Kohaku: All You Need To Know About Ethereum's Privacy Push

Reading time: 6m 24s

Not many people know this, but the Ethereum Foundation (EF) is older than Ethereum itself. The foundation was founded 11 years ago as a Swiss non-profit on July 14, 2014, in Zug, Switzerland, while Ethereum as a product came online a year later. 

Fast forward to today, the foundation is at the center of discussions everyone should be paying attention to. 

The main topic of conversation: Why is everyone leaving? 

Vitalik has provided a convenient answer for this part. The Ethereum Foundation is just one node of Ethereum with a defined purpose, and this is no more than what can be traced back to a 2025 restructuring and the “Lean Ethereum” strategy, which deliberately shrank the EF's actual work.

For perspective, Lean Ethereum wants extreme scalability (a 1 million TPS “Beast Mode” built on real-time zkVMs), quantum-proof “Fortress Mode” cryptography via hash-based signatures, and a hard technical-debt purge that strips out legacy code to make the protocol verifiable and finally ossifiable.

Next is the more fundamental question on the minds of those who have not simply decided to FSH their ETH bag like Bankless. 

What is next for Ethereum? If it is privacy, what’s that really about, and what’s been done so far?  

As usual, we have decided to dig deep, and in the next few paragraphs, we will get into what Ethereum is focusing on and why it all ultimately ties back to privacy. 

What is CROPS?

A good place to start is the renaissance Ethereum is currently undergoing. 

Recently, the EF re-anchored itself to the four things the cypherpunks cared about in the first place, summed up:

• Can you transact without being censored? Is the code open, are you private, and are you secure?

The acronym CROPS stands for censorship resistance, open source, privacy, and security.

Ethereum Foundation considers these the core principles for the formation of Ethereum and has decided to focus on achieving them in practice, exiting the philosophical and theoretical back-and-forth. 

As a matter of fact, there are reports that those working on Ethereum were asked to sign a pledge aligned with these values. 

However, two of those four focus points are where the EF is aiming its firepower: privacy and security. But before we go into how the EF is approaching privacy, let’s refresh your memory on what crypto’s privacy debate is all about. 

Getting into the privacy weeds

Ethereum docs put it a bit more succinctly: every onchain action is visible to anyone who looks.

This is true. Transactions aren’t exactly private on Ethereum. While addresses do not bear your name (except when you’re doxxed by an ENS), your address can still be traced back to you if people look hard enough. 

But this is only the surface level. Ethereum’s privacy problem, or crypto’s privacy issue, extends beyond your address and into other layers. 

The centralized RPC logs your IP and location, the public mempool broadcasts your trade to front-running bots, and the dApps and analytics scripts fingerprint your device.

All of these are ways users are exposed. An exposed user is susceptible to attacks by malicious actors, surveillance, and other threats that take away their freedom.

To solve this problem, the EF launched an approach to tackling privacy. It’s a concerted effort together with a few other platforms to build something that’s more than a bolt-on fix, and that can potentially solve the privacy problem from a foundational approach. 

What is Kohaku? 

Kohaku is Ethereum’s user-led strategy for privacy, featuring an open-source SDK, a reference wallet, and tools that allow developers to design wallets with privacy built in. 

The Ethereum Foundation sits at the front of this project; however, Kohaku is being built alongside teams such as Railgun, Helios, Ambire Wallet, and others. 

Kohaku takes a wallet-first approach to privacy, considering that it is the main touchpoint for user activity. The idea is that your wallet is the front door to everything you do onchain, so that's where the leaks have to be plugged first.

Kohaku is not a wallet on its own. It functions as an open-source toolkit that lets the wallets you already use integrate privacy, instead of making everyone download a new wallet to access privacy. 

How does Kohaku work in practice?

Normally, your wallet asks a centralized RPC provider "hey, what's my balance?" - and that provider quietly logs your IP, your location, and a little file with your name on it. 

Kohaku is designed to bundle a light client (Helios) so your wallet does its own homework and stays quiet. 

Another way Kohaku is designed to function is in how it operates under the hood. 

