Public blockchains lay every amount in the open. This wasn't a problem until real balance sheets started using them. There are three paths to address it: build a private network from scratch, as with Zcash, Monero, and Canton; add privacy onto Ethereum, starting with Tornado Cash, then Railgun, and now Zama; or simply don't publish data at all—that's Canton again.
Each one trades concealment for functionality. No one has ever built something that hides everything while still allowing everything to run.
The demand is real and documented. J.P. Morgan validated the viability of institutional encrypted finance in 2024 and launched its deposit token on Canton in 2026. A sandwich-attacked swap loses 0.3% to 0.8%. Institutional spot OTC trading volume grew 109% in a year, while the top 20 exchanges grew only 9%; 40% of institutions now execute over half of their trades off-screen.
But privacy is not a security upgrade. It lowers your chances of being targeted, but is useless once you are. It also makes recovering funds harder. It even hid a vulnerability in Zcash that could print money out of thin air, for four years.
Value is in assets, not services. Privacy tokens hold roughly $25 billion in market cap. All protocols in the sector combined generate only about $6 million in annual fees. Monero and Zcash have earned a total of $3 million in their entire history. Zama has moved $595 million across its boundary, estimated to have earned $840 to $84,000—because it charges per bit, not per basis point.
The conclusion remains bullish. Demand is validated, technology is no longer the bottleneck, and regulation starting July 2027 will push the market toward auditable privacy. The only thing missing is a price, which is the easiest problem to solve in this entire piece. So the trade should be placed on the side that ultimately dares to charge.
The Problem: Public Ledgers Expose What Shouldn't Be Public
Blockchain is a shared ledger recording who owns what. Every machine in the network holds an identical copy, and every payment is written into all copies. No one in the middle decides what's true; anyone can check the ledger themselves. This is what allows strangers to use it without trusting each other.
The cost is that this ledger is open to all. Your account is called an address, essentially a long string of letters and numbers. Anyone can paste an address into a free website like a block explorer and read its entire life: what it holds, whom it has paid, how much, and at what minute. No login, no permission, no opt-out.
▲ A block explorer. Every address, every amount, readable by anyone, forever.
For a decade, this didn't matter much: there wasn't much money on-chain, and users were pseudonymous. Once real balance sheets enter, it's no longer harmless.
Consider what a public ledger actually discloses. A company paying salaries on-chain publishes its payroll. A fund with open positions discloses its positions, entry prices, and liquidation levels. A business paying suppliers reveals its supplier list and payment terms. And any individual holding a large balance discloses a number that makes them worth robbing.
Two things have turned this from a theoretical concern into an urgent issue. One is stablecoins—tokens designed to peg one dollar, backed by real dollars in banks—now trading in significant volumes. The other is tokenized real-world assets—bonds, funds, and property turned into tokens—bringing regulated entities on-chain. These users cannot accept "everyone sees the amounts" as a condition of entry.
So the problem is clear, the solution hard: how to hide the numbers while still letting thousands of strangers verify no one cheats?
Who's Really Paying for This: Those Whose Losses Are Measured in Basis Points
Privacy has always had a narrative. Surveillance is bad, freedom is good, and so on. But narratives don't fund products. What changed in 2025–2026 is that specific people started losing specific money because the public ledger leaked, and then they came looking to buy something.
It's not about who dislikes being watched; it's about whom the public ledger repeatedly makes pay, money that would be saved with a private ledger.
▲ Who pays for privacy on chain, plotted by how onchain the loss is against whether anyone is paying to stop it.
Traders: Getting Front-Run by Their Own Order Flow, Losses Measured in Basis Points
Your trade sits in a public queue before execution. Bots read it, buy ahead of you, and sell into your execution. This is a sandwich attack. In the year to October 2025, about 95,000 occurred on Ethereum, extracting ~$60 million, with each sandwiched swap losing 0.3% to 0.8%.
The buyers here are professionals; losses are quantifiable in basis points. So privacy here sells execution quality, not belief.
Open Positions on Perp Exchanges: Exposure Is Continuous
For those with positions, it's worse than a sandwich because the exposure is continuous. Every position on a perpetual futures exchange is public, including its liquidation price, so anyone can push the price toward it. Hyperliquid alone did ~$432 billion in volume in April 2026.
Platforms responded commercially, not ideologically. Aster launched hidden orders, Paradex and Hibachi sell position privacy, and Zama added confidential RFQ to private beta in July 2026 (Section 6 breaks this down).
Labeled Wallets That Must Sell: Strongest Demand, Least Discussed
A fund's unlock tranche sits in a wallet already labeled by Arkham and Nansen, with the unlock date known to all. When the money moves, the market front-runs it, repeating next quarter.
This revenue already exists but flows elsewhere. In the year to end-2025, institutional spot OTC volume grew 109% while the top 20 exchanges grew only 9%; 40% of institutions list OTC as their preferred execution venue, with over half of trades conducted off-screen. A market serviced by a phone call exists precisely because public venues leak.
Strategies That Get Copied: Almost No One Pays to Prevent It
Copy-trading tools can replicate a profitable address within a few blocks, so a treasury manager's rebalancing decision dies not over weeks but at execution. This isn't hiding from governments; it's hiding from a dozen peers watching the same dashboard. Almost no one pays to stop it, which is precisely what makes this quadrant interesting.
Regulated Ledgers Moved to Public Chains: Demand Is Real but Captured by Permissioned Rails
Over $30 billion of tokenized real-world assets sit on public chains, and banks cannot publish their holdings in real-time. So do banks actually want this? One case gives answers in both directions.
In November 2024, J.P. Morgan's blockchain unit ran Project EPIC in its sandbox, demonstrating encrypted fund subscriptions, blind auctions, and direct settlement on encrypted numbers using Zama's fhEVM, designed so even J.P. Morgan couldn't see the details. But that was a sandbox, and Zama was just one of several vendors. When J.P. Morgan chose where to launch its deposit token in January 2026, it went with Canton, a permissioned network.
So institutional demand is real and documented, but it was captured by permissioned rails, not public-chain cryptography.
The Toolbox: Four Ways to Keep Secrets, Differing Only in Where the Secret Lies
Every project in this sector builds with one or two of these same four ideas. The real question distinguishing them is simple: where does the secret actually live?
▲ The four primitives, sorted by where the secret actually lives.
The cost used to be speed, and this is the part of the article that will age fastest. For years, a fair criticism of FHE was it could only process ~20 transactions per second, while regular chains handled thousands. That gap has largely closed, faster than those building it expected.
No single approach wins outright. Real products combine two: sealed chips for speed, plus a zero-knowledge receipt proving the chip didn't cheat; or using FHE to store hidden state, with zero-knowledge proofs validating inputs.
There's a fifth option, bypassing cryptography altogether: only send data to those authorized to see it. That's Canton, and it's why banks like it.
First Answer: Build the Network Private from the Start
The earliest attempts designed an entire network around "hiding," rather than patching an existing one. Two coins lead this path, with opposite bets. The third case is built for banks, not individuals, but belongs to the same family.
