On Chain Privacy: What’s Different For Enterprises

Transcript

We're going to try that again. Can you guys hear me now? All right, I see thumbs up. People are awake. Uh we had our dance break. Um I'm Paul Brody, as I said before. So, I am the founder and CEO of a company called Nightfall Networks. Uh and and some of you think, "Oh, isn't that the EY blockchain guy?" And the answer is I was for 11 years, uh right up until the 27th of February. And now I'm the founder and CEO of Nightfall Networks, which is a blockchain privacy company that is going to build on the open-source technology that EY has developed over the last 8 years called Nightfall. Uh Nightfall is a privacy network. It's in development and deployment on a bunch of different uh uh blockchains, including Celo, Plume. It's coming soon to StarkNet and

the Ethereum mainnet. So, uh it's got a lot of traction, and it's very focused on enterprises. I've spent almost my entire career selling to, serving, and working with large enterprise organizations. That means big companies, right, that have lots and lots of process, little manuals of stuff that we have to follow. And they care actually a great deal about privacy, and their expectations of privacy are different than what the expectations of privacy are for a lot of consumers. So, what I want to talk today about is basically what is it that enterprises and financial institutions uh think about when they think about privacy, and how is it different from a lot of the stuff that's happening on chain today, and needs to be different from where a lot of stuff is moving. Right? So, let's get

started. One of the things that is great and makes me very happy is that basically it's not illegal to have privacy anymore. Now, I was always on the viewpoint that it shouldn't be illegal, but we had a period of time when basically people are like, "No, no, no, I don't want to go to prison." Right? Don't don't bring me any of that enterprise privacy stuff. We're not interested. Now, the the tide has turned legally and from a regulatory standpoint, that's really, really positive. Um but a lot of the privacy solutions are not very mature, right? Mixers, uh I would say, don't do a very good job. I saw an amazing presentation from Chainalysis about 9 months ago following stuff through mixers and bridges. They just don't work. But, there are other solutions that do, and

they're actually starting to get traction. There are uh they're a little bit a little bit suboptimal, but they still do the job. And this is a really good example, right? You have bank A and bank B, and they're doing things like stablecoin netting. So, right, they're they're aggregating a whole bunch of wallets on one side and a whole bunch of wallets on the other. They're doing their netting off chain, and then they're settling by stablecoins on chain. Right? This may not be perfect, but it absolutely provides a robust level of privacy, which, in my opinion, is definitely progress. But, it's got a few shortcomings. So, you can't really build a complex proprietary trading strategy that way. You can't hold anything that looks like a non-fungible asset, because those don't work in any any kind of a netting model. Uh you

can't do any kind of business operational work, like keeping track of your inventory. You can't do delivery versus payment, because that's all done that netting is really just stablecoins netting against each other. And you can't have any kind of a specialized smart contracts. So, uh leaves a lot to be desired. Nonetheless, it's progress, but it's a kind of progress that that is, I think, typically an intermediary step. And um you know, if you think about other industries that have gone through big digital transformations, one of my favorites is music, right? Well, I've I'm old guy, so I've lived through this whole experience. Like, when I was a kid, you bought like physical media, right? And then they tried to get you to buy the entire album again. And we all know there is only actually one good

track on the album, right? Albums are like nine tracks of stuff that you didn't want to hear, and one that you did. And um you had to buy the whole thing digitally, and then you could buy huge innovation an individual track. Uh and then finally you got to subscription model. So, we went from like sort of various flavors of the that we were trying to sort of slam the analog model into the digital framework until we got to the revolution. And I spent 15 years, almost 15 years at IBM, and this stage of the market, the one that we're in, is what we called your mess for less. Right? We haven't actually made any substantial improvements. The process is not better, but boy, it's faster and cheaper, and that's pretty good. Right? So, we are in that stage. It is almost always an intermediary stage on the way to truly

transformational approaches. Right? I think we we're going to have privacy with proper smart contracts, delivery versus payments, always on DeFi. It's coming. My goal is to build it in a way that is friendly and ready for enterprises. Do we need privacy on chain? I think this is a question that we no longer ask ourselves, right? I I think early on in my time in the world of blockchain, all the way back uh in uh 2013 when I met Vitalik, right? This was a question like, do we even need privacy? Isn't it kind of mostly private? No, it's not mostly private, and yes, we do need privacy. Uh and uh I think it the one of the reasons for slow adoption is that even though many of us need and want privacy, the truth is and and the the

prior speaker made reference this, um everything that you want to do on chain is so much harder under privacy. Where did that asset come from? You don't know. Right? Uh transaction analytics, origin of the asset, who's doing what? You don't know and you can't see. Right? Composable smart contracts, again, kind of really tough to do under privacy. All of these things, by the way, are possible. They're just not easy. And that's that's the big challenge, right? And I I have this joke, and you may not find it funny, cuz I'm not generally I actually I think I'm pretty good with a two-drink minimum. But, uh there's this joke, you know, men will do anything except for go to therapy. I think software developers will do anything except for fully implement encryption. Right? It's hard.

