Skip to content

Wallet Privacy, A White-Label Private Mode for Wallets and dApps

In short

White-label wallet privacy using the Ethereum Foundation's Kohaku Standard SDK: add Private Mode without building a ZK team, relayer, or indexer from scratch.

3-5 seconds
proof generation
80%
faster proofs
0.2%-1%
transaction fees
Trusted by teams building on-chain

Wallet privacy is the ability to make on-chain activity confidential, shielding amounts, counterparties, and balances, without leaving the wallet your users already trust. A private wallet, or a "Private Mode" inside an existing one, lets a user route funds through a shielded pool so their transactions are not exposed in plaintext on a public ledger.

On a transparent chain, every balance and transfer is visible to anyone, and for high-value users, funds, treasuries, payroll operators, and active traders, that openness is a liability: trading strategies leak, salaries get doxxed, and counterparties are exposed, so wallets are increasingly losing those users to dedicated privacy alternatives.

Protofire integrates a white-label Private Mode into wallets and dApps using the Kohaku Standard SDK: the Ethereum Foundation's open-source privacy framework. We handle the relayer, indexer, proving circuits, and compliance hooks; your team toggles the feature on. We don't own or sell Kohaku, we're the engineering partner that integrates it, and we've already shipped a production privacy wallet on mainnet.

Privacy-wallet integration stack we assemble end to end

Protofire deploys and maintains every layer between the Private Mode toggle and the shielded on-chain pool.

01

Wallet UI / Private Mode toggle

The user-facing switch that routes funds into the shielded flow without changing the wallet UX or custody model.
02

Kohaku Standard SDK

The Ethereum Foundation's protocol-agnostic routing framework; Protofire integrates, configures, and maintains this layer inside your wallet.
03

Privacy-backend routing

Multi-protocol routing across Hinkal, Railgun, Privacy Pools, and 0xCurvy with automatic failover so the wallet never depends on a single provider.
04

ZK proving circuits

Rust-based zero-knowledge proofs that break the public link between sender, receiver, and amount; on Telos we cut proof time from 15-25 seconds to 3-5 seconds.
05

Relayer and indexer

Protofire-operated services that submit shielded transactions and track shielded state without exposing either to the public network.
06

Shielded pool with compliance hooks

The smart-contract layer where funds move through the privacy pool; compliance hooks support optional KYC and transfer rules for institutional use.
01

What wallet privacy is

Wallet privacy means a user can transact without broadcasting the details of that transaction to the entire network. In practice it looks like a Private Mode toggle in the wallet UI: when it's on, funds move through a shielded pool, and the link between sender, receiver, and amount is broken on-chain.

The user keeps custody and a familiar UX; what changes is what the public ledger reveals. This is selective confidentiality, not a black box, it pairs shielded transfers with compliance hooks and optional KYC so the feature stays usable for institutions rather than reading as an opaque mixer.

For a wallet team, the point is differentiation: power users and institutional clients want confidentiality by default, and it keeps them inside your product instead of pushing them toward a separate privacy wallet. Benefits: a privacy feature your best users actually ask for · selective disclosure instead of full transparency · retention of high-value, institutional accounts.

02

How an integration works

1

Design

We map the Private Mode UX into your existing wallet flow, define fee tiers, and scope the compliance hooks (transfer rules, optional KYC). Deliverable: an integration and UX plan.
2

Integration

We integrate the Kohaku Standard SDK and stand up the backend: relayer, indexer, and proving circuits, with routing across the privacy backends. Deliverable: a working shielded-transaction path in your wallet.
3

Launch

Testing, rollout, and a maintenance handover so the privacy infrastructure stays current after go-live. Deliverable: Private Mode in production, supported.
03

First-hand: shipping a production privacy wallet (Telos zkWallet)

Privacy is a hard usability problem: most protocols offer strong cryptographic guarantees but stay too complex and too slow for everyday payments. Telos partnered with Protofire to build Telos zkWallet, a privacy-enabled wallet for the Telos EVM ecosystem. During discovery we identified the real barriers as UX friction, infrastructure coordination, and proof latency.

Our approach was to ship the complete privacy stack, not a thin interface. We adapted the open-source zkBob protocol for Telos EVM and deployed privacy smart contracts, ZK-SNARK circuits, relayer services, and indexing infrastructure, packaged as a cross-platform desktop app (macOS, Windows, Linux) with a trusted-setup ceremony for the circuits.

The key move was native Rust-based proof generation: it cut proof latency from typical browser times of 15-25 seconds to roughly 3-5 seconds, up to an 80% improvement in responsiveness.

The outcome is a production privacy wallet running on Telos mainnet, with a UX comparable to a standard Web3 wallet (live demo). That is the same stack, relayer, indexer, ZK circuits, that the Kohaku-based Private Mode service productizes into a white-label, multi-backend integration. The difference now is that you don't start from scratch: we bring a shipped privacy wallet's worth of experience to your integration.

04

An engineering-led privacy partner

Protofire is a blockchain development company with 250+ projects shipped since 2016 across 60+ networks and 95+ protocols. Our credentials sit close to this work: we maintain Solhint, the open-source Solidity linter used by 1M+ developers and built with Ethereum Foundation grants; we are an official Safe Guardian, with Safe deployments across 120+ EVM networks securing $2B+ in assets; and we shipped Telos zkWallet, a production privacy wallet with its own ZK circuits, relayer, and indexer.

On Telos we cut proof latency from typical browser times of 15-25 seconds to roughly 3-5 seconds with native Rust-based proof generation, a production privacy wallet now live on Telos mainnet at privacy.telos.protofire.io. So when we integrate a Private Mode, the privacy infrastructure underneath isn't theoretical, it's a stack we've built, deployed, and maintained on mainnet. That is what lets a wallet team add wallet privacy without standing up a ZK engineering function of its own.

