Compliance Privacy: What is Kohaku, Ethereum’s Latest Major Privacy Upgrade?

On November 16, Ethereum founder Vitalik showcased Kohaku at Devcon 2025 in Buenos Aires, Argentina—a privacy-first toolkit for the Ethereum ecosystem, aimed at enhancing privacy and security within the Ethereum ecosystem.

What exactly is Kohaku? How does it achieve privacy? Is privacy becoming increasingly important in the Ethereum ecosystem?

Ethereum in 2025: Increasing Focus on Privacy and Security

As early as 2023, Vitalik mentioned the “privacy transformation” in his article “The Three Transitions”:

“Ensure the provision of privacy-preserving fund transfer services, and ensure that all other tools under development (social recovery, identity, reputation) also have privacy protection features.”

“Without a privacy transformation, Ethereum will fail, because making all transactions (and things like POAP) publicly viewable by anyone is too great a privacy sacrifice for many users, and everyone will turn to centralized solutions that can at least hide data to some extent.”

Two months after “The Three Transitions” was published, Vitalik co-authored another article, “How Privacy Pools Protocols Protect User Privacy While Meeting Compliance Requirements.” When we introduce Kohaku later, you’ll see Ethereum’s practical achievements in this direction.

At the end of 2024, Vitalik published a blog post detailing his vision for the ideal crypto wallet, once again emphasizing that “focusing on privacy and security attributes is the most valuable.”

Entering 2025, Vitalik has increasingly mentioned privacy, and the Ethereum Foundation has also taken more actions regarding privacy. In April this year, Vitalik released a simplified Ethereum L1 privacy roadmap.

In May, he posted on social media, stating, “Nordic countries are abandoning the push for a cashless society because their centralized implementation of the concept is too fragile. It turns out that cash as an alternative is necessary. Ethereum needs to be resilient and private enough to play a credible role in such scenarios.”

On September 14, the Ethereum Foundation released an end-to-end privacy roadmap, aiming to build comprehensive privacy protection for the world’s second-largest blockchain. The former “Privacy and Scaling Explorations Team” has been renamed the “Ethereum Privacy Stewardship” (PSE), shifting its focus from speculative exploration to solving real-world problems and optimizing ecosystem outcomes.

On October 9, the Ethereum Foundation announced the formation of the Privacy Cluster, composed of 47 top blockchain researchers, engineers, coordinators, and cryptography experts, aiming to advance privacy protection features for the Ethereum network. The cluster, coordinated by Igor Barinov, will integrate the Foundation’s existing privacy R&D projects and promote new privacy-related initiatives. On the same day, Vitalik reposted the Kohaku roadmap, stating that full-stack privacy and security are Ethereum’s top priorities.

On October 10, the Ethereum Foundation’s funding coordination team and Keyring Network jointly launched a new funding mechanism to support privacy developers.

The latest development is the live demonstration of Kohaku at Devcon. It’s also worth mentioning that in this year of Ethereum’s increasing focus on privacy and security, the most obvious beneficiary among related tokens may be Railgun ($RAIL), which hit a record high of $5 earlier this month—nearly 10 times its lowest price in April this year.

What is Kohaku?

Kohaku is an open-source project designed to enhance on-chain privacy and security. It provides a modular foundational framework that enables developers to build secure, privacy-focused wallets without relying on centralized third-party institutions.

On Kohaku’s official Github page, the documentation mentions three privacy-protecting fund pool protocols: Railgun, Privacy Pools (in development), and Tornado (in development). These protocols allow users to securely hide their funds.

Kohaku may be the largest privacy upgrade scheme for Ethereum to date. To better visualize its workflow, we quote the Kohaku workflow diagram drawn by @iamjosephyoung:

- Suppose Bob has a regular address (0xABC...), and he creates a stealth key pair associated with that address

- Based on this key pair, Alice derives a completely random and one-time stealth address and transfers $1,000 to that address

- Bob scans the network to see if any address corresponding to his stealth key pair has received funds

- Bob spends or withdraws the $1,000, and the one-time address expires and is no longer used

In summary, Kohaku uses the user’s public key to create a temporary stealth address, allowing you to perform private operations without exposing your main wallet association. Stealth addresses are a privacy solution proposed by Vitalik (ERC-5564 standard), allowing the sender to generate a unique, one-time address for the recipient. This address is designed for a single transaction and is not reused, preventing transactions from being traced back to the user’s identity. People can only see that Alice sent money to this address, but cannot know that Bob is behind it, while Bob can directly control the assets in this address through his key pair.

Unlike Tornado Cash’s shared mixer pool for all users, Kohaku does not rely on mixing with other users at all. It complies with regulatory requirements because Bob can selectively disclose the full transaction history as needed.

Railgun even has a decentralized malicious transaction prevention system called “Private Proofs of Innocence,” which uses only publicly available on-chain malicious address sets to prove the safety of fund sources without compromising user privacy, preventing users from receiving illicit funds.

At Devcon, Privacy Pools (@0xprivacypools) gave a live demonstration of this transfer feature.

Kohaku caters to the trend of compliance without undermining auditability, while also addressing privacy needs. In the long run, this could provide a perfect option for institutions to transfer large amounts of funds on-chain.