Why Is Ethereum Hiring 50 People for Privacy? The 2029 Strawmap That Changes DeFi

The Ethereum Foundation has just hired 50 people for a single objective: to ensure that transactions on the L1 stop being an open book. Because institutions are not going to settle trillions of dollars on a network where their competition can see every operation in real time. Privacy is not a nice-to-have: it is the final roadblock between Ethereum and mass institutional adoption.

Why is the Ethereum Foundation building native privacy in 2026?

Radical transparency was Ethereum's foundational virtue. It has also become its greatest obstacle to institutional adoption. For an investment bank, an asset manager, or a corporate treasury, the public visibility of every transaction, balance, and contract logic is not an audit feature — it is an operational and fiduciary risk that prevents the deployment of large-scale capital.

Consider the most basic scenario. A corporation pays its chip supplier $4.2 million in USDC on the first of every month. That transaction is visible to every competitor, every data broker, and every malicious actor on the planet. Within weeks, the competitor has deduced unit costs, identified the supplier relationship, and begun undermining the deal. On traditional banking rails, this information would require a court order. On Ethereum, it requires an Etherscan URL.

The traditional financial industry operates under the assumption of privacy by default: records are private but auditable for competent authorities. The transition toward blockchain requires a synthesis where systems remain verifiable and open, but reveal only strictly necessary information. This demand has led the Ethereum Foundation to formally recognize that institutional privacy is not an ideological luxury but a functional entry requirement.

In October 2025, the EF formalized its commitment by creating a Privacy Cluster coordinated by Igor Barinov, with approximately 50 specialists divided into two operational arms: Privacy & Scaling Explorations (PSE), active since 2018 with over 50 open-source projects, and the Institutional Privacy Task Force (IPTF), which translates regulatory and institutional requirements into technical specifications. This is not an academic research group. It is an implementation unit with a production mandate.

Table: Risks of total transparency for financial institutions on Ethereum.

For an in-depth analysis of how MEV Era III exacerbates this problem with protocol-level value extraction, see our dedicated analysis.

What are "shielded transfers" and how will they work on Ethereum?

Shielded transfers are transactions where the sender, recipient, and amount remain hidden from external observers but are mathematically verifiable by the protocol. It is not a new concept — Zcash implemented them in 2016 — but integrating them into Ethereum's base layer represents an engineering challenge of a completely different magnitude.

Strawmap 2029 proposes two complementary mechanisms to achieve this.

Gated Shielded Pools: Privacy with Compliance

The IPTF has presented a proof of concept for private stablecoin transfers that prioritizes regulatory compliance. Unlike consumer privacy protocols that maximize anonymity, this design integrates privacy as a feature of the compliance architecture.

The system uses attestation-gated entry. Before a participant can deposit tokens, a compliance authority must issue a KYC attestation stored in an on-chain Merkle tree. Upon depositing, the user proves via a ZKP that their public key is listed in said tree — confirming their verification without revealing their personal identity on-chain.

Within the shielded pool, funds exist as "notes" encrypted under a UTXO model. Each note contains the token address, amount, owner's public key, and a random salt. The architecture employs a dual-key system:

• Spending Key: Authorizes the movement of funds. The user maintains exclusive control.
• Viewing Key: Allows the decryption of transaction history without granting the power to move funds. A regulator can hold this key to audit specific transactions, complying with AML/CFT without exposing data to the public or competitors.

EIP-7503: The Burn-to-Remint Protocol

The EIP-7503 proposal represents a paradigm shift. Unlike Tornado Cash, which requires interacting with an identifiable mixing contract (creating a "red flag" for compliance analysts), EIP-7503 proposes a "burn and remint" mechanism that offers plausible deniability.

The protocol works in five steps:

1. Burn: The user sends ETH to an address with no known private key. On-chain, it looks like an accidental loss of funds — a common and non-suspicious activity.
2. ZK Proof Generation: The user generates a zero-knowledge proof demonstrating they are the owner of the burned funds without revealing their original address.
3. Submission: The proof is sent to a smart contract that verifies it.
4. Mint: The contract issues an equivalent amount of new tokens to a fresh address.
5. Unlinking: The link between the burn address and the destination address is mathematically broken, creating an anonymity set that encompasses all Ethereum addresses with ETH that have no outgoing transactions.

This approach is harder to sanction because the initial step is indistinguishable from a normal transaction. There is no "mixer" contract to flag. There is no list of addresses to sanction. Privacy emerges from indistinguishability, not obfuscation.

What is the difference between stablecoin privacy (Payy) and L1 privacy?

Privacy in the Ethereum ecosystem operates at two distinct layers with complementary but technically independent goals.

