Compliant Private Stablecoins: The Roadmap to Confidential Stable Finance

Transcript

[Music] Hey everyone, welcome. My name is uh Zayn and I'm the CTO of Horizon Labs. Uh we work on the Horizon blockchain and uh we're the home to the cryptocurrency Zen. We're also builders on base. Uh today I'll talk about compliant private stable coins. These are the high-level uh beats of what I'll talk about today. We'll start with some quick framing uh with Vitalix 3 transitions and then I'll go through

the four four models of private stable coins. Uh for each of those models I'll do a quick case study on each of them. uh the first one anonymity sets the second one FHE based uh the third one ZK proof systems and the fourth trusted execution environments um then I'll go through a road map towards compliant private stable coins and then a summary and next steps quick framing uh so on the left the bank list guys um you know early on in the year they had coined this term called stable coin summer. And so we're in the

midst of it. Everybody um probably has gone through conferences that are completely about stable coins. Um it's unavoidable. It's inevitable. And uh just uh just like some quick framing here in 2024 the global volume was 27.6 trillion more than Visa and Mastercard. And the 2025 numbers uh are set to surpass that. Uh on the right is Chris Dixon. He's the founder of A16Z Crypto. Last month he was part of the A16Z crypto podcast where everybody was asking him, hey, why is everybody into stable coins right now? He simplified it by saying um payments are now less than a second and

less than a penny. Uh that's very valuable for many countries. Um and for apps who want to adopt payments, it's literally one click uh to be able to have your application accept payments from 190 plus countries just like that. He called stable coins uh internet native money. um and the layer for it. Stable coins are fast, global, but they really they leak everything. Um and um yeah, this illustration is more around like a uh leaky faucet. Uh for enterprises, it undermines the

competitive advantage. So it exposes supplier and vendor relationships. It leaks payroll. And all in all, the adoption of stable coins for B2B flows is limited. Um, for individuals, uh, it compromises financial dignity and safety. Um, anybody could trace uh, someone's income, their spending, donations. It puts um, your family members, employees, and um, activists at risk. It fails a lot of the basic premise for financial privacy.

Um although it has had a lot of adapt uh adoption and it's really um proving a lot uh it's still underutilized. Um there's no mass payroll um and retail adoption yet. Um mainstream use really demands compliance and confidentiality. Uh this is the um blog post that I mentioned at the start. This is from over two years ago now. Uh this is Vitalik's three transitions. Um these transitions are necessary for the greater level transition of Ethereum going from a young experimental

technology to a mature capable tech stack and this tech stack is meant to bring open global permissionless experience to average users. uh you see here uh that this ecosystem triangle uh for the higher level transition all three are needed. Um so on the bottom left we have L2 scaling and we've really seen the maturation of L2 scaling um across the frameworks is highly it's highly viewed as the you know official sharding for Ethereum and so that transition is it fully underway. Uh we have the wallet um smart contract um transition and uh some of the folks from

wallet connect were here earlier they spoke about it uh and then it was more fully introduced with uh last month's spectra upgrade. So the last one is that privacy transition. So two and a half years late, two years later where we are now. Uh these are the more recent views from um just a couple months ago. So 2025 Q2 um Vitalik has posted around why he supports privacy um that it is no it can no longer be ignored. It's freedom, order, and progress.

um in the Ethereum magicians forum that's the core dev forum for Ethereum um he's posed a maximally simple L1 privacy road map it consists of nine steps and it kind of goes uh just a little bit more simple beyond the protocol. So uh just to close out the framing uh this talk is more about a higher landscape view. It is less about the specifics but more about broad overall patterns.

So I'll cover the four models of private stable coins. Uh what is it? Uh a definition for a private compliant stable coin is a stable coin that preserves transaction confidentiality. So this could conceal the sender, receiver and amount. I know some projects are not concealing the sender and receiver by choice citing that uh just the amount is necessary for regulation. Uh this would align with regulatory expectations. Uh this could be having an audit trail selective disclosure and I know that jurisdictions are very different. So this is more general uh compliance around juris jurisdictions.

How does it manifest itself? Um, so it could manifest itself in two ways. It could be a private rep representation of an existing stable coin. So these are the ones you know very well, USDC, USDT, uh, die. They're locked in contracts um, uh, on the L1 and then reissued in these uh, private run times. It can be achieved through wrapping or bridging and it allows for private balance transfers within that runtime without uh issuing a brand new stable coin.

