Kohaku: Ethereum's Privacy-First Wallet Revolution

The Reveal at Devconnect Buenos Aires 2025

When Vitalik Buterin took the stage at Devconnect in Buenos Aires in November 2025, he did not mince words about where Ethereum stands:

"We're in this very last mile stage. It's in this last mile stage where we need to put a lot of concerted effort into doing better. Same on the security side."

He also put the stakes plainly:

"Privacy is freedom. It gives us space to live our lives in the ways that meet our needs without having to constantly worry about how our actions will be perceived by all kinds of centralized and decentralized coercive political and social entities."

Kohaku is Ethereum's answer to that last mile: a privacy-first wallet framework meant to put zero-knowledge proofs in the hands of everyday users.

What Is Kohaku?

Kohaku is a set of privacy and security primitives for Ethereum wallets. It was announced in October 2025 in a blog post by Ethereum Foundation coordinator Nicolas Consigny.

Important: the project is a work in progress and is not ready for production use.

What Makes Kohaku Different?

Not Another Wallet - A Framework

Kohaku is not trying to replace MetaMask or Rabby. It is an open-source framework that any wallet can integrate, and it comes in two parts. The first is a modular SDK: privacy and security features that developers can drop into an existing wallet, either all of them or only the parts they need. The second is a reference wallet, a browser extension based on the Ambire wallet, aimed at developers and power users who care about privacy.

Development Collaborators

Kohaku is being built with a set of well-known Ethereum teams, each owning a piece. Ambire provides the reference wallet infrastructure, Railgun the privacy protocol integration, and DeFi Wonderland the DeFi integrations. Helios from a16z is the light client, Oblivious Labs handles private reads and writes, PSE (Privacy Stewards of Ethereum) brings the privacy research, and ZKnox contributes zero-knowledge tools.

Privacy Cluster Team

The Ethereum Foundation has formed a dedicated team called the "Privacy Cluster", made up of 47 engineers and researchers. It is headed by Igor Barinov, the founder of Blockscout, and is responsible for making sure privacy is implemented thoroughly across the ecosystem.

The Privacy Pools Integration

Kohaku integrates directly with Privacy Pools, which goes after the "tainted money" problem that hurt earlier privacy protocols like Tornado Cash.

What Are Privacy Pools?

In Tornado Cash, good actors and bad actors ended up in one mixed pool, so everyone in it could look suspicious. Privacy Pools change that by letting users build association sets that prove their legitimacy. You keep your privacy and still get to say, in effect, "I'm in the legitimate user pool, not the criminal pool".

How It Works in Kohaku

The flow has three steps. You deposit funds into a privacy pool. You generate a ZK proof that your deposit belongs to the "clean" subset. Then you withdraw to a fresh address, which keeps you private while still proving you are legitimate.

Supported Privacy Protocols

Core Features

1. Transaction Shielding

In a demo at Devconnect, a user shielded publicly visible funds through the Railgun integration. The goal is default opt-in privacy for any wallet connected to Ethereum. That covers private sending and receiving, hiding IP addresses, masking traffic so the IP does not leak, and showing one aggregated balance across every privacy protocol you have enabled.

2. Local Light Client (Helios)

Helios runs as a WASM package inside the browser extension, so the wallet does not have to trust an RPC provider. Transactions are verified locally, which cuts down the surveillance risk.

3. Private Reads and Writes

This is a browser-based execution client for private actions, including eth_call against an oblivious server. The first version uses TEE+ORAM, with plans to move to purely cryptographic solutions based on PIR (Private Information Retrieval).

4. Stealth Address Support

Kohaku creates an ephemeral stealth address from your public key, so you can run a private action without revealing the link to your main wallet. Stealth addresses are generated automatically, the wallet scans for incoming payments as a recipient, and private addresses are supported transparently through ERC-7811.

5. One Account Per DApp

Every new connection asks you to generate a separate address, which keeps your activities from being linked to each other. It works the way web2 already does: your PayPal and Netflix logins have nothing to do with each other.