Payy Network represents the application layer approach: a ZK-Validium L2 that builds privacy as a service on top of existing Ethereum infrastructure. With 100k users, an annualized volume of $130M, and integrated Proof of Innocence, Payy demonstrates that stablecoin payment privacy is technically viable today. However, it depends on its own network, its own consensus (HotStuff BFT), and its own off-chain data availability.

L1 privacy, by contrast, is a property of the base protocol. When shielded transfers become native to Ethereum, any application — from Aave to Uniswap, from tokenized bond settlements to corporate payroll — will be able to operate with confidentiality without needing a separate network. The difference is that of an application VPN versus operating system-level encryption.

Table: Comparison between application-level privacy (Payy) and native L1 privacy.

Both approaches are necessary. Payy solves the problem today for stablecoin payments. L1 privacy solves the problem forever, for everything. But "forever" is three years away — and institutions cannot wait.

Can institutions use DeFi if all transactions are public?

The short answer is no — at least not at scale. And the institutional pilots of 2025-2026 demonstrate this clearly.

J.P. Morgan, through its blockchain unit Kinexys (formerly Onyx), pioneered the use of tokenized deposits. But it did not do so on Ethereum mainnet. It used Canton Network, a privacy-enabled blockchain, and Base, Coinbase's L2. The reason is explicit: the compliance departments of systemic banks cannot accept that their settlement flows are visible to the world.

Project Guardian, led by the Monetary Authority of Singapore (MAS), tested Aave Arc and Uniswap on Polygon for institutional tokenization. The fundamental lesson: institutions require "trust anchors" to interact only with verified counterparties. This led to the development of Aave Horizon, an institutional version that supports real-world assets (RWA) while maintaining asset-level compliance.

Goldman Sachs adopted a multi-platform strategy, reporting an exposure of $3.3 billion in digital assets by the end of 2025. Regulatory clarity in 2026 will be, according to the bank, the primary catalyst for the deployment of institutional capital into DeFi.

Table: Institutional exposure to crypto assets at the end of 2025. Source: public reports.

The Kendrick institutional thesis regarding ETH at $40,000 explicitly depends on institutions migrating from pilots on private networks to the public L1. Without native privacy, that migration does not happen. For a direct comparison of how Ethereum positions itself against its main competitor in this context, see our analysis of Solana vs Ethereum in 2026.

How is privacy combined with regulatory compliance (AML/OFAC)?

This is the question that defines the future of privacy on blockchain. And Ethereum's answer is fundamentally different from that of Tornado Cash.

The IPTF Gated Shielded Pools design integrates three complementary compliance mechanisms:

KYC Attestation Entry. No participant can deposit tokens without a compliance authority having issued a verifiable attestation. The attestation is stored in an on-chain Merkle tree, and the user proves via ZKP that their public key is in the tree — without revealing their identity within the verified set.

Viewing Keys. A regulator or auditor can hold the viewing key of a specific participant and access their full transaction history within the pool — without being able to move funds and without other participants losing their privacy. This satisfies AML/CFT monitoring obligations without creating a public database of financial movements.

Proof of Innocence (PoI). A ZK circuit that allows for the cryptographic demonstration that an account's funds do not originate from OFAC-sanctioned addresses or international blacklists — without revealing the full transaction history, balance, or counterparties. Verification is mathematical, not based on trust in an intermediary.

The combination of these three mechanisms creates what the EF calls "rational privacy": a system where confidentiality is the default state, but auditability is available under predefined and verifiable conditions. It is not absolute privacy (like Monero). It is not absolute transparency (like Ethereum today). It is privacy with mathematical backdoors — not trust-based backdoors.

This approach has direct implications for the physical security of holders. As documented in our analysis of physical attacks on holders in France, the exposure of on-chain balances has fueled a wave of kidnappings and extortions. L1 privacy does not just protect institutions — it protects lives.

What is the realistic roadmap: 2026, 2027, or 2029?

Strawmap 2029 is not a single launch. It is a sequence of seven forks that progressively build the infrastructure necessary for native privacy.

Table: Ethereum's Strawmap 2029 roadmap.

The Strawmap redefines Ethereum under five "north stars":

• Fast L1: Reduction of finality from 16 minutes to seconds. Block times from 12 to potentially 2 seconds.
• Gigagas L1: 10,000 transactions per second on the base layer via zkEVMs and real-time proof generation.
• Teragas L2: 10 million TPS on Layer 2s through PeerDAS (data availability sampling).
• Post-Quantum L1: Hash-based cryptographic schemes to protect against the quantum singularity.
• Private L1: Natively shielded ETH transfers. Privacy as a protocol property, not an external application.

The reality is that 2029 is the optimistic horizon for full L1 privacy. But intermediate improvements — especially Glamsterdam in H1 2026 with ePBS — are already beginning to reduce the attack surface of MEV and censorship, which are indirect forms of privacy violation.

