2BEAT on 18 October 2026 or from the issuer. The scorecard's identifiability row is our reading of the MiCA Article 76(3) test, not legal advice, and no supervisor has approved the privacy model of any product here.
Which privacy approach fits which institutional need?
only the parties to each contract, plus a regulator added as observer, should read it, a Daml build fits the timeline, and you accept that your validator operator, or your own node if you run one, sees all your data.
members accept a notary or operator who sees every transfer, as in Project Agorá's Noto model; choose Paladin's Zeto if the notary must not see balances and an auditor fixed at deployment, available on some Zeto token types, is enough.
you want your own sequencer and database with proofs or commitments on a public chain, and accept that Cari runs in sandbox and that Tempo's docs still call Zones a limited preview.
counterparty addresses may stay public, a 13-node threshold network decrypting what your contract allows is acceptable, and you want same-chain access to vaults such as Morpho.
an issuer-held auditor key that decrypts amounts is the disclosure your supervisor accepts and public addresses are fine; on XRPL, wait for the amendment vote.
user-held keys or ASP admission can serve as the disclosure path and your policy covers AMLR Article 79 from 10 July 2027; no regulated firm was named as a user on 19 October 2026.
the product can live on a young chain; Aleo's USAD, with one compliance service holding the view key, is the live pattern, and Aztec's own docs say not to store meaningful secrets in Alpha.
a physical attack on a server is an acceptable risk for the data involved and you design around Sapphire's access-pattern leaks; Secret Network lost its core developer's support on 1 September 2026.
you need private transfers on an EVM chain where Railgun, Privacy Pools and Zama do not run, or a key model that Paladin's Zeto and Avalanche's eERC do not give, and you will fund circuit audits and write the disclosure design before launch.
Which other privacy tools are early or paused, and which decision sits next to this one?
- Privacy on payment chains, not live yet: Arc's privacy features are "on the roadmap and not yet available", in a TEE design. Stellar's Confidential Tokens are on testnet, Plasma's and Stable's confidential payments are in development, Miden (spun out of Polygon in April 2025) runs a testnet only, and Solana's Private Channels "has not been security audited and is not recommended for production use with real funds without a thorough security review".
- MPC and TEE co-processors: Arcium runs multi-party computation on Solana mainnet in an alpha; its clusters keep data private if at least one node is honest, though "A protocol fault can stop a computation", and it names no institutional user. Inco Lightning, live on Base since 15 June 2026, decrypts in TEEs, and its homepage FAQ still says testnet.
- Experimental, paused, withdraw-only or narrowly audited EVM privacy tools: The community edition of Nightfall_4, published by EYBlockchain, "should be treated as experimental", and its deployment guide was tested on Base Sepolia. Hinkal paused all contracts after a double-spend exploit in July 2026, and Curvy's audit covered its Solidity contracts only. zkBob's pools have been withdraw-only since 6 July 2026. On 18 October 2026 Hinkal held $69K and Tornado Cash held $680.7 million.
- Who holds the keys: a view or audit key needs a holder and controls, as a signing key does, and crypto custody compares the three ways to hold one: multisig, MPC or a qualified custodian.
FAQ
What is onchain privacy for institutions?
Onchain privacy for institutions is the set of techniques that keep amounts, counterparties, balances or contract logic out of public view on a blockchain while a named party can still show a regulator or auditor the records it must see. It relies on zero-knowledge proofs, fully homomorphic encryption (FHE), hardware enclaves (TEEs) or access control on permissioned ledgers.
Zero-knowledge proofs show that a hidden transaction is valid, and FHE lets a contract compute on encrypted values. The approaches differ in who holds the widest view: an operator or the firm's own node on permissioned networks such as Canton, a decryption committee for Zama's FHE tokens, an issuer's auditor key for Solana's confidential balances, or the user's viewing key in Railgun.
How do banks keep blockchain transactions private?
Banks keep blockchain transactions private mostly on permissioned ledgers. J.P. Morgan's Kinexys and Partior can be read only by admitted members, Canton sends each party only its own part of a transaction, and Besu networks with Paladin keep private state off the public chain. In most of these designs an operator, a notary or the node hosting the bank sees all of the bank's data.