Zcash: Privacy Is a Switch, and That's Been Its Soft Spot for a Decade
Zcash is its own chain, essentially Bitcoin-style digital cash with a private mode added. It has two address types: transparent addresses identical to Bitcoin, revealing everything; and shielded addresses hiding sender, receiver, and amount. Moving money into the private side is called shielding; moving it out is deshielding.
The hiding is done by zk-SNARKs, a compact form of zero-knowledge proof. When you spend shielded ZEC, your wallet sends a short proof stating the payment balances and no coin is spent twice. Network nodes verify this proof and accept it, never knowing who paid whom or how much.
One design choice defined everything after: privacy is optional, and chosen per transaction. Sounds user-friendly, but it's also a weakness because anonymity relies on a crowd. If you're the only one wearing a mask in the room, the mask is useless. For most of its life, most ZEC sat in the transparent pool, with the shielded group always sparse.
Most think of Zcash as one thing; it's actually four pools. Distinguishing them is key to understanding the 2026 vulnerability in Section 8. The usual summary: Sprout proved private money was possible, Sapling made it usable, Orchard removed the trusted setup.
▲ Zcash's shielded pools over ten years, with the shielded share below and the incidents marked.
One more thing worth knowing about Zcash, a reason to hold it rather than use it: shielded ZEC carries no history. Once a coin passes through the pool, it loses any trail; each unit is interchangeable with any other. This property is called fungibility, which is what compliance departments truly struggle with on transparent chains—there, you might receive a coin whose previous holder used it for crime and inherit the trouble.
Monero: Privacy On by Default, No Switch at All
Monero is also its own chain, making the opposite choice: no public mode is available. Every payment is private to all, so there's no small private pool to join—the entire chain is the crowd.
Until recently, it relied on three tools rather than zk-SNARKs. Ring signatures hide the sender by mixing the real coin with decoys; observers see sixteen possible sources, not knowing which is real. Stealth addresses generate a new one-time address for each payment, hiding the receiver. RingCT hides the amount.
▲ How Monero hides the sender, the receiver and the amount.
In early 2026, Monero underwent a major upgrade, FCMP++, replacing ring signatures with zero-knowledge membership proofs. The practical effect: the crowd you hide in expands from sixteen decoys to every payment ever made on the chain, over 150 million.
▲ Monero's anonymity set after FCMP++.
Canton: Hides Nothing, Because Nothing Is Shared
The third member of this family is not a coin and is often omitted from privacy research. But the largest institutional decision of 2026 landed here, and omitting it is a mistake.
Zcash and Monero accept the premise that "the ledger must be broadcast to everyone" and then use cryptography to hide the contents. Canton rejects this premise outright. There is no single shared ledger everyone validates. Each participant only receives the parts of transactions where they are a counterparty, enforced at the contract level by a language called Daml. If you're not involved, you never receive the data and never know the transaction happened. A component called the Global Synchronizer orders and confirms validity without seeing content.
▲ The same three payments on a public chain and on Canton, showing who receives which rows.
So secrecy is protected by "never sending it out"; authorized parties read plaintext. Note this scheme uses none of the four tools from Section 3: no zero-knowledge proofs, no FHE, and despite long-standing confusion, no MPC. Daml calls itself a language for multi-party applications, which sounds like multi-party computation but is entirely different. Integrity relies on cryptography: each participant receives hashes for the branches they don't read. Confidentiality is purely a matter of "who gets sent what."
The inversion in validation is interesting. On Ethereum, every validator re-executes every transaction, so everyone must see everything. On Canton, transaction counterparties validate themselves, each re-running only their branches, then voting. An arbiter tallies votes according to a confirmation policy, seeing only hashes. So there's no global re-execution to catch collusion; the consolation is that only parties already inside your contract can harm you.
J.P. Morgan chose it for JPM Coin, announced in January 2026 and rolling out throughout the year, for practical rather than ideological reasons. Privacy is on by default, no need to worry about crowd size. No shared pool means freezes like Circle's in Section 8 can't happen here. Every participant is an identified legal entity, a hard requirement for regulated banks, not a compromise. Settlement is atomic across applications. Peers are already on it, including Goldman Sachs and BNY Mellon.
What it gives up is equally real. No permissionless composability; liquidity is walled off. Privacy is built on access control, not math, so authorized counterparties see everything, and a compromised participant node leaks. It's not censorship-resistant—a feature for banks, a disqualifier for the original ethos. Even when everything works, three things leak: change amounts (depending on token model), who hosts your participant node, and the sequencer sees "who is messaging whom."
Canton Coin (ticker CC) launched with the Global Synchronizer mainnet in July 2024, used to pay application and infrastructure fees and reward network operators, with no pre-mine or pre-sale. ~100 billion can be minted over the first decade. As of late July 2026, price was ~$0.12, market cap ~$4.8 billion, already a top-twenty asset.
That number is worth pausing on; it redefines the entire sector. A permissioned network built for banks has a token value ~35x that of Zama.
Side-by-Side Comparison
Three lines sum up the argument. Both coins can hide your amounts from everyone, but neither can run even a single application. Canton can run applications and hide amounts from everyone except counterparties. And Canton doesn't need a crowd for anonymity because there's no shared ledger to hide within, bypassing the weakness that plagued Zcash for a decade.
No one has built something that does both. A chart at the end of Section 6 shows how consistent this trade-off is.
Where Privacy Coins Hit a Wall: They Work, But Live on an Island
Privacy chains do their core job well, but they live on an island.
First, practical friction. They're separate chains with separate tokens; assets must be moved in and out. The dollars people actually trade with and the lending protocols they use are all on the other side—Ethereum and Solana.
However, this island is less isolated now. There's a second solution unrelated to "bringing privacy to Ethereum": leave the privacy chain where it is, just make it accessible.
▲ Buying shielded ZEC with and without a centralised exchange in the path.
NEAR Intents does exactly this and is a major reason for Zcash's 2025 resurgence. You declare your intent, e.g., swap Bitcoin for ZEC, and a network of competing solvers figures out how to hop chains to fulfill it; you sign only once. Zcash's own wallet integrated this, allowing users to buy shielded ZEC from another chain or sell it, without touching centralized exchanges or exposing their Zcash address.
As of March 2026, cumulative ZEC volume via NEAR Intents reached $1.5 billion, with $600 million from the wallet's built-in swap product (launched October 2025).
So the island problem is real, but it's a spectrum, not a wall, with two competing answers: bring privacy to where the money already is (the rest of this article); or leave privacy where it is and fix the surrounding plumbing, which is cheaper and already running.
Then the bigger limitation: these chains only handle money. They have no smart contracts (Canton excepted), the little programs that let a chain do more than transfer—lend, borrow, earn interest, run a market. You can hold private cash, send private cash. You cannot earn yield on it, use it as collateral, or plug it into anything existing.
Privacy also pays its own tax, and Zcash and Monero each pay half. Zcash made anonymity optional, so the crowd is only as large as "those willing to bother." Monero made anonymity mandatory, creating the industry's strongest crowd but also getting itself delisted from regulated exchanges. European rules will tighten further from 2027; Section 9 returns to this.
Second Answer: Add Privacy onto Chains People Already Use
Another approach avoids moving altogether. Keep money and apps on Ethereum, add a layer of confidentiality. No new chain, no cross-chain bridges, no new wallet.