It makes stuff hard. I don't hear anybody laughing. Um I I appreciate if you would just make me feel better bit better about myself. Um but we want to get to all of these things. We want to have our own trading strategies. We want to be able to buy and sell non-fungible assets, run smart contracts, have DeFi. We want to be able to do all of those things. So, uh and in particular, I think it's really important to set all these things that we want to do in a bigger context. If you go and look at this picture, right? This is a a classic business process map, um which I spent way too much time in my career building these kinds of things, right? You have a contract, purchase order, etc. One of the things that's really amazing is this

process end-to-end anywhere from $250 to $1,000. The payment is the cheap part of this process. Almost the rest of it is so much more expensive, especially any form of reconciliation, because in the traditional business world, the money and the stuff exist in completely separate systems. We have Swift and banking system for the money, and we have this whole other system called EDI, electronic data interchange, for the stuff. And then companies spend all their time reconciling the money and the stuff. Did you get what you paid for, right? Did the invoice match the terms and conditions we agreed upon? Uh that's actually where all the money goes. It's not really on the cost of the payment.

You know, I think in the world we obsess over how much it cost to make a payment. And that's a cost, but it's not anywhere close to the most important cost in this end-to-end transactional picture. And we know that if we apply smart contract, we can have a real revolution going on. And and I'll show you one of my favorite examples. Back in 2018, EY got a project that I was a part of for Microsoft to take the Xbox video game procurement system with a thousands and thousands of contracts with unique terms and turn it into a series of on chain smart contracts. Basically read in the the the traditional paper contract, turn it into a a on chain smart contract. Um this was

insanely successful. Uh reconciliation time, 45 days down to three or four minutes, right? Operating cost down by 40% and a huge increase in trust. This was a wildly successful project and um one of the reasons why you haven't heard about it and it didn't go anywhere is because we didn't have the privacy technology that would make it possible to take this off an internal private blockchain and put it onto the public Ethereum ecosystem. That was the plan. It just took a whole lot longer than we ever thought it would to actually get there. But we know from this experience and some of the others that that we had that end-to-end smart contract implementation is absolutely revolutionary and the

savings are far far larger than the cost of the payments. Like they dwarf the savings of like digital based payments. So what does good privacy look like and why is it taking so long? So uh you know, this is the next question, right? Good pri- What does good privacy look like? Well, I think there's there's two things fundamentally to good privacy and they basically you can you can deduce these from the the mechanics of every business agreement. 100% of all business agreements in the entire universe are very straightforward. One party has money or something that looks like money and the other party has stuff product service asset imaginary piece of artwork on an NFT. It doesn't matter what it is. It's money

for stuff under the terms of some kind of an agreement. Now, the money and stuff needs to move privately, but also you need to keep the terms of the agreement private. Because otherwise, if I have a deal with you that says I'm going to buy a thousand widgets for $10 a piece. You already and and you don't need to see the money in the stuff move. You've already learned everything important. So, you need these two kinds of privacy. So, the first thing is you need two kinds of privacy, the money and stuff privacy, and the smart contract privacy. Secondly, you need four characteristics, I believe, to make these systems really useful. Number one, it's got to be scalable, right? You got to be able to do a lot of transactions. It's you know, the early version, the the prototype that EY built for Nightfall, a single

transaction took two full blocks of the Ethereum network and cost $100 in gas, right? There were zero use cases for that. Secondly, it's got to be composable. You got to be able to move stuff from one output of one contract into another. It's got to be programmable under privacy, and it's got to be permanent. We must stop thinking about privacy as this thing you put stuff in and you take it out. You are leaking data all over the place every time you do that. Now, I was super intrigued by the prior speaker who says they've got some ideas on how to do that. The people at StarkNet are brilliant in terms of their thinking about how to do some of the most advanced math, but for most use cases, if you go into privacy and come out of it, you are leaking important information. Therefore, the optimal

environment is really you put your stuff into a privacy environment, that's where it lives. You live there now in privacy. That's where it should go. So, those are the four characteristics of what I think of as a really, really good enterprise-friendly privacy system. And it is it has been a long road, right? I talked about where we were. At Devcon in 2018 in Prague, we showed our prototype, right? And and about in 2019, we released the the the first version, and we've been at EY, I keep saying we, I don't work there anymore, but I'm going to continue this is the work I'm going to continue. We are going to keep moving along. We started with one, two, three, three and a half, four.

