Author | a16z crypto
Compiled by | Odaily Planet Daily (@OdailyChina)
Translator | DingDang (@XiaMiPP)
Editor's Note: In 2025, the surge of Zcash reignited the privacy narrative in the crypto industry. Often, what we see is just a surge of sentiment and capital inflow. Many might internally believe this is merely a temporary emotional wave, lacking recognition of the sustainability of this narrative itself. The latest release from a16z crypto, "Privacy trends for 2026," attempts to bring the privacy discussion back into the framework of infrastructure and long-term evolutionary logic. By gathering collective observations from several seasoned crypto industry practitioners, the article elaborates on their judgments about "how privacy will shape the next phase of the crypto system" from multiple levels, including decentralized communication, data access control, to security engineering methodologies.
1. Privacy Will Become the Most Important "Moat" in the Crypto Industry This Year
Privacy is one of the key functions for the global financial system moving on-chain; simultaneously, it is also a function severely lacking in almost all blockchains today. For most chains, privacy has long been an afterthought, a patchwork consideration. But now, "privacy" alone is enough to create a substantial distinction between one chain and all others.
Privacy also brings a more important point: chain-level lock-in effects—or, if you prefer, "privacy network effects." Especially in a world where competition based solely on performance is no longer sufficient to win.
Thanks to cross-chain bridge protocols, migrating between different chains is almost costless as long as all data is public. But once privacy is involved, the situation is completely different: Cross-chain transfer of tokens is easy; cross-chain transfer of "secrets" is extremely difficult. Operating outside the privacy zone always carries the risk of being identified by monitors through on-chain data, mempool, or network traffic analysis. Whether switching from a privacy chain to a public chain, or between two privacy chains, it leaks a large amount of metadata, such as transaction timing, size correlations, etc., making users easier to track.
Compared to those new public chains that lack differentiation and whose fees are likely to be compressed to near zero in competition (block space is essentially becoming homogeneous), blockchains with privacy capabilities can form stronger network effects. The reality is: If a "general-purpose" blockchain lacks a thriving ecosystem, killer applications, or asymmetric distribution advantages, there is almost no reason for users to use it, let alone build on it and remain loyal.
In public chain environments, users can interact very easily with users on other chains—which chain they join doesn't matter much. But on privacy chains, the user's choice becomes crucial because once they enter a privacy chain, they are less willing to migrate and risk identity exposure. This mechanism creates a winner-take-all (or at least winner-take-most) pattern. And since privacy is necessary for most real-world application scenarios, ultimately, a few privacy chains might control the majority of value activities in the crypto world.
— Ali Yahya(@alive_eth), General Partner, a16z crypto
2. The Key Question for Instant Messaging Apps This Year Is Not Just How to Be Quantum-Resistant, But How to Be Decentralized
As the world gradually prepares for the era of quantum computing, many instant messaging applications built on encryption technology (like Apple, Signal, WhatsApp) are already ahead and doing quite well. But the problem is, all mainstream communication tools still rely on private servers run by a single organization. And these servers are the easiest targets for governments to shut down, implant backdoors, or force to hand over private data.
If a country can simply shut down the servers; if a company holds the keys to the private servers; or even just because a company owns the private servers—then what's the point of even the strongest encryption?
Private servers essentially require users to "trust me"; whereas having no private servers means "you don't have to trust me." Communication does not need a single company in the middle. Messaging systems need open protocols that allow us to trust no one.
The way to achieve this is to completely decentralize the network: No private servers, no single application, completely open-source code, and using top-tier encryption—including encryption resistant to quantum threats. In an open network, no individual, company, non-profit, or country can deprive us of the ability to communicate. Even if a country or company shuts down one application, 500 new versions will appear the next day. Even if one node is shut down, new nodes will immediately replace it—mechanisms like blockchains provide clear economic incentives.