Public-chain tools such as Zama's encrypted tokens and Railgun's shielded pool hide amounts or the transaction graph, but no bank was named as a live user of either on 19 October 2026. The choice between the two families turns on who must be able to read all of the bank's transactions: the bank itself, an operator it contracts, or only the user.
Why do payment firms and corporate treasuries need onchain privacy?
Payment firms and corporate treasuries need onchain privacy because a public chain shows rivals their volumes, settlement wallets and counterparties. Brian Butler, Payments Lead, US at Polygon Labs, told the Roundtable that card users could "go to the blockchain explorer and then see the transaction and route it to a specific settlement wallet".
Butler said card users could then "see how much money these stablecoin and card companies are moving on a daily basis", and that "this is also competitive intelligence and alpha that these people could go get if these transactions are not private". A permissioned token on a public chain stays readable: J.P. Morgan says JPMD on Base records "all transactions ... on a shared ledger with full traceability, but only vetted, approved counterparties can participate".
Canton vs Zama vs Prividium: who sees what?
Canton, Zama and Prividium give the full view to different parties. On Canton it is the validator node hosting your party. On ZKsync Prividium it is the operator, which keeps every transaction and all state in its own database. On Zama no single party has it: a threshold key network decrypts only what each contract's access list allows.
What the public sees differs too. Canton shows each node only the parts of a transaction its parties may see. Zama hides balances and amounts on Ethereum while addresses stay public. Prividium posts only state roots and proofs to Ethereum, and its deposits and withdrawals stay visible. Tempo Zones and Base Ledgers follow Prividium's operator model: Tempo's Zones docs say "The sequencer can see all transactions on the Tempo Zone", and Coinbase runs Base Ledgers in Managed mode.
Can regulators see transactions on a private blockchain?
Regulators can see transactions on a private or privacy-preserving blockchain only through access that an operator, issuer, app or user grants: no live protocol gives a supervisor a key of its own by right. Cari, a bank network on ZKsync Prividium, describes a regulator key "granting read-only ability to decrypt and examine all Network transactions", and its status page said on 18 October 2026 that it operates in sandbox only.
Elsewhere a supervisor gets in through the party that holds the view: the operator on Rayls or Prividium, delegated decryption on Zama, an issuer's auditor key on Solana, or a key a Railgun user shares. Rado Patus, Lead Product Manager at Protofire, told the Roundtable that selective disclosure, "who owns the decision to disclose", is "one of the big problems which is still blocking this adoption".
What is a viewing key?
A viewing key, which some chains call a view key, is a read-only key that decrypts a holder's private records without the power to spend them. Railgun, Aleo, Aztec, Midnight, Secret Network and Rayls use them, and a holder can share one with an auditor or supervisor. Railgun's keys are "irrevocable, meaning that whoever holds the key can see private interactions forever".
An Aztec user's master viewing key opens all of that user's private data. Rotating keys per period can end access to future transfers, but not to records already shown. Some designs place the key with an institution: on Aleo, USAD's asset view key is held by one compliance service, and on Rayls each member's view key is encrypted to the network operator at registration.
What did DTC tell the SEC about privacy on a blockchain?
In its request to SEC staff, which the staff answered with a no-action letter on 11 December 2025, DTC said it "would support private blockchains as well as those that allow privacy protecting technologies, such as zero knowledge proofs". It added that "DTC must have the ability to observe all transfers of Tokens".
DTC would support only a blockchain that, "either on its own or through supporting technologies", lets DTC review every token transfer. The condition covers DTC's own tokenization pilot only. In our reading, the permissioned options in this guide can meet it through the operator, and a shielded pool with user-held keys cannot meet it by itself.
Does the EU ban privacy coins or private accounts from July 2027?
The EU does not ban privacy coins outright. From 10 July 2027, Article 79 of its Anti-Money Laundering Regulation (AMLR) bars credit institutions, financial institutions and crypto-asset service providers (CASPs) from keeping anonymous accounts or any account allowing "the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins". It binds those firms only.
Article 3(25) covers coins whose anonymizing features work "either systematically or optionally", so a token with an optional shielded mode can fall inside it; the text has no carve-out for selective disclosure. Recital 160 leaves out hardware, software and self-hosted wallet providers without "access to or control over" the wallets. Whether a design that lets the firm identify holders and history counts as anonymous is untested. MiCA Article 76(3) already lets a CASP's trading platform admit such tokens only if holders and "their transaction history can be identified". Which MiCA route a CASP needs is compared in our MiCA license routes guide.