And down at version four, which we released last year, was 5 cents a transaction in compute cost. Version 4.5 will be even less, right? And every time we reduce the cost of a transaction and every time we increase the total volume of transactions, we unlock new use cases, right? There's a lot more use cases at 5 cents a transaction than there were at $100. Uh where do I see Nightfall fitting in? This is a bit of an eye chart, but uh Nightfall and Starlight are designed to sort of check all the boxes that enterprises have for privacy. So, Nightfall is a ZK-ZK Rollup and Starlight is a zero-knowledge circuit compiler.

So, you want to make a smart contract, you want it to run as a zero-knowledge circuit, so run like a black box on chain, use Starlight to make a smart contract, use Nightfall to do the payments and the asset transfers, and that way we get to those two pieces of privacy I'm talking was talking about. The money then stuff movement and the smart contract logic. Very importantly, we do not allow for anonymous transactions. We fundamentally believe that privacy does not mean anonymity. Privacy means your competitors can't see what you're doing. Privacy means your peers can't see what you're doing. It doesn't mean that you can anonymously move money around. And that is really important. We make a big differentiation between privacy and anonymity, and it's

something that I think the institutions and regulators care a great deal about. Um win or lose in this little of longer-term ecosystem, the thing that makes me happy is this picture I could not build 8 years ago when we started. If I had made this picture 8 years ago when we started, it would be EY and Aztec, and that would be it. Right? And I wouldn't be able to check any boxes because nothing was really yet. So, uh I am super happy to see the progress of this industry has had, and I have always believed that just the act of getting this process started will trigger movement, and I think it really has.

Uh Uh, I am a privacy optimist. I know I I've talked to I'm out now of EY and I'm going to raise money for all the you know, for my startup and uh, I have talked to a lot of people and I'll tell you there are some burned out privacy hopers out there. I had a VC, she's like, "I'm sorry. I just don't believe anymore, right? This is not going to happen." I still believe, right? And one of the things that makes me believe is that although we're starting from a very low base, privacy transactions are starting to go up and they're starting to go up at the same rate as overall Ethereum transactions.

And I believe that's a precursor to privacy transactions starting to actually grab share as enterprises come on chain and really drive this forward. And I I personally really believe that while consumers and they can kind of take it or leave it on privacy, many of them don't understand it, enterprises get it, they care about it, and they will use it when it is available. Now, is the path completely clear? I would say argue not entirely yet, but we are so close, right? It's no longer fundamentally illegal to use privacy software. Um, all the sanctions have been removed from the software. The SEC leadership in the United States has very directly, concretely said that there is a role, there's a legitimate use for

privacy software. The thing that's missing is a kind of privacy version of the Clarity Act, like a clear set of rules the rules that that says, "Hey, if you do these things with your privacy technology, uh, it's totally good, right?" And that is that's important thing. I don't think we're there yet. I have talked to many, many regulators over the years about privacy technology and although I think they're very smart and they're very thoughtful, it's not real for them yet. There just isn't a huge volume of transactions until and until it's real and until there's serious volume of privacy transactions, then they'll start sit down and be like, "Oh, you know know thing that we sort of thought was probably be okay. it turns out we're not okay with that and we need some changes. So, I do not I I don't

anticipate that we're going back to where things were before, but I won't be surprised if we hear from regulators that there are changes that they need to the way privacy protocols operate. Like that's coming for sure. So, what happens now? In addition to me coming to the end, I think first of all, I'm just fundamentally optimistic. This is a survey that EY did last year of institutions and back in 2025 towards the end of the year, EY talked to about 250 large companies and they asked them a question like, are you going to use stablecoins next year?

And 54% This is like a mind-blowing statistic. 54% said yes, we are going to get on the stablecoin train in 2026. That is a huge increase. That's like the average from 2025 is about 10%. That's a 4x increase in the number of enterprises using stablecoins. What are they going to use it for? Supplier payments, international payments, domestic payments. The The thing to know about all of this is these are all sensitive business transactions. Who you're paying, how much you're paying, how regularly you're paying them, that is all sensitive business information and you will need to care about privacy for those applications.

How quickly will this happen? I believe if you go look at at at sort of big historical cases of large-scale transformation, they're not one or two years of 1,000% growth. They tend to be something that looks more like 15 to 25 years of 15 to 25% a year growth. So, we can together me sooner than you ride this wave to retirement. Like this is this is going to go on for years and years and years. Transformation at scale takes a long time and we know this from tons of different marketplaces. I think there are huge number of waves of transformation coming. We We've just started with like supplier payments, but there's tokenized securities, there's decentralized finance, there's private

markets that have liquid assets that can be tokenized and made liquid, there's industrial assets and use cases, right? Everybody everything and everybody is getting tokenized. It's only a question of when. And that is it for me right on schedule. This is my QR code and thank you so much for your time and attention. It is a delight to be here back in Cannes. Thank you all. Ciao.