Three generations have tried this, each existing because of what the previous couldn't do. Read them in order; the order itself is the argument.
First Generation: Tornado Cash, and How 'Mixer' Became a Dirty Word
Think of it as a coin-swap window. You deposit a fixed denomination (0.1, 1, 10, or 100 ETH) into a pool, receiving a secret note. Later, withdraw to a fresh address using a zero-knowledge proof stating you own one of the pool's unspent deposits, without revealing which one. The link between old and new addresses is broken. Your anonymity set is everyone else who deposited the same denomination.
That's the product. Money sits idle, earns no yield, does nothing; fixed denominations mean you can't transfer arbitrary amounts. It severs one link but doesn't give you a private balance.
The ending was legal, not technical. OFAC sanctioned these contracts in August 2022. In November 2024, the Fifth Circuit Court of Appeals ruled OFAC overstepped, reasoning that an immutable, uncontrolled contract wasn't anyone's property. Contracts were removed from the sanctions list in March 2025. Then in August 2025, developer Roman Storm was convicted of conspiracy to operate an unlicensed money-transmitting business; the jury deadlocked on money laundering and sanctions charges, with prosecutors seeking a retrial.
The code won; the developer didn't. This outcome explains something you'll notice elsewhere in this section: both successors explicitly emphasize they are not mixers. That statement is doing legal work, not technical work.
Tornado also had two features carried into everything after. Your anonymity set is only others who deposited the same denomination, so an abnormally sized or timed withdrawal can deanonymize itself—the same behavioral failure that undid Zcash users. Also, honest users had no way to prove their innocence. Clean money exiting the pool looks identical to stolen funds; exchanges could only treat everything from that address as tainted.
What Tornado couldn't do is the entire reason for the next tier. It hides your history, not your holdings. You can obscure where money came from but cannot hold a private balance because money sits idle in the pool.
Second Generation: Railgun, a Shielded Pool You Can Actually Use
If Tornado is a coin-swap window, Railgun is a private bank account on Ethereum that can also make external payments. You shield tokens into its pools on Ethereum (also Arbitrum, Polygon, BSC). Inside the pool, zero-knowledge proofs hide sender, receiver, and amount.
The distinction from Tornado is worth stating precisely, as people often conflate them. Tornado takes only fixed denominations, one-off, returning the same denomination to a new address. Railgun takes any amount of supported tokens, maintains a persistent private balance, allows payments within the shield to another Railgun user, and lets you interact with things like Uniswap without unshielding first. Tornado's anonymity set is others who deposited the same denomination; Railgun's is the entire pool on that chain.
The clearest understanding: Railgun is essentially Zcash's shielded pool rebuilt as a smart contract, on the chain where the dollars and apps already exist. This gives it stronger privacy than Zama because it hides the transaction graph, not just the numbers on it.
But what "reaching into DeFi" means has an important caveat. When Railgun helps you swap on Uniswap, it unshields the amount, executes the swap in plaintext on the public chain, and re-shields the output, all within one atomic transaction. So the trade itself is public; what's hidden is "that it's you." Railgun anonymizes the actor, not the value, meaning it does not protect you from sandwich attacks: bots see the pending swap and its size, regardless of who's behind it.
It also has a more elegant compliance answer, born directly from Tornado's fatal gap. Private Proofs of Innocence let users generate a zero-knowledge proof showing their funds don't originate from known illicit lists, without revealing where they actually came from, at the cost of a one-hour delay. So you can be both private and provably not a thief—something Tornado never allowed.
Practical use is through a wallet called Railway: shield, transact, unshield when needed. Vitalik Buterin publicly used it in 2023 and has spoken favorably of roughly this shape of compliance solution, which only helps this route's credibility.
Now for the sobering part. Railgun has shielded $90–110 million across four chains, with cumulative shielded transaction volume ~$5.16 billion, and historical cumulative protocol revenue of $13 million, with $4.6 million from the past year. Zama holds $39.6 million, with H1 2026 transaction volume of $452 million. Metrics aren't perfectly comparable—Railgun launched in 2021, Zama mainnet only in December 2025—but the direction is clear. On every available metric, the zero-knowledge incumbent is larger than the FHE newcomer, and it's already charging.
Two weaknesses deserve mention, rarely discussed. The pool is the crowd, so Railgun inherits Zcash's structural problem entirely: at ~$100 million shielded, the crowd is decent but not deep; privacy weakens as it thins. Worse, being spread across four chains splits that crowd into four smaller ones, exactly opposite what anonymity sets want. Second, fees flow into the Railgun DAO treasury, not directly to the token, so holding RAIL and having an economic stake in the protocol are two different trades.
Why a third generation then? Because of an easily missed limitation: Railgun can hide your holdings, but two people's holdings never meet. Zero-knowledge proves facts about data you already hold; it cannot compute on someone else's hidden state. No blind auctions, no encrypted order books, no vaults doing arithmetic on deposits they can't read. This gap is the reason for everything that follows.
Third Generation: Zama, and Wrapping the Dollars You Already Hold
You take regular USDC, wrap it into cUSDC—the same dollars, but with encrypted balances. ERC-20 is the standard recipe every ordinary token on Ethereum follows; ERC-7984 is the same recipe, just with hidden balances. Pay a small fee when wrapping; unwrap back to regular USDC anytime.
▲ Wrapping USDC into cUSDC
What it hides and doesn't hide. Two things are encrypted: the amount of each transfer, and your real-time balance. The balance is the bigger prize—with regular USDC, anyone can permanently see you hold $4.2 million; with cUSDC, that number is never readable.
What remains public is your address, the counterparty's address, and the timing. The contract must know whose balance to update, so addresses are in plaintext. The transaction graph remains intact. Zama hides the numbers written beside the edges, not the edges themselves.
The practical consequence is worth stating plainly, as it's easiest to misread optimistically. Using cUSDC to pay thirty employees, everyone still sees you paid those thirty addresses and when. You hide the salary amounts, not the employment itself. Same for suppliers: you hide the payment terms, not the supplier list. It protects you when the sensitive thing is a quantity; it does little when the sensitive thing is a relationship.
One exception is structural, not cryptographic. When a contract sits in the middle (vaults and RFQs are like this), the chain shows you're talking to the contract, not to a counterparty. Depositing into a private vault doesn't reveal who's borrowing your money; paying someone directly reveals whom you paid.
Doing Math Without Unlocking
Zama adds a privacy layer to Ethereum and other compatible chains; Solana is planned. What makes it work is the FHE approach from Section 3. The network needs to confirm you have enough funds and update two balances, all without seeing any numbers. FHE allows directly adding/subtracting on locked boxes, producing a locked answer.
This is precisely what privacy coins cannot do. Zero-knowledge proofs can prove your own payment valid but cannot perform new arithmetic on someone else's hidden balance. FHE can.
▲ How FHE computes on locked boxes
No One Holds a Master Key
The immediate worry: a company somewhere holds a key that unlocks everything. Zama's answer is that such a complete key never exists in any single place.
