Ethereum 2025-2026 Privacy Roadmap: The Dawn of Private Infrastructure

Privacy Becomes Official

For years, privacy on Ethereum was an afterthought, something left to third-party protocols and layer-2 solutions. Developers experimented with mixers like Tornado Cash, built privacy layers on top of the main chain, and came up with complex workarounds that took real technical expertise to use.

That changed in September 2025.

The Ethereum Foundation made privacy an official part of the roadmap through the Privacy Stewards of Ethereum (PSE) initiative, formerly known as Privacy & Scaling Explorations. It is a coordinated, multi-year effort to make privacy a core feature of Ethereum, from the base layer protocol all the way up to the wallet interface.

As Vitalik Buterin said at Devcon 2025, the network has strong security and privacy research and solid layer-1 security, but it still has not leveled up the last mile: the wallets and apps people actually use.

The technical capabilities exist. The cryptography works. Zero-knowledge proofs have been battle-tested for years. What is still broken is the user experience. People juggle multiple seed phrases, install separate privacy wallets, and often give up entirely and fall back to centralized exchanges.

Sam Richards of PSE put it this way: Ethereum is on the path to becoming the settlement layer for the world, but without strong privacy it risks becoming the backbone of global surveillance rather than global freedom.

The Three Pillars of Ethereum Privacy

The PSE initiative is built around three capabilities that will carry the work for the next few years: private writes, private reads and private proving.

1. Private Writes

The goal: confidential on-chain activity that does not broadcast the action to the world.

Three technologies carry most of this. Stealth addresses let recipients receive funds without exposing their public address: the sender derives a one-time address from a shared secret, and only the recipient can spend from it. Homomorphic encryption lets you compute on encrypted data without decrypting it, so smart contracts can process confidential information while the data itself stays hidden. Privacy Pools add selective disclosure. A mixer hides everything from everyone; a Privacy Pool lets you prove you are not mixing funds with sanctioned addresses while staying private from the general public.

Put together, that covers anonymous governance voting, private DeFi interactions, confidential DAOs and enterprise treasury operations.

The team is also building PlasmaFold, an experimental Layer 2 design for private transfers. Its proof of concept debuted at Devconnect in Argentina on November 17, 2025.

PlasmaFold: The Technical Breakthrough

PlasmaFold is a new kind of Layer 2 with a hybrid architecture. An operator generates proofs server-side to show blocks were built honestly, while users keep balance proofs on their own devices.

Splitting the work this way is what makes it interesting. Users can exit instantly and non-interactively using their balance proofs, while the block proofs handle most of the validation. That keeps users' costs down and removes the need for complex exit games.

It also makes private and public transactions equally efficient. You do not pay extra gas for privacy and you do not wait longer for confirmations. Privacy becomes the default instead of an expensive upgrade.

PlasmaFold L2 is designed around secure, confidential transfers, using zero-knowledge primitives and optimistic privacy constructs.

Timeline: public testnet expected Q1 2026, security audits Q2 2026, mainnet launch mid-2026.

2. Private Reads

The goal: query Ethereum applications without revealing your intent or identity.

The problem is that every balance check and every dApp interaction leaks something. RPC providers can see your IP address, which addresses you control, what tokens you hold, and your activity patterns.

The fixes work at different layers. ORAM (Oblivious RAM) lets you access data without revealing which data you accessed, so the server cannot tell a query for address A from a query for address B. Privacy-preserving RPCs are new RPC architectures that blind queries before they reach the provider. And client-side verification has your wallet check responses with cryptographic proofs, so you no longer have to trust the RPC provider at all.

Because typical RPC calls can leak personal information like IP addresses or which accounts a user cares about, PSE has convened a private RPC working group to evaluate solutions.

Timeline: Q1 2026 the first privacy-preserving RPC implementations go live, Q2 2026 standards are finalized, Q3-Q4 2026 client-side verification becomes standard.

3. Private Proving

The goal: make zero-knowledge proof generation fast, cheap and accessible on everyday devices.

The team calls this the "prove anywhere" initiative, a set of projects aimed at making proofs easier and cheaper to generate on the devices people already own.

zkTLS lets you prove facts about web data without revealing the data itself, for example that your credit score is above 700 without showing the actual score. Modular ZK wallets turn privacy into plug-and-play components: need stealth addresses, install the module, which lowers the barrier to entry. Distributed proving splits proof generation across multiple devices, so ten people each spend one minute instead of one person spending ten.

Timeline: Q4 2025 zkTLS enters production, Q1 2026 mobile proving becomes viable with sub-30-second proof times, Q2 2026 distributed proving networks launch, Q3-Q4 2026 modular ZK wallets become standard.

The Privacy Cluster: 47 Experts Building the Future

The Ethereum Foundation has expanded its privacy efforts with a new Privacy Cluster: 47 of the top researchers, engineers, coordinators and cryptographers in the blockchain industry, coordinated by Igor Barinov.