Does the Travel Rule still apply to private transactions?
What does Canton hide, and who can still see a Canton transaction?
Canton hides each transaction's content from every node that hosts no party to it: "Each view is encrypted so that only its informees (and the participants hosting those informees) can decrypt it". A party's validator operator sees all of its data, and three more parties see part of the traffic: sequencers see recipient lists and message sizes, mediators see informee lists, and Super Validators see all Canton Coin activity.
Canton Coin balances and history are public through the network's scan service, and Canton's docs list timing, transaction sizes and activity patterns as leaks. A regulator gets access as an observer party added to each contract; Canton documents no network-level regulator node or master key. A firm that wants its data off a third party's node runs its own validator, and a dedicated synchronizer can keep traffic in one jurisdiction.
Are shielded pools such as Railgun compliant, and is Tornado Cash still sanctioned?
No regulator has approved a shielded pool such as Railgun, and whether a firm may use one depends on the rules that bind it, from AMLR Article 79 in the EU to sanctions law in the US. Tornado Cash is no longer sanctioned: OFAC, the US Treasury's sanctions office, designated it on 8 August 2022, and the Treasury delisted it on 21 March 2025.
The Fifth Circuit had held on 26 November 2024 that Tornado Cash's immutable contracts are not sanctionable "property". Roman Storm, convicted on one count in August 2025, faces a retrial on the hung counts set for 26 April 2027. Railgun's docs say its Private Proofs of Innocence, screening checks on a user's funds, are "optional and separate from RAILGUN's core smart contracts". In Privacy Pools an Association Set Provider decides which deposits can be withdrawn privately, and the original depositor can ragequit, withdrawing publicly without its approval.
Is fully homomorphic encryption ready for institutional use?
Fully homomorphic encryption (FHE) is in production on Ethereum, but its named institutional use is still small: one trade, one payroll and a set of vault curators. Zama's mainnet has run since 30 December 2025, with $131.1 million locked on DefiLlama on 18 October 2026, mostly in Morpho vault wrappers, and its decryption runs through a 13-node threshold key network inside AWS Nitro Enclaves.
Zama's key network stays safe "as long as at most 1/3 of the nodes act maliciously", and any protocol operator can pause the protocol. Production throughput is over 20 transactions per second on CPU. The trade is a GSR OTC trade and the payroll is Bron paying its own staff; Seturion's work was on test chains. Fhenix's homepage said on 19 October 2026 that its mainnet on Ethereum and Arbitrum was planned for 21 October, and its docs that day placed decryption inside an Intel TDX enclave.
Are TEE-based privacy chains safe after the 2025 and 2026 hardware attacks?
TEE-based privacy rests on the chip vendor and on whoever physically controls the servers, and research in 2025 and 2026 showed that brief physical access is enough to break it. Battering RAM ($47.62 of parts) broke Intel SGX and AMD SEV-SNP, TEE.fail (under $1,000) extracted keys from Intel TDX and AMD SEV-SNP, and DDRop ($159) forged TDX attestation in September 2026.
Intel and AMD treat physical memory attacks as out of scope, and AMD does not plan mitigations for TEE.fail. None of the attacks is remote. TEE.fail also extracted the consensus seed of Secret Network's testnet, a secret its authors say "allows us to decrypt all confidential transactions on the network". Oasis said on 2 October 2025, before TEE.fail, that its SGX v1 key manager and Sapphire were unaffected by Battering RAM and WireTap. Arc's planned privacy and Inco Lightning rely on the same kind of hardware.
Can zero-knowledge privacy circuits fail?
Zero-knowledge circuits can fail, and four privacy systems had soundness or proving failures reported in 2026. zkBob found a critical double-spend bug in one of its circuits on 5 June 2026 and put all pools into withdraw-only mode. Hinkal paused all contracts after an early July double-spend exploit that BlockSec traced to a likely circuit flaw, and Aztec disclosed a critical V5 proving bug on 7 August.
In Zcash, a soundness bug, a flaw that lets a false proof pass, was reported on 29 May 2026. Zcash briefly disabled its Orchard pool and moved to a new shielded pool, Ironwood. zkBob's 2023 ChainSecurity audit had left "the verifier and the snark circuits" out of scope. A trusted setup, a relayer and the prover software are further trust points. A buyer should therefore budget a circuit audit separately from the contract audit.