Eighteen operators run the system, in two roles. Five coprocessors perform encrypted arithmetic. Thirteen key-holding parties (collectively KMS) each hold only a shard; at least nine of thirteen must cooperate before anything is decrypted. A gateway assigns tasks and checks operators agree. ZAMA token is used to pay for verifying inputs and decryption; operators also stake it as a bond, slashed for misbehavior.
▲ Who runs Zama
This is an assumption, not an incident. "No one holds the master key" rests on two conditions: no more than one-third of the thirteen key-holding nodes are malicious; and the AWS Nitro enclaves these nodes run in truly hold. The second condition is hardware trust.
A Live Example: Private Yield on Morpho
The first product using this entire stack is a savings vault. A vault is a pool: takes deposits, lends money out, pays interest to depositors.
You shield USDC into cUSDC and deposit it. It doesn't go directly in—that would expose your size immediately—but queues with others' deposits for about a day to form a batch. When the batch closes, the network decrypts only the batch's total; individual deposits remain encrypted. This aggregated amount is then deployed into the Prime USDC vault by Steakhouse on Morpho. That vault is ordinary, public, audited, with ~4% interest plus a launch reward. You receive an encrypted share of it, plus your yield.
This is not a mixer. Nothing is mixed, rerouted, or laundered through intermediaries. Money lands in a public vault anyone can check; the only hidden fact is how much each person contributed. The cost: your privacy is only as good as your batch, so the system waits until enough peers are present.
▲ Private yield on Morpho
Second Live Product: Confidential Block Trades
The vault hides how much you deposited. The next product hides how much you traded, commercially more interesting.
First, the problem it targets; this sizing is the article's strongest demand argument. Large trades don't happen on public chains; they happen on OTC desks, and the trend direction is documented: in the year to end-2025, institutional spot OTC volume grew 109%, the top 20 exchanges grew 9%, 40% of institutions list OTC as their preferred venue. The analogy to traditional markets is fair, not marketing: ~59% of U.S. equity volume already occurs off public exchanges, dark pools alone hit a record 40.3% in Q1 2026, and these venues exist for one purpose—executing large orders without showing your hand.
So the insight beneath this product is correct. We spent a decade building programmable, verifiable trading infrastructure, and institutions still negotiate block trades in Telegram groups because that's the only way not to get sniped.
Walk through the mechanism with a real trading pair, with numbers. Suppose you hold 1,000,000 ZAMA, shielded as cZAMA, and want to swap for dollars. Mid-price ~$0.25 means you're selling ~$250,000, and the token's total shielded supply is only $6 million. These numbers are round examples, not actual trades; the proportions are the point: on a public exchange, an order of this size relative to that liquidity is a gift to bots.
▲ A 1,000,000 cZAMA sale, with the dealer quotes and a table of who can read which field.
The small trick in step one is worth pausing on; it's the most clever part of the design and costs nothing. You send two transfers instead of one: the actual cZAMA to sell, plus a zero-amount cUSDC leg. Both amounts encrypted, observers see two legs of unknown size in opposite directions, unable to tell if it's a sell or buy. Hiding "which asset you're trading" works on the same principle, promised for later versions.
Before excitement, read the right column of that chart, because that's where marketing and mechanics diverge. Public front-running bots indeed cannot see your order, so sandwiches vanish. But whitelisted market makers decrypt your intent and see your size. They cannot see your direction—part of the cleverness—nor each other's quotes. The winner is then told the direction to settle. So ultimately, one professional market maker knows your entire trade, and a few know your size in real time. This is the trust shape of an OTC desk, not an anonymous venue.
Step three is what justifies the entire technology choice. Comparing two encrypted quotes and selecting the higher one without decrypting either is exactly what FHE can do and zero-knowledge proofs cannot.
Progress must be precise. It's invite-only private beta, with three pairs: cUSDT vs cUSDC, cZAMA vs cUSDC, cSteakcUSDC vs cUSDC. Public launch planned for September 2026, multi-chain after. No meaningful volume yet.
The third pair is commercially important. It lets managers enter/exit a yield vault position without unshielding or waiting for redemption periods. Rotations between strategies are where many allocators actually make money, and leaking rotations is how they lose it.
What's Actually Inside, and What That Tells You
Zama publishes shielded value composition quarterly; this breakdown is more informative than headline numbers.
▲ Zama's shielded value by asset class to 30 June 2026, with volume alongside it.
Four things stand out; only one sounds good.
Vaults are the single largest category, $18.8 million, exceeding stablecoins' $14.1 million. So the first real demand to emerge isn't private payments; it's people wanting yield without disclosing position size.
Take Zama's own token out of the token category, and almost nothing remains. Of $6.8 million, $6 million is cZAMA. A protocol shielding its own token doesn't prove market demand for shielding tokens.
Real-world assets total $52,200, all tokenized gold. Contrast this number with how often "confidential RWA is an institutional opportunity" is said, including in Zama's own launch materials.
The truly important number is next to the total. $39.6 million shielded, $452.3 million transacted in six months; money turned over ~11 times, not sitting idle. This matters commercially because a confidential dollar only generates fees when moving.
Five weeks later, the protocol's own dashboard makes this argument stronger and adds three things the June snapshot missed. As of 3 August 2026, cumulative shielded value $320.8 million, cumulative unshielded $274.2 million, meaning ~$595 million moved bi-directionally across the boundary, with net holdings ~$46 million.
Confidential dollars don't sit; they pass through. cUSDT shielded $130.8 million, unshielded $122.8 million, leaving $7.9 million. cUSDC shielded $69.7 million, unshielded $65.1 million, leaving $4.7 million. ~94% of every stablecoin dollar that ever entered has left. This is a hallway, not a vault. For a protocol that profits from money moving, this shape is right; for anything that profits from balances, it's wrong.
Money in the vaults is four wallets. cSteakcUSDC has four distinct shielded wallets, net holding $20.2 million, ~43% of all net shielded value in the protocol, corresponding to a Morpho vault holding $28.2 million. The largest, commercially most interesting category in this section is not a market; it's four institutions. Remember this when reading any growth rates—one redemption could wipe it out.
The RWA line has actually started. In June, it was $52,200 of tokenized gold. By August, cTGBP holds $5.1 million of tokenized GBP, its wrapped version another $5.1 million, gold $60,300. $10 million is still tiny but two orders of magnitude above a negligible tail, and the first real evidence for the sector's most repeated claim.
A size correction is needed; a circulating number beautifies this considerably. Zama deployed 549 contracts on mainnet. The 27,662 confidential contracts most reports cite include all public testnets dating back to July 2025; ~98% of that number are not production. Now there's also a cBRON token, twenty-one wallets, $1 million.
Why This Avoids the Island Problem
Because it sits on Ethereum, those private dollars are the same dollars others hold, able to work in apps that already have users. The privacy is still programmable—contracts can enforce rules on hidden data.
It also leaves room for compliance: auditors or regulators can be granted view keys to see specific records, and freezes on underlying assets propagate to the wrapper layer. In May 2026, a court order did exactly that, freezing the entire cUSDC pool for three days. Section 8 covers what happened.
The Ladder, and the Cost at Each Step
Reading three generations sequentially reveals a pattern none advertise.
Tornado hides your history. Railgun hides your holdings. Zama hides holdings that can still interact. Each tier exists because of the specific thing the next couldn't do.