The Kohaku SDK can spin up a one-time, throwaway address derived from your real key - basically like a burner number that still rings through to you - so you can do something onchain without anyone tracing it back to your main wallet. 

Kohaku also does shielded transactions the easy way by plugging straight into Railgun, and hiding all the cryptography behind a normal-looking "send" button. 

Another approach to keeping you private that Kohaku brings on board is the serial-killer gloves approach to addresses. 

Using one address can doxx you, but it can also be a chore having to spin up many addresses. Kohaku hands each dApp its own address, making onchain sleuthing or tracking a near-paranormal activity. 

Other significant additions that Kohaku brings to the users’ experience, like the ability to pay for gas in whatever token you’re holding or the fact that you’ll be able to recover your account if you lose your keys, using tools like ZK Email or Anon Aadhaar - proving "yes, this is me," without handing over your identity to anyone, are completely revolutionary improvements.  

Current progress

A few days ago, the Kohaku team released the SDK, hosted openly on GitHub, and hit a genuine milestone. 

Until now, every privacy tool basically ran its own private courier service to sneak your transaction onchain - separate, fiddly infrastructure for each one. 

Kohaku's release gets them all riding a single shared express lane (the ERC-4337 "account abstraction" mempool). This allows users’ transactions to reach the chain without ever revealing their wallet address or history in the public waiting room. 

At the moment, the first phase, i.e., local light-client verification and private data queries that cut the cord to snooping RPC providers, is available: 

And at the moment, the second phase: per-dApp addresses, shielded transactions, and peer-to-peer broadcasting, i.e., send, receive, and use dApps privately, is being rolled out, starting with the live 4337 relay.

The road ahead

The next phases for Kohaku revolve around zero-knowledge (zk) recovery, post-quantum-safe signatures, and universal hardware-wallet support, making key management both verifiable and private.

According to Vitalik, the endgame is getting security "as close to the silicon as possible" - baked into your device's hardware, even a native Ethereum browser, rather than trusting some website not to snitch on you. 

Ethereum’s privacy warfare is also factoring in AI-grade surveillance that can vacuum up a public ledger and pattern-match you in seconds, as well as measures against the bots that hunt and frustrate real users onchain.

How this might affect Ethereum and ETH

Kohaku unlocks multiple advanced user experiences for both builders, developers, and end users. 

For builders, Kohaku is a genuine mental model shift. 

Its features, such as one-address-per-app, break a couple of lazy assumptions, like the fact that smart contracts need fallback identification beyond simple address matching, frontends have to handle different addresses across sessions, and backends can no longer assume cross-dApp identity is linkable. 

For users, you get to compartmentalize your onchain life the way you already compartmentalize your real one, without juggling multiple wallets.

Concerning how Ethereum's drive for privacy affects ETH as an asset, we believe that privacy, combined with security, creates the perfect environment for true onchain adoption. 

Crypto’s susceptibility to painful nuances on the user's side still affects perception. Ethereum’s Kohaku could potentially assist in a tremendous way in ameliorating the fears of onchain-averse users, guaranteeing an improved user experience and safety, while providing an environment for freedom. 

With ETH down roughly 60% from ATH, and the privacy meta heating up across the board - Zcash, Umbra on Solana, Octra, the lot - Ethereum making privacy native and credible is one of the few narratives that's genuinely differentiated rather than another scaling arms race.

Nonetheless, even as the roadmap gets eaten, how this affects the price of ETH positively will largely depend on wallet-wide integration by popular wallet providers, a visible change in metrics as DeFi could potentially see a resurgence in inflows based on a rise in trust, and if the foundation can just stop selling ETH. 

Concluding thoughts 

Kohaku looks like a remarkable undertaking from where we are seated, and things look promising. However, they’re not the only path to privacy and security for Ethereum. 

Vitalik’s mentioned a few other bits like AA + FOCIL, which he states make privacy protocol transactions, among many other things, first-class with strong inclusion guarantees, and keyed nonces, which replace the single sender nonce with (nonce_key, nonce_seq), giving frame transactions independent replay domains.

The most important thing is that Ethereum is busy. And we like busy. Privacy is a huge problem in the industry, and if solved, will create new opportunities.