What do Solana confidential transfers hide?
Solana's Confidential Balances, a feature of its Token-2022 token program, hide token balances and transfer amounts, while "the mint, token accounts, account owners, and transaction participation" stay public. An issuer can set an auditor key that can decrypt transfer amounts but "does not reveal an account's full balance or grant authority to move tokens".
The feature was switched off after a bug in June 2025 and came back in June 2026, when its proof program was re-enabled at slot 424,224,000 on 4 June and Token-2022 was redeployed on 17 June. Code4rena, Least Authority, zkSecurity, Trail of Bits and Qedit had audited it before the return. On 18 October 2026 the PYUSD, USDG and AUSD mints had the extension configured with no auditor key, and no issuer had announced live confidential use since the return.
Can a regulated firm put personal data on a blockchain under GDPR?
Under GDPR, a regulated firm should avoid putting personal data on a blockchain where that conflicts with data protection principles. The European Data Protection Board's blockchain guidelines, final since 7 July 2026, say "storing personal data on a blockchain should be avoided, if this conflicts with data protection principles". They add that "technical impossibility cannot be invoked to justify non-compliance".
Public keys "qualify as personal data" when they can identify a person, and "all encryption systems have an undetermined, but limited, lifespan". Encrypted data on an immutable ledger, as in FHE tokens or encrypted notes, is therefore still stored data. The guidelines' impact-assessment questions ask whether a private or permissioned chain, or "a 'zero-knowledge' architecture", would be enough.
Does a US stablecoin issuer keep freeze powers if transfers are private?
A US payment stablecoin issuer must keep freeze powers whatever privacy layer its token sits in. The GENIUS Act takes effect on 18 January 2027. It requires "technical capabilities, policies, and procedures to block, freeze, and reject specific or impermissible transactions", and lawful orders can require an issuer to "seize, freeze, burn, or prevent the transfer".
A privacy layer on top has to keep that working. After a US court ordered Circle to freeze Zama's cUSDC contract on 29 May 2026, Zama said its confidential tokens would mirror freezes of the underlying asset. On Aleo, USAD's token program checks transfers against a freeze list, and Paxos keeps freeze controls on the USDG behind it.
Are Aleo, Midnight and Aztec ready for institutional use?
Aleo, Midnight and Aztec are live but young. Only Aleo carried live stablecoins tied to regulated issuers on 19 October 2026: USDCx, backed by USDC through Circle's xReserve, with $4.6 million in circulation on 18 October, and USAD, issued by Paxos Labs. Midnight's genesis was on 17 March 2026, and Aztec's Alpha network opened to user transactions on 31 March 2026.
Midnight's blocks come from a permissioned federation of node operators; its partners include Worldpay, MoneyGram and Google Cloud, none of them shown using it for payments, and Monument Bank's deposit tokens there are announced, not live. Aztec's Alpha page calls it "early, unaudited software", and its critical V5 proving bug was still open on 19 October 2026, with the fix planned for V6. None of the three gives a supervisor a protocol key.
When does it make sense to build your own privacy layer?
Building your own privacy layer makes sense on an EVM chain where Railgun, Privacy Pools and Zama do not run: Railgun's official deployments cover four mainnets, Privacy Pools four, and Zama's docs list confidential tokens on Ethereum and Polygon only. On such a chain, Paladin's Zeto, with at most one auditing authority fixed per contract, and Avalanche's eERC, which hides balances and amounts but not addresses, are the nearest existing options; a build fits when neither suits the firm.
The build covers pool contracts, circuits with a trusted setup or a transparent proof system, a relayer, an indexer, wallet integration, screening at entry and a written disclosure design that names each key holder. Its budget carries a circuit audit next to the contract audit. Where Railgun or Zama already runs on your chain, integrating it is faster than building.
Your users transfer privately on your EVM chain, deposits are screened at entry, and a written design names which party can decrypt what. We build the pool contracts, client-side proving, relayer, indexer and wallet behind that.
zero-knowledge privacy layers →Get a proposal
Tell us what you are building. An engineer reads it, we have a short call, and the written proposal follows within one business day.
Budget
An NDA is available from the first message and can cover anything you share. How it works