But the cost has moved in the opposite direction. Tornado hides most but can do nothing with the money. Railgun hides sender, receiver, and amount. Zama hides only amounts; the transaction graph is fully public. Each generation bought functionality with concealment.
A second axis moves the same way, tightening the story. Tornado gave honest users no way to prove innocence; exchanges treated the whole pool as tainted. Railgun answered this precisely with Private Proofs of Innocence. Zama went further with view keys and inheritable freezes that regulators can actually use. So the trend among the three isn't privacy getting better; it's more usable, more legible privacy, with the bill paid from concealment.
▲ All six designs plotted by how much they conceal against what the money can do while concealed.
The empty space in the top-right is the interesting part. "Hide everything while running everything" is the product no one has; Zama is the latest attempt to bend the line upward. By every number in this article, it's also the smallest.
Who Else Is Climbing This Same Ladder
Zama is the one with a mainnet, so this section has focused on it. Live on Ethereum since 30 December 2025, first confidential stablecoin transfer that day, named companies using it in production, token standard ERC-7984 implemented by OpenZeppelin as an audited library, and an on-chain registry mapping ordinary ERC-20s to their confidential wrapped versions. This last detail is worth more than any benchmark: writing a confidential token becomes inheriting from an audited OpenZeppelin contract—that's how a technology sheds its niche status.
Zama won this round; what round it won is worth specifying: it launched first. That's a real achievement, and this section gave due credit. But first-launched speaks to timing, not design ceiling, and the route it validated has more than one implementation. Fhenix, Inco, and Mind Network all build confidential execution on the same cryptographic substrate, at earlier stages, none yet with a mainnet year to judge.
Two easily missed points follow. Zama's launch is good news for all of them because the category's challenge was never whether the math works, but whether anyone will pay to use it; now that question has customers attached, not predictions. The other: for such a young cryptographic primitive, having a single implementation is systemic risk, not a moat. The Orchard bug in Section 8 lay undetected in one codebase for four years. Multiple independent implementations of the same idea are how such things get caught, so the second and third names here carry value invisible in "live product comparisons."
Fhenix raised $22 million, led by Guy Itzhaki who previously headed homomorphic encryption at Intel, backed by Multicoin and Collider. It uses Fully Homomorphic Encryption, same family as Zama, not different cryptography. Multi-party computation appears within both (Zama's thirteen key holders, Fhenix's threshold service network) but only as the mechanism to shard decryption keys. The primitive actually doing the hiding is the same.
It started as an FHE Layer 2, later abandoned. Benchmarks accompanying an ACM CCS 2025 paper favored a modular design; that Layer 2 became CoFHE, an off-chain coprocessor any EVM chain can call, with EigenLayer staking providing economic security underneath. It runs on Ethereum Sepolia, Base Sepolia, Arbitrum Sepolia; its own docs state production mainnet not yet available.
It has a token standard FHERC-20 and working demos: shield any ERC-20, private payments, sealed-bid auctions, private stablecoin, on-chain RFQ, delegate encrypted balance view rights to a designated party, a front-running-resistant Uniswap v4 hook, plus two consumer gadgets. Canopy integration slated for Q4 2026, Offchain Labs invested via Tandem to bring the tech to Arbitrum.
The truly important seven lines, side-by-side.
Most of that gap is calendar, not capability, but two rows aren't. Zama and Fhenix have converged architecturally, so "no new chain, no bridges" isn't a differentiator; both let Solidity devs add an encrypted type with ~one line of code. What separates them is which bottleneck each attacks. In homomorphic systems, user-perceived latency is the decryption round trip, not arithmetic, and that's what Fhenix attacks: 64,319 ops/sec, 8.48 ms latency, published at ACM CCS 2025 and winning a Distinguished Paper Award. Zama's headline is 1,000 transfers/sec on H100, self-reported, not yet live. Lab numbers degrade in production, and they aren't even measuring the same thing, but on the only directly comparable axis, the peer-reviewed number belongs to the not-yet-live side.
The demand side is no longer hypothetical either, the more interesting development. Between 2 July and late July 2026, Fhenix announced one acquisition and three integrations; their shape is worth reading. It acquired Sunscreen, one of the earliest FHE teams, bringing compiler tech and a BFV research base parallel to its own TFHE work, with Sunscreen founder Ravital Solomon joining to lead research. Sedona, a self-custody neo-bank for trading, is migrating to Arbitrum and replacing its trusted execution environments with CoFHE, covering balances, positions, and spending caps it sets for AI agents. Nomyx, building compliant RWA issuance, uses it for confidential positions with selective disclosure: private to the market, provable to regulators. Canopy bakes encrypted computation into its app framework by default. Plus earlier Monaco research partnership, mainnet target October, on Ethereum and Arbitrum.
Three things in that list matter more than quantity. Sedona is a customer migrating out of TEEs toward FHE, the only evidence yet that this security upgrade is worth paying a latency cost for a live product. Nomyx points to Section 2's argument about regulated ledgers—what's needed there isn't concealment but disclosure at the holder's discretion. Agent spending caps are a use case that didn't exist when all this was designed; the adversary you're guarding against is your own deployed software. None of this is revenue yet; October is a target, not fact. But it's a pipeline with named counterparties, more than a pre-mainnet protocol typically has.
So look beyond the first mainnet. The category's problem was never whether the math works, but whether anyone pays; Zama now answers that with customers, not forecasts, which helps every implementation of the same idea. And for such a young primitive, a single implementation is risk, not moat; Section 8 will shortly show how costly an undetected bug in one codebase for four years can be. Meanwhile, the layer that launched first is the neutral layer, and neutral layers almost never capture money for what they deliver, so being ahead on that layer doesn't mean being where the value ultimately lands. That's why the second and third attempts are worth watching: whether confidentiality is consumed through a primitive everyone shares, or through the Layer 2 and consumer gateways Fhenix is betting on (with Offchain Labs behind it), truly isn't decided, and that decides where value in this category accumulates.
How Much Revenue Does This Sector Generate
The above covers what these designs can do. This section only covers how much they charge for it, because the answer is small, publicly verifiable, and the least scrutinized number in the sector.
Each number below is on-chain fee data as of August 2026. The last column is key: in this sector, collecting fees and earning revenue aren't the same.
Start with privacy chains; they hold almost all the sector's market cap and are the clearest examples. Monero earned $1.58 million in fees over its entire history, Zcash $1.37 million since 2016, and those are payments to miners, not revenue to any business. No entity collects them; there's no profit inside.
A circulating number needs correction; it's off by nearly three orders of magnitude. Multiple 2026 reports claimed Zcash annualized fees of $405 million, leading Ethereum and Solana. Its actual past year was $567,000. The public number appears extrapolated from a single high-activity window and coincidentally aligned with Zcash's price at the time, the more likely explanation. Using that headline to gauge sector size is off by 700x.
Tornado Cash is the most instructive row. Its users paid $9.3 million; the protocol got zero, every dollar went to withdrawal relays, and fee data explicitly shows zero protocol revenue. The decade's largest mixer created real cash flow for operators but nothing for itself—a reason it had no P&L to defend when sanctions arrived. Railgun is the counterexample and the only real business in the table, charging 25 bps on each boundary into its treasury. Against $5.16 billion cumulative volume, $13 million implies ~9 bps realized, vs. 50 bps nominal. That gap itself is a clue: money shields once, moves inside for free, pays only on entry/exit.