Uh the other uh way it'll manifest itself is through these native deployments directly in those privacy enforcing environments. So this could be a new stable coin protocol that's launched directly inside uh the ZK FHE and TE systems. Uh so these examples could include algorithmic models or CDP based uh collaterized deposition based issuance um where they're fully private by design and they have built-in logic for compliance. Uh so these are just like very high level broad strokes the way I see them.

They're four models. Um the first one is around anonymity sets. It's just uh playing around with indistinguishability amongst users. I'll go through uh some of the case studies here include bit wage, tornado cache, rail gun. Uh and then uh the second one is around uh fully homorphic encryption FHE based approaches. Uh many of these projects that are listed here are here at ECC. Uh then we have zero knowledge proof systems uh Aztec Alomo Manta and others and then uh trusted execution environments uh with Oasis, Vala, Automa and US Horizon.

Uh so the first case studies set I'll go through is Bit Wage. They've been around for a while and um uh they've really um pushed uh the frontier towards um payroll. Uh they've reached this was from the beginning of the year in January. They reached 400 million in crypto payroll processed and they largely use stable coins. Um there's this option here which has been around for a while. Um it is a lightweight form of an anonymity set which is to offer a set of over a hundred different payout addresses. So every time that um you're paid as part of payroll, wages will be sent to the next address on that list which uh

nobody could see except for the folks who are there. Um it achieves anonymity with this uh limited set of addresses. Um the second one, many of you are familiar with this. It's the tornado cache style of smart contract mixing. Uh the idea here is that to use a shared pool where you could deposit your stable coin, a fixed amount at USDC, and it creates a commitment that gets added to a data structure um Merkel tree upon withdrawal to a different address. uh all you have to do is supply zero knowledge proof and you it doesn't

reveal um which deposit was originally theirs. Uh now the anonymity set here is that it's all deposits and more users mean more anonymity. Uh one issue with this is uh these are all from 2022. Um the uh tornado cache was added to the OFAC list, the office of foreign asset controls. And so this caused many projects uh because they want to be uh OFAC compliant. Uh they start to freeze tornado uh interactions with tornado cache smart contracts. Uh the first one was circle. Um initially

USDT said that oh they are not going to do that but 16 month later 16 months later they did and uh definitely understandably so. Um even RPC providers with Infura and Alchemy started blocking access to tornado cache which means that um even if you were to use popular wallets you couldn't access tornado cache um through those. The center image is around um relayers in the block building process. Uh so uh many of these uh ME relayers um at least seven out of the 10 of them they are uh they strive for OFAC compliance. So they

actively censor blocks which means uh for certain transactions especially those that interact with tornado cache they were censored. I know that there's a active movement around this with um uh forked uh choice inclusion lists and I know that that will be definitely a big part of anti-censorship. Uh one degree higher than tornado cache uh private uh pools is the concept of privacy pools. Uh this was um on the left is a white paper from Vitalic from a couple of years ago and it talks about um just like an advancement where these pools are only limited to addresses who

have never interacted with known exploits. Um it is uh uh there's a kind of like a way of uh checking um and providing these proofs of innocence and uh there's a diagram here showing a membership proof. I'd mentioned that ninestep plan from just a couple of months ago. uh the very first step of that ninestep plan from Vitalik had mentioned hey we can immediately use these privacy uh tools and these privacy pools with existing wallets so uh MetaMask trust wallet Coinbase just giving some examples where um wallet should have this notion where whenever you send to someone else you

should send it from a shielded balance uh that way uh it can't you achieve privacy on the wallet level. Now, this uh would ideally be turned on by default and so users would not have to download a a separate privacy wallet. Uh one downfall of this is that risk risk could be viewed as moving towards uh the wallet providers. I have no like real good statistic around this, but my sense is that like maybe there's a 10% chance that wallet providers would actually default to this. That's a fuzzy statistic.

Uh so the summary um the summary is that uh private stable coins with these anonymity sets definitely uh unlinkable when the set is large. It's a very flexible design space with bit wage wallet defaults and it's available today. Um the cons are their small sets which reduce the anonymity guarantees and censorship censorship and legal risk which we saw. Um and uh you know another thing with the privacy set is that boot bootstrapping these sets are hard and uh although it's available today it's in a little bit of a gray area.

