Vitalik Buterin’s privacy pool idea is interesting, but it’s just the start

The original teaser, shown in March, was based on an idea initially espoused by Ethereum co-founder Vitalik Buterin in 2022. But it somehow failed to attract the attention of the crypto hive-mind. It was only weeks ago — after Buterin authored an academic paper on the subject — that it began making the rounds more widely on social media.

Why? Well, nothing like mixing “blockchain privacy” with regulatory compliance” to upset some cypherpunks. And to leave the rest of the community wondering if regulators would even be interested in legitimizing the use of non-custodial crypto-asset mixers — which are indeed crucial to the on-chain economy, yet so often misunderstood.

Because the future is clearly a more digitally transformed world where zero-knowledge proofs enter the mainstream and there’s at least a corner of decentralized finance (DeFi) that can benefit from automated compliance at the smart contract level. And this paper has kickstarted that conversation, even if without a conclusion. Meanwhile, how do we go from A to B?

Let’s discuss if privacy pools can really be compliant at the moment. Can they satisfy the core ethos of the community — or at least of the part of the community that cares about preventing the illicit use of tokens, as the Pretty Good Policy for Crypto podcast recently put it? And how can we overcome one of the paper’s most critical shortcomings: the narrative?

Firstly, even if the proposed implementation is sound, users can only prove their innocence by showing their original deposit either belongs to a set of presumably legitimate sources, or doesn’t belong to a set of known unlawful sources. These are referred to as association sets and their implementation is still to be defined by the ecosystem. But compliance is not only about addresses on OFAC’s SDN list or about staying away from known malicious actors.

zero-knowledge Know Your Customer (zkKYC) poolsYes, if someone hacks a protocol, or if an indicted criminal has their wallets identified, and tries to move funds to new addresses, these could be automatically added to an association set for honest users to dissociate from. That’s easy and the paper also recommends more interesting construction mechanisms, such as inclusion delays or even zero-knowledge Know Your Customer (zkKYC) pools.

However, bad actors can stay under the radar for long before being recognized as such, and that leaves regulators…