Summed, the entire sector's annual revenue is ~$6–7 million across all protocols, while value parked in these assets is ~$25 billion. Two-thirds of this flow goes to Railgun and Tornado's relays. The chains holding nearly all market cap collectively charge ~$2 million annually.
Moving to the table's lower half, Zama is the interesting one: it does charge, but on a completely different meter. It doesn't take a percentage of anything; it charges per operation, priced in dollars per bit—verifying a proof on encrypted inputs, decrypting a ciphertext, bridging it once. Homomorphic computation itself is free; deploying an app is free and permissionless.
Put numbers to that difference using its own traffic. In seven months since 30 December 2025, the protocol processed 104,848 mainnet transactions across 549 mainnet contracts, while $320.8 million was shielded and $274.2 million unshielded, ~$595 million moved across the boundary, average single shield ~$24,000.
On Railgun's fee schedule, this flow would generate $1.49 million. On Zama's published price list, it generates $840 to $84,000, likely in the lower half because rolling 30-day discounts push heavy users below one cent, and this traffic is concentrated enough that the largest payer gets the deepest discount. In fee terms: a $24,000 shield costs thirteen cents, one-fiftieth of a basis point; Railgun charges 25 bps. 18x to 1,700x less, depending where the real number falls in the range.
To be clear, this number is derived, not disclosed. Transaction count is on the protocol's dashboard. Thirteen cents is the launch news figure; the simplified whitepaper price list puts a confidential transfer at eight-tenths of a cent to eighty cents, depending on operation mix. So the range matters more than any point estimate, and the argument doesn't need a point estimate—every reading of the public price list lands in the same place. Incidentally, the exact figure is knowable: every protocol fee is burned; cumulative burn at that address is the observable version, checkable by anyone.
Why So Cheap
The most straightforward read is Zama mispriced itself. The more likely read is it's buying customers now, charging later, and evidence points to the latter, not an oversight.
A layer taking 25 bps is a tax on every integrator, and Zama wants to be the privacy layer others build on, not a venue competing with them. Pricing like cloud service buys your token standard implemented by OpenZeppelin as an audited library, a wrapper registry, integration paths with wallets/exchanges, and a payroll company willing to run salaries atop you. None of those buyers would cross a 50 bps tollgate. Bron won't pay 25 bps to hide a payroll run, and the four wallets holding $20.2 million in that vault won't pay it to rotate a position.
So this low fee is doing work. It's buying what's truly scarce at this stage: reference customers and a standard others will adopt, pushing revenue to the day volume justifies a small fee. On this read, current fees are customer acquisition cost, not a business; the number to watch isn't this year's fees but whether that meter ever changes.
Two things make this reading falsifiable, not just generous. Fees can be raised without touching cryptography: at today's volume, $5.65 per transaction earns $1 million annually, still ~10x cheaper than the incumbent on a bps basis. And value is accumulating somewhere during this time: one layer up, to those running venues, not the neutral rails underneath, which is why RFQ matters more to Zama's economic model than the protocol itself.
What Vulnerabilities Have Privacy Tech Had
It's easy to write about privacy tech as if it all works. Three incidents are worth knowing, each failing in a different place: the cryptography itself, the software wrapping it, and the law overriding both.
▲ Nine years of privacy failures, grouped by which part of the stack gave way.
Zcash: The June 2026 Orchard Bug, and the $3 Billion It Cost
Start with the most recent, because it's the single largest destruction of value in the sector and explains a market move many remember but didn't understand.
On 29 May 2026, security researcher Taylor Hornby (commissioned by Shielded Labs in April) found a soundness flaw in the circuit behind Orchard. Soundness is the property that makes a zero-knowledge proof valuable, guaranteeing you cannot produce a proof that appears valid for a false statement. With this flaw, you could. Hornby built a working exploit, minting unlimited fake ZEC in test environments, completely undetectable.
The flaw had been in that circuit since Orchard launched in May 2022. Four years, multiple professional audits, no one found it. He found it with the help of an AI model (Claude Opus 4.8) and custom analysis tools. That's the genuinely fresh fact here. The audit process that repeatedly cleared this code was human; what finally broke through wasn't.
The engineering response was swift. An emergency soft fork on 2 June disabled Orchard operations at a designated block height. A permanent fix via a hard fork with corrected circuit went live 3 June. No chain split, no funds lost.
Then the market took over. Public disclosure came 5 June. ZEC actually rose before the announcement, ~$544 to $624, reasoning that a clean emergency fix signals rigorous engineering. Once substance landed, it fell to ~$309 within 48 hours, ~50% drawdown, taking over $3 billion in market cap with it. Arthur Hayes publicly exited on 4 June, arguing privacy assets need perfection, not "probably fine," triggering forced liquidations among leveraged holders. Monero fell ~13% in sympathy, so the market read this as a Zcash problem, not a privacy problem.
Now for the part that should worry you, and it's not this bug. Shielded Labs stated plainly that cryptography alone cannot determine whether it was exploited before discovery. This isn't evasion but a direct consequence of design. A shielded pool hides counterfeits as well as it hides payments, so a four-year window of potentially undetected inflation cannot be closed by looking at the chain. Their remedy, now live as Ironwood, does gatekeeping accounting for every Orchard coin, making supply independently verifiable.
For newcomers, this is the most important idea in this section. The privacy-vs-auditability tension plays out at the level of the money supply itself, not just "who paid whom."
Was it actually a bug? Three questions often conflated have three different answers.
Was there a real bug? Yes, serious. When you spend hidden money on Zcash, you don't show coins to the network. You hand it a mathematical receipt proving you own them and aren't double-spending. The bug was in that receipt verifier, which would accept some fake receipts. That means printing ZEC out of thin air.
Was it used to steal anything? Almost certainly not. A researcher hired specifically to find such problems discovered it, verified it on his test copy, and it was patched two days later. No known person touched the live network with it.
Can anyone prove it wasn't used in those four years? No. On an open chain you can count coins; too many coins means someone counterfeited. Zcash's shielded pool deliberately makes coins uncountable because that's the product. So the honest answer: no evidence it was used, and that cannot be upgraded to proof it wasn't.
That leaves the obvious question: no money lost, why did the price halve? Because ZEC's entire proposition is that the math is airtight, and "probably fine" and "airtight" are two different products.
Worth knowing this is the second counterfeiting flaw of this category, the first being in Zcash's original proof system in 2018. Two different proof systems, eight years apart, same shielded pool design, and twice the chain couldn't tell you if they were used. That's pattern, not bad luck. Another layer of irony: Orchard existed because trusted setup was seen as Zcash's biggest unresolved risk, and Halo 2 was adopted specifically to remove it. The pool built to not need trust is precisely the one that later proved unsound.
Zcash: Wallet Leak, and the More Typical Failure
This one is smaller but more representative of failures in this section.