Next I'll go through uh FHE based uh this is a um announcement from circle research with INCO um they had said that they're introducing this uh confidential ERC20 and I know Remy from um Inko had talked yesterday um which was great and this on on the right is the uh on your right is the white paper for uh this is a high level on the interface. So it it it com is comparable to the RC20 but it has this concept of

hidden balance hidden transfer and these wrappers. Um and the idea is that um you could either implement this sort of uh um privacy as EVM pre-ompiles or co uh co-processing approach. So um with this confidential ERC20 is more of an interface um that contracts can interact with and uh FHE is just one implementation of it. Uh so from a higher level I didn't really go through FHE uh but uh on a higher level um the data that you're working with um could be the address the

amount it's encrypted and then um there's this uh all computations on this encrypted data happening while it's encrypted so it's not um decrypted any way until much later on by the client. Uh so um on the right you'll see uh this like high level representation of it which is um the confidential ERC20 um really delegating to this uh FHE processor um there uh for like things like a um balance transfers. It undergoes um everything through encrypted operations. So that includes encrypted uh edition, encrypted comparisons and uh yeah just like

deducting the amount in an encrypted way uh through over the encrypted data from the sender and then add adding the increment to the recipient. Uh Zama has uh made a lot of progress uh here and are leaders in the space. They have the confidential blockchain protocol. I believe they're go their test net launch today. Uh much uh congrats to them. And um it's really a similar model where there's co-processing that's happening offchain with uh encrypted computation. Um and they had mentioned that although they can um work with encrypted sender and recipient addresses, they chose um not

to do that but only uh the amounts are uh encrypted. uh they've from their view compliance is more around traceability. Uh just like the way messages are happening where you know that you can see messages who exchanged them but not the message content um they they are encrypting the amounts right test net live July 1st today mainet Q4 2025 and transaction costs are uh have been lowered and no fees on the computation itself as of now.

So um pros uh I think that it has strong backing uh in terms of uh circle research the a leading stable coin provider issuer uh directly involved with the uh research. It really takes FHE and aligns it with real world regulatory and enterprise needs. Um it's scalable with more hardware investment. this a lot with um FBGA's A6 and the costs are trending down overall. Uh the cons are is that it's still a heavy uh off-chain infrastructure requires those heavyweight um co-processors and MPC decryption nodes.

Um I think we're still pretty early um and uh the tooling is pretty new as well as the test net's just launching. um summary is uh there's like a lot of um large technical strides but still really early. Next up uh ZK proof systems. Um Aztec uh you know they have that programmable ZK layer 2 off Ethereum. Um they also uh launched testnet um sometime last month. they have Aztec Noir as smart contracting language and

um been making huge advancements in the space. Uh the architecture here is that um smart contract execution happens in this custom ZKVM and uh private state is held in these encrypted UTXOs uh and public state in Merkel trees. Uh the design pattern for stable coins is similar where um you know stable coins could be bridged directly from Ethereum into Aztec or new stable coin protocols can be deployed.

Uh the maturation cycle here in test net uh there's new Aztec 3 uh but mainet expected later in the year. Uh this this is a uh project um that's led by Taurus which is a um uh it is a um institution and uh the architecture here is that um it is a contract minted direct that is deployed directly into Aztec and it's backed by onetoone off-chain assets um similar to circles USDC. um it is native privacy. Um the

way I view this is that it's more of a like um a directional um view where um the that institutions are interested in it and um instit institutional grade privacy native stable coins are occurring in ZKL2s. Um and so uh it's like it is a broader evolution. Uh pros so pros and cons with uh stable coins and zk proof systems. Uh the programmable privacy here is that um it

is uh much richer especially with with uh noir amongst the cryptographic privacy models. seems to be the most mature. Uh they have had uh solid uh tooling and test nets for some time and um offer just a little bit more performance. Um in terms of cons, uh proof generation is improving but still a constraint. Um there's faster proving with hardware acceleration.

Um but even with that proving there's centralization risks as well as leakage. um uh in terms of privacy leakage from the proving networks uh ecosystem still early but it is a compelling and practical approach um and uh yeah test net and mainet are promising. Uh lastly I'll go through the third the fourth bucket which is uh trusted execution environments.

Uh I just to do a quick aside uh from that ninestep plan uh there is a step five here um around uh TE based um RPC privacy. Uh now it's not directly related to stable coins but um I just wanted to call out uh that uh it w it was mentioned in the ninestep plan and here it's more around the fact that RPC nodes themselves are leaking privacy uh as you're I mean you don't even have to be submitting transactions but uh any your interactions such as uh your browsing patterns and IPs uh they are visible to RPC providers. So the idea here is to be able to um run a

T-protected um RPC and Automa who I believe also had a talk yesterday um has uh is a working example of this and this is u another way of having wallets and RPC providers help with privacy beyond the protocol. Uh so extending extending T's towards transaction execution. Um the idea here is that um transactions execute inside of the trusted execution uh environment uh where EVM logic it lives inside the enclave. Um now uh T's have come a long way and um yeah I I

think that it is a very compelling design. Um this enables private transfers of existing stable coins uh without modifying the contract and without having to know a new language. Uh there's confidentiality and compliance by design where sender, receiver and amount are all hidden and it supports jurisdictional controls such as geo fencing uh enterprise compliance. Um it is the fastest um path towards enterprisegrade stable coin deployments.