The cluster has three parts. PSE (Privacy Experience) works on privacy protocol UX and on making privacy accessible. The Institutional Privacy Task Force (IPTF) bridges institutions and Ethereum by translating regulatory requirements into privacy specifications. And Kohaku is a new reference implementation of a privacy-preserving wallet, plus an open-source wallet SDK.

Key Projects Already in Motion

The Foundation has funded privacy research since 2018 through the PSE team, which has built over 50 open-source R&D projects and released core primitives. A few of them are already in real use:

• Semaphore: zero-knowledge identity framework for anonymous signaling and voting.
• TLSNotary: pioneered zkTLS to prove facts about web data with cryptographic guarantees.
• Zupass: privacy-preserving event ticketing, used successfully at Devcon 2025.
• Anon Aadhaar: private national ID verification that proves Indian citizenship without exposing ID documents.
• MACI: collusion-resistant private voting for DAOs.

The Regulatory Win-Win

Privacy and compliance are not opposites. Zero-knowledge proofs make selective disclosure possible.

That is where the roadmap points. Consensus, settlement and proof verification on Ethereum stay transparent and verifiable, while user data, fine-grained application logic and linkages move behind zk-proofs and encrypted state.

With zero-knowledge proofs you can prove you are not on a sanctions list without revealing your identity, show tax compliance without exposing your trading history, and verify accredited investor status without sharing financial details.

The IPTF is working with regulatory bodies in the US, EU and Asia to define standards for selective disclosure.

Kohaku: Where Everything Comes Together

Kohaku is best understood as Ethereum's new privacy-and-security toolkit for wallets: an open-source framework from the Ethereum Foundation with a modular software development kit and a reference wallet.

It is designed to make privacy effortless by building in established tools like Railgun and Privacy Pools, and it adds multiple keys and risk-based controls for large transfers, all without making users manage extra seed phrases.

Buterin laid out what is wrong today. Using a privacy protocol needs a separate seed phrase with no multi-sig option, a private send and withdraw takes about five clicks, and public broadcasters are unreliable.

Kohaku changes that. Privacy becomes one click, and you use the same seed phrase for public and private transactions.

The feature set covers private sending and receiving, hiding IP addresses, a separate account for each DApp, P2P transaction broadcasting that bypasses normal RPC servers, and social recovery through tools like ZK Email or Anon Aadhaar.

The wallet is being built both as a browser extension and as a reference implementation for developers who want to put privacy primitives straight into their own applications.

Kohaku Release Timeline

The private alpha for developers and power users lands in December 2025. The public beta follows in Q1 2026, with the SDK documentation finalized. In Q2 2026 major wallets integrate the Kohaku SDK, with MetaMask, Rainbow and Coinbase Wallet named. By Q3-Q4 2026 the goal is for Kohaku to be the standard for privacy-first wallets.

Market Impact and Institutional Adoption

Industry leaders have backed these privacy enhancements. Cathie Wood, founder of ARK Invest, publicly endorsed the initiative and pointed to its importance for Ethereum's institutional market dominance.

For institutions, privacy is part of how a business operates and makes decisions. It lets them choose who to work with, how to compensate teams and how to structure internal processes, while meeting the security and compliance standards they need before they can adopt public blockchains.

Real-world impact: UBS has tokenized $1.7 billion in private credit on zkSync. The 2026-2027 roadmap targets trillions of dollars in tokenized assets, including real estate, private equity, bonds and commodities.

The Path Forward: 2026-2027

December 2025

The PlasmaFold testnet goes live and the Kohaku private alpha launches.

Q1 2026

Private RPC standards are finalized, zkTLS production applications launch, and Kohaku goes to public beta.

Q2 2026

PlasmaFold security audits complete, mobile proving becomes viable, and major wallets integrate the Kohaku SDK.

Q3 2026

PlasmaFold launches on mainnet, Layer 1 privacy features begin rolling out, and the Institutional Privacy Task Force delivers its first compliance frameworks.

Q4 2026

Privacy becomes standard, regulatory clarity emerges, and enterprise adoption accelerates.

2027

Layer 1 privacy reaches maturity. An optional private mode becomes available on Ethereum mainnet, and the privacy infrastructure is complete.

The Bottom Line

HTTPS became the default for websites, and privacy is on the same path for blockchain, moving out of experimental research and into concrete problems and better outcomes for the ecosystem.

The Ethereum Foundation's commitment rests on a simple principle: credible neutrality, security and openness are worth much more to humanity when they come with privacy.

Without privacy, a blockchain becomes a surveillance tool. With it, a blockchain becomes what it was always meant to be: permissionless, censorship-resistant, globally accessible financial infrastructure, where you control your data, protect your identity and transact with confidence.

The roadmap is ambitious, and the next 18 months will decide whether Ethereum can deliver on it. Success depends on execution, but the technology is ready, the teams are in place, and the market is asking for it.

Next in this series: a closer look at Kohaku, the privacy-first wallet framework that brings these ideas to end users.

Are you building with privacy in mind? What privacy features are most critical for your use case?