October 2025, investigator ZachXBT tested the cross-chain swap function in Zcash's main wallet Zashi, which routes via NEAR Intents. He swapped Solana to Zcash, then transferred out ETH. An unexpected 0.001598 ZEC refund arrived at his transparent address, fully public. NEAR Intents at the time processed refunds via a visible Zcash address instead of the shielded pool, and the wallet reused the same transparent address every time. Matching time and amount, you could deanonymize someone's transparent address and link it to their shielded activity.
Nothing stolen, no cryptography broken. The proofs were fine. The integration wrapping them had a problem.
Be precise about the fix, because it's only half done. Swaps now generate a one-time transparent address per transaction using a standard called ZIP 320, so no long-lived address accumulates history. Shielded swaps were announced on Zcash community forums 17 November 2025, about a month post-disclosure. The second promise, routing refunds themselves within the shielded pool, has no public confirmation: a user directly asked in the same thread on 20 November 2025, got no response, and wallet support docs still ask for a refund address without specifying if it must be shielded.
And there's a residual leak no fix removes. Sending shielded funds to a one-time transparent address requires two public transactions, one unshield and one spend-down, and for any single swap, observers can still match them by time and amount. What the one-time address buys you is that no one can link multiple swaps together or to the rest of your wallet.
Zama: No Exploited Bug Yet, but the Most Instructive Failure
It hasn't had a protocol vulnerability exploited, and for something that launched in 2026 after ~70 audit-weeks, that's what you'd expect. Zama's encounter was a legal failure, and it's the one you should put in front of any institution considering this product.
On 30 May 2026, 01:08 UTC, Circle blacklisted Zama's cUSDC contract on Ethereum, freezing 12,606,386 USDC. The trigger was a temporary restraining order issued by a U.S. district court the day before, in a civil lawsuit alleging that a founder of an unrelated protocol, Overnight Finance, transferred over $15.77 million from its treasury just before a holder vote to liquidate, and deposited $12.4 million of it into cUSDC the same day.
Now for the part that should make potential users pause. cUSDC is a pooled contract. Blacklisting it locked every depositor, not just the contentious address, and the contentious funds happened to be over 99% of the pool. On 1 June, a judge in the Northern District of California vacated the order, and ~$12.5 million was released. This is believed to be the first instance of a contract-level Circle blacklist being overturned via litigation in a private civil dispute.
Both readings are correct, and you need to hold both. The compliance hooks are real, and that's why a regulated entity would touch this product. And they are indiscriminate, and that's the price you pay for "privacy a court can still reach into." A shared pool isn't just a shared crowd; it's a shared fate.
What These Three Incidents Share
None involved someone breaking cryptography and stealing money. The Orchard flaw was patched before disclosure and never used, yet cost holders over $3 billion, so if you hold a privacy asset, you're shorting news of a bug, not the bug itself. The swap leak was an integration detail, not proof failure. The freeze came from a court, something no audit catches.
And that points to the same conclusion the rest of this article repeatedly reached: the math itself held; the software wrapping it and the law overriding it did not.
So What's It Actually Worth
All above is settled fact. What follows is judgment and three debatable questions.
The field has many names, and people often categorize them by cryptography, which provides almost no useful information. Categorize instead by their position in the tech stack, because that determines the client and how this thing makes money.
▲ The privacy sector as four layers plus two groups that cut across all of them.
Question One: Is the Demand Real?
Yes, and it's the strongest part of the entire argument.
J.P. Morgan didn't run Project EPIC as a hobby. Encrypted fund subscriptions, blind pool auctions, delivery-vs-payment on hidden numbers, identity checks on encrypted data, designed so the bank itself couldn't see details. Then it launched its real deposit token on Canton. Circle tested a private USDC on Aleo. Coinbase absorbed the Iron Fish team. Goldman Sachs and BNY Mellon stand behind Canton. This isn't a narrative; it's a pattern of capital expenditure.
On the trading side, losses are quantified, not asserted. A sandwiched swap pays 0.3% to 0.8%. Every position on perp venues is public, including its liquidation price. And the clearest evidence: institutions move over half their trades off-screen and pay spreads precisely to keep size from being seen.
Question Two: Does Privacy Actually Lower Risk?
It lowers the risk of being selected as a target. Predators pick victims from what they can read, so hiding balances takes you off the list. This is real and the strongest claim privacy can make.
It does nothing against being compromised. A stolen key empties an encrypted balance as fast as a public one. Malware, a wrong signature, a hacked frontend: encryption protects the ledger's content, not your device or judgment.
And it actively makes recovery worse. Monero's own community couldn't trace a stolen crowdfunding wallet because Monero works as designed. Privacy is asymmetric in time: it protects you before the attack; it protects the person who robbed you after.
At the protocol level it's worse because privacy blinds the defense too. On a transparent chain, an exploit manifests in the supply within days. The Orchard soundness flaw lay undetected for four years precisely because of this. More privacy machinery also means larger attack surface: thirteen key holders, five coprocessors, a gateway, threshold assumptions, and AWS enclaves underpinning the whole thing.
Question Three: How Do You Price It?
This is the question the sector evades, and it has a real answer. Privacy's value equals the cost of the leak. Three categories are calculable.
Execution slippage is the cleanest. A sandwiched swap loses 0.3% to 0.8%, so eliminating it on $1 billion annual flow creates ~$5 million value; you can then debate capture rate. Railgun provides the only real datapoint: $13 million cumulative revenue on $5.16 billion volume implies it captured ~9 bps.
Market impact on block trades is already priced, and this is underrated. Institutions pay spreads to OTC desks precisely to not show size. That spread is the observable market price of privacy, paid today on most institutional trades. The addressable market for confidential trading isn't speculative; it's the existing OTC spread pool.
Alpha decay from copy-trading is real, and no one has published a number. Calculating it requires performance differences between tracked vs. untracked addresses running similar strategies. Label directly as not measured, not pretend-known.
Now apply this method to the obvious next product. If Zama builds a confidential AMM, how much is hiding a position worth? One constraint changes the answer: AMMs need public reserves for price discovery. Encrypt the pool's holdings, price discovery breaks. What can be hidden is individual LP shares and an order's size at submission.
That means a confidential AMM's value is mostly order flow privacy, not position privacy, bringing us back to the first category: basis points saved on execution. Hiding LP positions does have value, but smaller, mostly preventing active strategies from being copied and instant liquidity from squeezing your fees. So valuation is the sandwich tax on attracted volume, times a capture rate near Railgun's 9 bps. At $1 billion annual volume, that's single-digit millions in protocol revenue. Real, but far from multi-billion-dollar valuations.
There's a fourth category, and the live products precisely sit in it. Some leaks have no transaction to meter.
Look at what actually appeared on mainnet in the first seven months, because it's not what the sizing above predicts. Bron's finance head paid company salaries using confidential USDT. Raycash launched a Revolut-shaped account with IBAN, card, yield, keeping balances private. GSR executed the first confidential institutional OTC trade in March 2026, two KYC'd counterparties, amount encrypted on-chain. TokenOps does confidential unlocks/airdrops, Zaiffen converts ordinary ERC-20 to confidential, and Zama used both for its own token. Elliptic integrated for compliance screening in July 2026.