6. Privacy-Preserving Recovery

Kohaku plans social recovery options built on zero-knowledge verification: ZK Email for anonymous email verification, ZK Passport for a privacy-preserving identity proof, and Anon Aadhaar for identity verification without exposure.

7. Post-Quantum Protection

Security researchers on Kohaku have built a "Post-Quantum killswitch" that lets token holders switch to post-quantum accounts using Falcon or Dilithium verifiers, optimized for Solidity. It protects assets against potential quantum computing threats.

The Developer Experience

Modular SDK Architecture

The SDK ships privacy and security features that other wallets can integrate. Its plugin architecture lets developers pick the privacy modules they want, which makes customizing a wallet easier and keeps it future-proof. For developers that means open-source code and a public roadmap on GitHub, a plug-in system for choosing specific features, a modular design where you only use what you need, and an active community behind it.

Roadmap

Phase 1: Foundation (2025 Q4)

The first phase lays the groundwork: SDK documentation and an initial release, the browser extension based on the Ambire wallet, the Helios light client integration, and basic private send and receive. Mainnet comes first, before expanding to Layer 2 networks.

Phase 2: Privacy Features (2025-2026)

The second phase adds the privacy features themselves. Private sends go through 0xbow Privacy Pools, crosschain sends through the Open Intents Framework, and balances are shown in one universal view across chains. It also brings per-DApp account isolation, shielded transactions and peer-to-peer transaction broadcasting.

Phase 3: Structural Privacy (2026+)

Native Account Abstraction: A secure and private wallet needs Ethereum to implement native account abstraction. The team will work in that direction through 2026, toward privacy-preserving account abstraction that requires client-side ZK-EVM (or perhaps ZK-RISC-V) proving that you control a given wallet. That lets the same wallet control both public and private funds.

Beyond that, the 2026+ goals include zero-knowledge recovery, post-quantum-safe signatures, universal hardware wallet support, a native Ethereum browser for deeper security, transaction security scoring via local AI, new social recovery schemes, and full private account abstraction built directly into Ethereum's protocol.

Hardware Wallet Support

Kohaku proposes a "universal Ethereum-app for hardware" to end vendor lock-in and open up advanced features to everyone. It includes a reference implementation for hardware wallet manufacturers and a ZK hardware signer on Jubjub/Bandersnatch, so hardware wallets can work with privacy protocols.

Challenges and Limitations

Current Limitations

Kohaku is a work in progress and not ready for production use. The first release targets developers and power users, not everyone. Mainnet is the priority, and Layer 2 support comes after mainnet is stable. And there is a real performance overhead, because generating ZK proofs takes computational resources.

Upcoming Improvements

The next improvements address exactly that: faster proving with optimized circuits, broader protocol support, mobile implementations and gasless private transactions.

The Bigger Picture: Privacy as Infrastructure

Kohaku is a shift in how Ethereum thinks about privacy. In the old view, privacy was a niche feature for paranoid users, delivered through separate protocols with complex UX. In the new one, privacy is core infrastructure for everyone, built in, with simple UX.

The Ethereum Foundation believes that without strong privacy safeguards, Ethereum could become a "foundation for worldwide monitoring." Kohaku is meant to make privacy a normal, accessible feature for everyone instead.

Getting Started with Kohaku

For developers: start with the GitHub repository at ethereum/kohaku, review the SDK documentation, try the example integrations, and join the community for developer support.

For wallet projects: review the integration guide, choose which privacy modules to integrate, implement them through the plugin architecture, and launch the privacy features to your users.

The Verdict

Kohaku is not just a wallet. It is Ethereum's bet that privacy can be both powerful and easy to use.

For too long we accepted a false choice between usability and privacy. Kohaku shows we can have both. Whether Ethereum can build privacy in is settled; what is left is how quickly it becomes the default.

Next in this series: real-world applications of privacy technology, from DeFi to voting systems to enterprise use cases.

Have you tried Kohaku? What privacy features matter most to you?