On-Chain Privacy: Pseudonymity, Mixers & Zero-Knowledge

01 · Concept — what problem does it solve?

Your bank statement is visible to you and your bank. Your blockchain history is visible to everyone, permanently.

An address is a pseudonym, not an identity — until one link ties it to you. A single exchange withdrawal with your name attached, an ENS name, a payment from a friend who knows you: after that, every transaction that address ever made, and every counterparty it touched, is readable by anyone with a block explorer. Chain-analysis firms do this for a living. Privacy on a public chain is therefore not the default state; it has to be engineered back in.

The needs are ordinary. Salaries, supplier payments and treasury moves are commercial secrets. Visible wealth is a physical-safety risk. Public order flow invites front-running. The engineering problem is doing that without giving up the auditability that makes the ledger trustworthy.

02 · Mechanics

• How analysis works. Clustering (addresses that fund each other or share a deposit address probably share an owner), timing (a deposit and a withdrawal minutes apart), amount matching, and labelled exchange addresses. None requires breaking any cryptography — only reading public data patiently.
• Mixers and shielded pools. Users deposit into a pool and later withdraw to a fresh address. A zero-knowledge proof lets the withdrawer show "I own some deposit in this pool" without saying which. Tornado Cash used fixed denominations so all deposits look alike. The size of that crowd is the anonymity set.
• Zero-knowledge proofs. Prove a statement is true without revealing the underlying secret. Here the statement is "I have a valid deposit"; elsewhere the same technology compresses transactions in rollups. Different job, same mathematics.
• Stealth addresses. The sender derives a fresh one-time address for each payment from the recipient's published key, so payments cannot be linked to the recipient's public address. ERC-5564 proposes a standard for it.
• Native shielded systems. Zcash and Monero build privacy into the base layer rather than layering a contract on top.
• Privacy Pools. A design that adds association sets: a withdrawer proves their deposit belongs to a set that excludes known-illicit deposits, without exposing their full history — an attempt at privacy that can still satisfy a compliance question.
• Reducing leakage elsewhere. Private transaction relays keep orders out of the public mempool; the RPC provider your wallet talks to can otherwise see your IP address alongside your addresses.

03 · Formulas

anonymity set N          the crowd you could plausibly be
naive identification     1 / N

bits of anonymity        = log₂(N)
anonymity loss (bits)    = log₂(N) − log₂(N_effective)
                           // N_effective = crowd left after timing, amount and
                           //               address-reuse heuristics narrow it

e.g. 1,024 equal deposits → 10 bits of anonymity on paper.
A 3.42-bit loss → N_effective = 1,024 / 2³·⁴² ≈ 96
                  → the crowd is about 10.7× smaller than it looks.

That last figure is the median loss reported in a June 2026 arXiv preprint measuring the Railgun privacy pool on Ethereum; the same study reports its heuristics linked 17.65% of withdrawals to deposits. It is a single preprint and not yet peer-reviewed, and it measures one protocol — read it as an illustration of how behaviour erodes an anonymity set, not as a verdict on privacy technology in general.

04 · Edge cases & risks

• Legal risk is separate from technical risk. A tool can be delisted and still leave users with compliance problems: exchanges and analytics firms often flag funds that touched mixers, regardless of the sanctions status. Rules differ by jurisdiction and are changing.
• Privacy is not the same as wrongdoing. The same pool serves both a person protecting their savings from a stalker and a launderer. Compliance-friendly designs like association sets are attempts to separate the two without reading everyone's history.
• Off-chain metadata leaks more than the chain does. IP addresses, RPC providers, wallet-extension analytics, ENS names and timing all sit outside the cryptography.
• Some proof systems need a trusted setup. A one-time ceremony generates the parameters; if the secret left over from it were ever kept, forged proofs would be possible. Newer systems avoid this, at other costs.
• Anonymity is retroactive and one-way. Once an address is linked to you, the whole past becomes readable and cannot be un-linked. The order of operations matters more than any single tool.