Only GSR fits the bps story. The rest are businesses buying "an item of information not disclosed," and the harm avoided doesn't scale with the size of the transfer carrying it. A payroll leak costs your team knowing each other's salaries, competitors knowing your burn rate. Publishing an unlock schedule costs you getting front-run on your own unlock. These are fixed harms attached to a fact, not proportional losses attached to a payment.
This affects pricing, not demand. Demand in this category is broader than the trading thesis, and it's less suited to per-transaction pricing than any of the first three. And that's precisely what the fee data shows.
Remaining Unresolved Debates
Is privacy a chain or a feature? As of July 2026, evidence splits along an axis people often confuse. The feature side wins on new use cases: sealed quote trading, private vaults, payroll. The chain side wins on price: Monero ~$12.9 billion, Zcash ~$7.1 billion, Zama $115–142 million. Two different markets, two different buyer types.
Is optional privacy a trap? It creates a small crowd, and a small crowd is weak privacy. That was Zcash's decade-long flaw. What changed is the least glamorous thing imaginable: not cryptography, but a wallet. From February 2024, Electric Coin Company built Zashi, private by default, all three pools behind one address, and swap functionality made buying shielded ZEC a few clicks. Shielded supply share rose from ~5% to the twenties, nearing 30%; shielded transaction share rose from ~30% to a reported 59.3% peak. Then ECC CEO Josh Swihart stated causality plainly: after Zashi, shielded pools grew exponentially. Timeline matches.
A lurking issue here is governance, not technical. In January 2026, the entire Zashi team resigned from ECC over governance, funding, and autonomy issues, forming Zcash Open Development Lab, and renamed the wallet to Zodl in February 2026. So the sole piece of software that boosted Zcash's privacy adoption is no longer built by the foundation managing the protocol.
Is compliance-friendly privacy actually privacy? Critics say a privacy system with an override switch is a queue, not a privacy system. Supporters say it's the only version institutions can legally touch, and the alternative's endpoint is Tornado Cash's fate. Both are right. They're selling to different clients, and both exist.
The regulatory clock. EU AML rules (specifically Regulation 2024/1624, Article 79) take effect 1 July 2027. From that day, crypto service providers cannot hold anonymous accounts or handle privacy assets like XMR, ZEC, supervised by a new agency, AMLA, overseeing ~40 largest providers. Read scope carefully: this bans trading venues from touching those assets. It does not stop those chains. It drains regulated liquidity in Europe, and the second-order effect pushes the market toward auditable privacy.
What Metrics to Watch
Four numbers, quarterly.
Volume on confidential trading venues, from counterparties unaffiliated with the protocol. Post-September launch, this is the number deciding if the trading thesis holds, because swap fees buy back ZAMA, and volume is cash flow. A venue with no strangers on the other side is just a way to talk to yourself privately.
Railgun revenue vs. Zama's. The incumbent already captures ~9 bps on real flow. If Zama cannot approach that within a year of public launch, no one is paying the FHE premium.
The first company outside crypto paying salaries or suppliers via confidential stablecoin. Note cUSDC hides amounts, not supplier lists, so this use case needs more than encrypted balances to truly run.
Canton Coin fee revenue, if it ever becomes auditable. A $4.8 billion token built on usage no one outside can verify is the sector's largest unscrutinized valuation.
Zama's realized fee burn, in USD. Every protocol fee is burned, so cumulative burn is on-chain, the only indisputable measure of whether anyone is actually paying. It's currently four figures; predictions are ten figures. The month it moves an order of magnitude signals pricing has changed, the single most informative number here.
Will four wallets become forty. Forty-three percent of net shielded value sits in four addresses in one vault. Decreasing concentration matters more than rising total.
Will anyone start charging subscription, not per-meter. The gap documented is a pricing gap, so the first confidential product priced per seat, AUM, or spread matters more than the next cryptographic benchmark.
Fhenix's mainnet timing, and whether its rollup is built on cryptography it owns. These two answers decide if the FHE category is one company or several.
Conclusion
Three answers to one question, and the honest summary for all is a trade-off, not a victory. Every design in this article bought the ability to do more by exposing more, and the corner "hide everything while running everything" is empty.
Demand is real. A bank spent real money proving it, traders lose measurable basis points, and institutions already route most trades to venues whose entire product is "don't show your size."
But privacy is not a security upgrade. It changes who picks you as a target and makes recovering funds harder, and at the protocol level, it hides the defects of the very thing you're trusting.
And valuations don't match revenue. ~$25 billion value sits in privacy assets across Monero, Zcash, and Canton Coin. On the services side, numbers are now precise, not approximate, and they're under single-digit millions. Railgun, the best of them, charging 25 bps on each boundary, historically collected $13 million, while Monero and Zcash together earned $3 million in fees since 2014 and 2016. Zama processed 104,848 mainnet transactions, moved $595 million across its boundary, and because it charges per bit not per basis point, on the published price list, it earned between $840 and $84,000. Running Zama's traffic through Railgun's fee schedule yields $1.49 million, i.e., 18x to 1,700x more, depending where the real number lands. In fee terms, one-fiftieth of a basis point vs. 25 bps.
So the opening dilemma is resolved, and the answer is better than any of its corners. These services are underpriced not because no one wants them. They're underpriced because the meter is attached to the wrong thing. A protocol charging per bit hides a $20 million vault position and a $10 transfer for the same fee, and currently four institutions collectively hide $20 million for a few cents.
That's why I end bullish, but with a qualifier on "bullish on what exactly."
Demand is validated, not predicted, rare this early. A bank spent real money establishing encrypted finance works, then launched its real deposit token on a rail it built. Institutions route most trades off-screen and pay spreads for the privilege. Dark pools took a record 40.3% of U.S. equity volume in Q1 2026. Money already moves privately everywhere it's allowed, and the only question public chains need to answer is whether they can offer the same cover without surrendering the programmability that made them worth using in the first place. As of August 2026, one of them does, in production, with real companies, $595 million across the boundary, money turned over eleven times.
Technology also isn't the constraint anymore, the silent change of the past year. Confidential tokens have a standard and an audited OpenZeppelin implementation, so writing one is now inheritance, not cryptography. A court order pierced the wrapper layer and was vacated in three days—a compliance feature discovered the hard way, not a failure. And regulation arriving 1 July 2027 drains European liquidity from anonymous assets while pushing everything toward the kind of auditable privacy these designs happen to provide. The parts are in place, and the clock is running in their favor.
What's missing is a price, and a missing price is the easiest problem to solve here. Charging $5.65 per transaction instead of thirteen cents earns $1 million annually at today's volume, still undercutting the incumbent tenfold. This needs no improvement in math. Only someone charging for concealment the way it's charged for elsewhere, per seat, subscription, or basis points of AUM, and the first customers arriving are companies whose procurement departments expect an invoice shaped exactly like that.
So the position is long demand and long whoever ultimately charges for it, and by current evidence, that's trading venues, wallets, or authorized businesses, not the neutral layer underneath. Test it with four numbers: post-September volume from strangers, the dollar value of fees actually burned, whether the four wallets in that vault become forty, and the date someone mails the first privacy subscription invoice. The buyer with a budget line item is a bank, not a cypherpunk, and the encouraging part of all this is that bank has already started shopping.