“We handle the ZK stack; your team toggles the feature on.”

FAQ

What is wallet privacy, or "Private Mode"?
Wallet privacy is the ability to transact on-chain without exposing amounts, counterparties, and balances in plaintext. In a wallet it appears as a Private Mode toggle: when it's on, funds move through a shielded pool, breaking the public link between sender, receiver, and amount, while the user keeps custody and a familiar UX. What changes is what the public ledger reveals, not how the wallet feels to use. This is selective confidentiality, not a black box, it pairs shielded transfers with compliance hooks and optional KYC so the feature stays usable for institutions rather than reading as an opaque mixer. For a wallet team, the point is differentiation: power users and institutional clients want confidentiality by default, and the feature keeps them inside your product instead of pushing them toward a separate, dedicated privacy wallet.
What is Kohaku, is it your product?
No, and this distinction matters. Kohaku is the Ethereum Foundation's open-source privacy framework; Protofire's service integrates the Kohaku Standard SDK into your wallet or dApp. We don't own, sell, or control Kohaku. We're the engineering partner that implements it and runs the supporting infrastructure. The SDK is protocol-agnostic: rather than betting on a single privacy protocol, it routes each shielded transaction through the best available privacy engine for the user's liquidity and compliance needs, and can fail over to another if one is unavailable. We integrate routing across Hinkal, Railgun, Privacy Pools, and 0xCurvy so the wallet is never dependent on one backend, and we deploy and maintain the relayer, indexer, ZK proving circuits, and compliance hooks underneath. Your team integrates the SDK and ships the UX; it never has to build or operate ZK infrastructure in-house.
Is private-wallet activity compliant?
The integration is built for compliance-friendly privacy, not opacity. It includes compliance hooks for transfer rules and optional KYC, so the feature supports selective disclosure rather than behaving like an unaccountable mixer. It is selective confidentiality, not a black box: shielded transfers are paired with the controls an institution needs, so the feature stays usable for funds, treasuries, and payroll operators rather than reading as an opaque tool. During the design phase we map the Private Mode UX into your existing wallet flow and scope the exact controls, transfer rules and optional KYC, with your team, against your jurisdiction and risk requirements, before any build work starts. The aim is to keep confidentiality-seeking users and institutional accounts inside your product within a controlled, accountable environment, rather than pushing them toward a separate, unaccountable privacy wallet.
We're a wallet team without ZK engineers, can you still integrate this?
Yes, that's the entire point of the service. Underneath the Private Mode toggle, a full stack does the work: a relayer to submit shielded transactions, an indexer to track shielded state, ZK proving circuits to generate the proofs, and compliance hooks for transfer rules and optional KYC. Protofire deploys and maintains all of it. Your team integrates the Kohaku Standard SDK and ships the UX; you never have to build or operate the zero-knowledge stack yourselves. This isn't theoretical for us: we shipped Telos zkWallet, a production privacy wallet with its own ZK circuits, relayer, and indexer, live on Telos mainnet. So the infrastructure underneath the toggle is a stack we've already built, deployed, and maintained, which is exactly what lets a wallet team add wallet privacy without standing up a ZK engineering function of its own.
Which privacy protocols does Private Mode route through?
The Kohaku Standard SDK is protocol-agnostic, so Private Mode is never tied to a single privacy protocol. We integrate routing across Hinkal, Railgun, Privacy Pools, and 0xCurvy, and the SDK selects the best available privacy engine per transaction based on the user's liquidity and compliance needs. If one backend is unavailable, it fails over to another, so the wallet keeps working rather than depending on any single provider. This multi-backend resilience is a deliberate design choice: betting a wallet's entire privacy feature on one protocol creates a single point of failure, both technically and for liquidity. Because Protofire deploys and maintains the routing along with the relayer, indexer, and proving circuits, your team gets the resilience without operating any of the backends. As the framework adds engines over time, the wallet can route to them without a rebuild.
Can the wallet earn revenue from Private Mode?
Yes, the model is built to be a revenue stream as well as a feature. Shielded transactions carry a fee of roughly 0.2%-1% per transaction, and the integrating wallet earns a share of that flow, turning a privacy feature into recurring transaction-fee revenue rather than a cost center. The economics work because the demand is real and recurring: private payroll paying global contributors in USDC without doxxing salary tiers, B2B settlement where counterparty pricing is sensitive, treasury movements that shouldn't telegraph strategy, and traders who don't want positions front-run all generate steady shielded volume. Instead of treating confidentiality as a security cost the wallet absorbs, the feature lets it pay for itself while keeping high-value, institutional accounts inside your product. We scope the fee tiers with your team during design, alongside the Private Mode UX and the compliance hooks.
How long does it take, and what does it cost?
We scope each integration in three milestones. In Design, we map the Private Mode UX into your existing wallet flow, define the fee tiers, and scope the compliance hooks, transfer rules and optional KYC, producing an integration and UX plan. In Integration, we integrate the Kohaku Standard SDK and stand up the backend: relayer, indexer, and proving circuits, with routing across the privacy backends, delivering a working shielded-transaction path in your wallet. In Launch, we handle testing, rollout, and a maintenance handover so the privacy infrastructure stays current after go-live, leaving it in production and supported. We size effort and cost against your wallet's UX surface, the privacy routes you need, and your compliance requirements, and confirm a fixed scope and estimate before any build work starts, so there are no open-ended commitments.

Reviewed by Luis Medeiros, Field CTO at Protofire. Last reviewed: June 2026.

Book a call with Alejandro Losa

Schedule a call with our Web3 Solution Architect to receive practical recommendations and a prompt proposal for upgrading your solution.

Protofire 2026. All rights reserved

Message us on Telegram