In the meantime, application-layer solutions like Payy, Railgun, and the IPTF Gated Shielded Pools fill the gap. Institutional privacy on Ethereum will not arrive all at once in 2029. It will arrive gradually, fork by fork, layer by layer.

How does privacy affect the thesis of Ethereum as a "global settlement layer"?

The thesis of Ethereum as a global settlement layer depends on a simple premise: that institutional capital prefers to settle on Ethereum over any other infrastructure. And that preference depends on four factors — liquidity, security, credible neutrality, and operational privacy. The first three are already resolved. The fourth is what determines whether the thesis materializes or remains an eternal promise.

Ethereum concentrates more than 66% of total DeFi TVL. It has been operating for nearly a decade without mainnet failures, with $92 billion in economic security via staking. Its credible neutrality — the absence of a central actor who can censor transactions or modify rules unilaterally — has no equivalent in the blockchain ecosystem.

But without privacy, that liquidity is a double-edged sword. Institutions see $92 billion in security and also a global ledger where their operations are exposed. Ethereum's TVL is an invitation and a warning at the same time.

The convergence between TradFi and DeFi is reconfiguring capital flows. Stablecoins, with a projected growth toward $300 billion in capitalization, are becoming the backbone of global payments. But corporations and institutions will not integrate blockchain into their core operations as long as every transaction is an involuntary press release.

Vitalik Buterin has articulated this clearly. He has donated funds to encrypted messaging projects like Session and SimpleX, and advocates for local LLM models to protect personal privacy. His vision for Ethereum is not just institutional — it is civilizational: that users regain computational sovereignty, moving from centralized services toward decentralized and encrypted alternatives. L1 privacy is the component that unites both visions.

What technical and political risks does Ethereum face when introducing privacy?

Implementing native privacy on Ethereum is not just an engineering challenge. It is a political, regulatory, and technical minefield where every design decision has potentially irreversible consequences.

Technical Risks

Computational cost of ZKPs. Zero-knowledge proof generation remains resource-intensive. For shielded transfers to be practical on L1, the cost of generating and verifying proofs must be reduced by orders of magnitude. The intermediate forks of 2027-2028 with native zkEVMs address this problem, but the timeline is aggressive.

Protocol complexity. Every new cryptographic primitive adds attack surface. ZKPs, FHE (Fully Homomorphic Encryption), and TEEs (Trusted Execution Environments) are technologies at different stages of maturity. Integrating them into a protocol that manages over $400 billion in value requires an unprecedented level of auditing and testing.

Anonymity set fragmentation. Privacy works by numbers. If only 1% of Ethereum transactions are shielded, the anonymity set is too small to offer real privacy. Privacy must be the default state, not an option — otherwise, choosing privacy is itself a signal.

Political and Regulatory Risks

The Tornado Cash precedent. The U.S. Treasury's sanction of Tornado Cash in 2022 demonstrated that regulators can and will act against privacy protocols. Although EIP-7503 is designed to be harder to sanction (there is no identifiable "mixer" contract), political risk persists. A change in administration or a national security event could accelerate restrictive regulation.

Competition from specialized networks. Midnight (Cardano) positions itself as a privacy layer for institutions with "rational privacy" — selective disclosure to auditors without public exposure. If Ethereum takes until 2029 to implement native privacy, institutions could build infrastructure on competing networks that solve the problem sooner.

Internal resistance. Not all of the Ethereum community is aligned with native privacy. On-chain analysts, blockchain forensics firms, and certain regulators depend on total transparency for their business model. The transition to privacy by default affects specific economic interests.

Table: Confidentiality technologies for Ethereum — comparison of advantages and limitations.

Conclusion

The Ethereum Foundation's bet on institutional privacy is an acknowledgment that the network must evolve or lose its position as the dominant financial infrastructure. The creation of a team of 50 specialists and the Strawmap 2029 roadmap indicate that privacy has ceased to be an optional feature and has become the pillar that will determine Ethereum's survival as a global settlement layer.

Technologies are maturing. Gated Shielded Pools demonstrate that privacy and compliance are not mutually exclusive. EIP-7503 offers plausible deniability without creating sanctionable "mixer" contracts. The Kohaku project eliminates metadata leaks at the wallet level. And institutions — from J.P. Morgan to Goldman Sachs — are already deploying capital in privacy infrastructures adjacent to Ethereum.

The trajectory toward 2029 suggests a future where native shielded transfers will allow value to move with the speed of digital light and the security of military-grade encryption, without sacrificing the credible neutrality that has defined Ethereum since its inception. In this new paradigm, privacy is not a veil for illegality — it is the necessary armor for global-scale trust to flourish on a shared digital infrastructure.

The success of this transformation will determine whether Ethereum consolidates itself as the definitive settlement standard of the 21st century, or if it yields that role to networks that solved privacy first.

Related Reading