Um it's low latency. Um a lot of them are um widely available in major cloud platforms AWS Azure and um is a great near-term solution for institutions seeking compliance and speed. Uh this is where we're operating as well. Um we um are part we are part of the base ecosystem. Um this is uh the announcement of BAS and uh their L3 chains and we're part of that initial cohort. We're moving our entire uh token supply from a UTXO based blockchain directly into base as an ERC20 and we're

working on a confidential compute environment for the end of the year. Uh these are the like high level beats of like um our road map and um we are fully into the migration of our token directly into base and um widely available across all exchanges uh Binance, Coinbase uh and then working towards our compute environment. Uh just another note this is um comment from uh Philip Decker who is a uh analyst in emerging payments at AMX. Uh he had gone through a similar uh kind of

like thought process as I did. Um this was published maybe two or three days ago. Um and he also at the end makes a case for TE's uh citing that the performance is high and it enables uh near instant execution with minimal gas. Um and because of their um the way that they're structured um there's a little bit more legal clarity. Uh just like with cloud storage uh governments can um have ability to request information as needed.

So, pros and cons. Um, there's EVM compatibility and speed. You can run the existing stable coin contracts without any rewrites and um near instant execution within these enclaves. Um, the is already compliance uh ready by design and uh supports selective disclosure, auditability and geoencing. Uh some of the cons are that uh the trusted there are assumptions with the hardware uh relies on the security of the vendors Intel and AMD and there are operational centralization risks but all in all uh TE's offer this practical

performant path and it's ideal for enterprises. is this is a highlevel road map. Um I've uh superimpose the uh Ethereum hard forks on here. Uh Ethereum has had 17 18 upgrades all uh dramafree and um with the zero downtime. Incredible. Um I put Fusaka on here, Glamsterdam and the risk five uh BM in like a more cloudy way. Um the first one, the anonymity set stable coins available now. Um but right that 10% chance of being adopted and still in

the gray zone. Uh FHS are um improving a lot uh I think uh in terms of co-processor development performance optimizations. uh there's um more of a chance for maturity closer towards the end of next year. Um ZK stable coins um ZK based uh stable coins um a lot is already out there but also probably 2026 um midyear and beyond. Uh and then Tbased stable coins more of the near term. Now this is also kind of like fuzzy uh reasoning but uh just like a high level view

summary and next steps. Uh so we went through the definition of a private compliance stable coin. How it manifests it uh manifests itself uh private representations um of existing stable coins bridged um reissued uh then the native deployments. Uh these are some like highle models of the private stable coins. Um I I probably missed a few like uh buckets.

Maybe there's a wallet based bucket um and account abstraction, but um these are the ways uh they could be categorized. And then quickly we went through like a a road map in terms of like time to maturity. Uh just uh superimposing this on top of the Ethereum um upgrades. Next steps. Uh we're all in this together. I've uh took a little um screenshot of the Ethereum infinite garden. It is a very fastmoving frontier. Uh we're building it together um as developers, parts of this community. I we also want to include

regulators and institutions. They're part of this like magical experience. Uh so um I I'm feel very grateful to be here and thank you. Thank you everyone. Uh any questions? Thanks. Great presentation. Thank you so much. Um I was wondering if you also would where you would put something like Midnight as a layer for uh encryption on existing wallets.

Uh, that's a good question. Um, from my what I remember about Midnight, it's more of like a ZKbased system. So, I'd categorize it there. I wasn't familiar about it being a layer 4, but um, you know, that seems to make sense to me terms of like lower costs. Thank you for the talk. It's very interesting. I have a question about performance levels. So you showed that slide with FHE and ZK. What kind of performance levels do you think you need or the industry needs for it to go mainstream?

Yeah. Yeah. It's a great question. I feel like these slides I just kind of like put them together, but they're probably outdated already how fast the you know things are moving into industry. Uh but at the very beginning I showed like um you know subsecond transactions. Um, you know, I know like base has block times now of like 250 milliseconds. So I think um in terms of like performance and speed, ideally it'd be a subsecond Um, any other questions?

Okay. Well, thank you. I appreciate you being here. Um,