When people control their messages through private keys—just like they control their funds—everything changes. Applications can be replaced, but users always retain their messages and identity; even without the application itself, end users can still own their messages.
This goes beyond "quantum-resistant" and "encryption"; it's about ownership and decentralization. Without both, what we build is just an encryption system that "cannot be cracked, but can still be shut down with one click."
— Shane Mac(@ShaneMac), Co-founder and CEO, XMTP Labs
3. "Secrets-as-a-Service" Will Become the Core Infrastructure for Privacy
Behind every model, agent, and automated system, there is a most fundamental dependency: data. But most current data pipelines—whether the data input into models or the data output by models—are opaque, mutable, and unauditable.
This might be acceptable in some consumer applications, but in industries like finance and healthcare, users and institutions often have strong privacy requirements. This is also becoming a major obstacle in the current institutional push for real-world asset tokenization.
So, how can we enable secure, compliant, autonomous, and globally interoperable innovation while protecting privacy?
There are many solution paths, but I want to focus on data access control: Who controls sensitive data? How does data flow? And who (or what system) can access this data under what conditions?
In the absence of data access control, any entity wishing to maintain data confidentiality currently has to rely on centralized services or build custom systems themselves—which is not only time-consuming and expensive but also severely hinders traditional financial institutions and others from fully unleashing the potential of on-chain data management. And as agent systems capable of autonomous behavior begin to browse, trade, and make decisions autonomously, users and institutions across industries need cryptographic-level deterministic guarantees, not "best-effort trust."
This is precisely why I believe we need "secrets-as-a-service": A new type of technical system that provides programmable, native data access rules; client-side encryption; and decentralized key management mechanisms, enforcing on-chain "who can decrypt what data, under what conditions, and for how long."
When these mechanisms are combined with verifiable data systems, the "secrets" themselves can become part of the internet's basic public infrastructure, rather than an afterthought patched onto the application layer—making privacy truly the underlying infrastructure.
— Adeniyi Abiodun(@EmanAbio), Co-founder and Chief Product Officer, Mysten Labs
4. Security Testing Will Evolve from "Code Is Law" to "Specification Is Law"
Last year's multiple DeFi hacks did not target new projects, but rather protocols with mature teams, multiple rounds of audits, and years of operation. These events highlight a disturbing reality: Current mainstream security practices still heavily rely on rules of thumb and case-by-case judgment.
To achieve true maturity this year, DeFi security must shift from "vulnerability pattern recognition" to "design-level property guarantees," and move from "best-effort" to "principled methodology":
- In the static / pre-deployment phase (testing, auditing, formal verification), this means no longer verifying only a few selected local properties, but systematically proving global invariants. Currently, several teams are building AI-assisted proving tools that can help write specifications, propose invariant hypotheses, and take on the historically extremely costly manual proof engineering work.
- In the dynamic / post-deployment phase (runtime monitoring, runtime constraints, etc.), these invariants can be translated into real-time guardrails, serving as the last line of defense. These guardrails will be directly encoded as runtime assertions that every transaction must satisfy.
In this way, we no longer assume "all vulnerabilities have been found," but instead enforce critical security properties at the code level, automatically rolling back any transaction that violates these properties.
This is not just theoretical. In fact, almost all attacks to date would trigger one of these checks during execution, potentially directly aborting the attack. Therefore, the once-popular "code is law" concept is evolving into "specification is law": Even novel attack methods must satisfy the security properties that maintain system integrity, and the final viable attack space is compressed to an extremely small, or extremely difficult to execute, scope.
— Daejun Park (@daejunpark), a16z Engineering Team
Related Reading:
《Buying ZEC to Dump BTC? The 4 Major Industry Truths Behind the Privacy Coin Surge》
《Messari: When BTC Is Regulated, ZEC's Hedging Potential Is Beyond Imagination》
《ZEC Rises Against the Trend: Which Other Projects in the Privacy Sector Are Worth Watching?》
