The privacy paradox in Ethereum

When Vitalik Buterin took the stage at Devcon 2025 to present the Kohaku demo, he bluntly summed up the Ethereum situation. The network has solid security and privacy research and solid Layer 1 security. But it still hasn’t “leveled up the last mile,” the wallets and apps that people actually utilize.

On paper, Ethereum has been a leader for a decade. Elliptic curve precompilations in 2018 opened the door to compact non-interactive zero-knowledge arguments (zk-SNARKs) and privacy tools like Tornado Cash and Railgun. The 2016 DAO hack pushed the ecosystem toward grave auditing, helped drive demand for strong wallets like Gnosis Unthreatening, and turned multisig from a niche idea to standard practice.

However, everyday private utilize in 2025 still seems clunky. People juggle extra seed phrases, install special wallets hoping that public broadcasters won’t let them down, and often fall back to centralized exchanges because they’re simpler.

Kohaku is an Ethereum solution.

Did you know? The Ethereum Foundation’s modern Privacy Cluster already has around 47 members, ranging from protocol engineers to wallet teams, all charged with bringing “privacy by default” to the ecosystem.

Why will privacy be at the forefront again in 2025?

So why is Ethereum making privacy a core priority again, rather than a niche feature for power users?

In his April essay “Why I Support Privacy,” Buterin described privacy as freedom, order and progress all at once:

• It’s freedom because people need space to act without having their every move recorded and judged.

• This is arranged because many social and economic systems are tacitly based on the fact that not everyone sees everything.

• This is progress because we want to utilize data for medicine, science and finance, without turning everyday life into a constant surveillance channel.

Meanwhile, onchain lives are more vulnerable and the stakes are higher than ever. Real-world assets, larger decentralized finance (DeFi) positions, and public identity are increasingly overlapping. Transparency is useful, but it also means that your balances, donations and contractors can be traced with just a few clicks.

Kohaku gets to this exact point: Ethereum already has the cryptography needed for privacy, but now it needs a way to make that privacy safe and sound, useful, and acceptable in a world that cares about regulation.

Did you know? A recent study of 53 Ethereum wallets found that address poisoning and fraudulent token transfers have already cost users over $100 million, largely because wallet interfaces do not clearly signal suspicious activity.

What is Kohaku in layman’s terms?

Kohaku is best understood as Recent Ethereum privacy and security toolkit for wallets.

For developers, it is an open-source platform from the Ethereum Foundation that includes a modular software development kit (SDK) and a reference wallet. The SDK provides reusable components for private sending, more secure key management and recovery, and risk-based transaction controls so teams don’t have to build an entire privacy stack from scratch.

For users, the first release is a browser extension portfolio aimed at power users, built as a fork of Ambire. It supports private and public transactions, separate accounts for each decentralized application (DApp), peer-to-peer broadcasting instead of centralized relays, and tools to hide Internet Protocol (IP) addresses and other metadata where possible.

Under the hood, Kohaku plugs into existing Ethereum privacy tools like Railgun and Privacy Pools, rather than inventing a modern mixer or Layer 2 (L2) network. This allows it to focus on what was really missing: a consistent wallet architecture where privacy, data recovery, and security are built in from day one, rather than tacked on as experimental add-ons.

How Kohaku works

Under the hood, Kohaku is not “one big app” but rather a stack of Lego bricks for building private, more secure wallets.

First comes the wallet architecture

The SDK defines how a Kohaku-style wallet should handle keys, transactions, and data recovery from day one. Instead of one all-powerful key, it’s designed for multiple keys with different roles, risk-based approvals, and recovery processes that don’t depend on a single seed phrase written on a piece of paper.

A $100,000 transfer may trigger additional checks and confirmations that are never seen in a $10 transfer. This is the kind of risk-based access that Buterin insisted on.

In addition, there is opt-in shielding

Kohaku doesn’t push every trade blindly. This allows wallets to offer public and private modes side by side. If you choose the privacy option, the wallet will be able to traverse protocols such as Railgun or Privacy Pools, generate modern and unlinkable addresses to receive funds, and keep the onchain footprint as petite as possible. Tools like link lists are built into the design so teams can block clearly illegal flows without stripping away everyone else’s privacy.

And finally, online privacy

Finally, the roadmap goes beyond what you write on-chain to include read and network privacy. Kohaku is designed to connect to mixnets to hide IP-level metadata and, over time, to zero-knowledge browsers or remote procedure call (RPC) schemes, so even checking your balance or reading decentralized application data won’t silently reveal who you are and what you’re doing.

Kohaku and Ethereum Privacy Change in 2025

Kohaku matters because it touches on a layer that Ethereum has been grappling with for years: the point at which real people interact with the chain.

For years, research teams have been delivering faster proofs, more capable cryptographic primitives, and more secure contract patterns. But in his Kohaku speech, Buterin’s complaints were much more mundane: extra seed phrases, lack of multisig support in private pools, unreliable senders, and clunky data flows that push people back to centralized exchanges because they’re easier.

By focusing on wallets, it also gives L2 networks and DApps something they have been missing: a common privacy-aware baseline. Instead of each rollup or application coming up with its own hidden address system, recovery flow, and enormous transfer warnings, Kohaku offers patterns and code that everyone can rely on. This is crucial in an ecosystem that increasingly resembles a network of rollups rather than a single chain.

Because this comes from the core Ethereum ecosystem rather than a single startup wallet, Kohaku has a real chance to become the reference model that other wallets aim to match or surpass.

Did you know? Kohaku is designed to be L2 agnostic, so essentially the same privacy-aware wallet patterns can work for rollups, not just on the Ethereum mainnet. This is crucial in a world where most user activity is expected to migrate beyond L1.

Trade-offs, risks and open questions

Kohaku also forces Ethereum to face some uncomfortable questions.

• The first is the boundary between maximum and responsible privacy. Linkage lists, auditable shields and risk-based controls are exactly the features regulators and banks expect. However, for some in the community, any selective visibility or blacklisting looks like the beginning of a slippery slope. Kohaku won’t end this argument; it just makes the tension more apparent.

• There are also technical risks. A wallet that combines multiple keys, recovery paths, privacy switches, various transmission options, and plug-in modules has a larger attack surface than a elementary send-phrase-and-send setup. This requires grave audits and clear policies regarding updates and defaults.

• Then there is the reality of user experience (UX). A framework can suggest good patterns, but it can’t force teams to deliver spotless interfaces. If users can’t tell when they’re sending data privately or publicly, what can be recovered, or which commits are most crucial, all that extra power turns into extra room for error.

A modern test case for privacy by design

For regular users, Kohaku is a sign that using Ethereum privately should stop feeling like a side quest.

The real test is whether major wallets will actually adopt his ideas: clear private and public modes, simpler recovery, additional hassle for enormous transfers, and less chance of exposing your entire online life in one click. If this happens, privacy will just become another setting in the wallet you already utilize.

For developers, Kohaku serves as an infrastructure layer that does a lot of the weighty lifting. Instead of rebuilding primitive privacy and security elements, they can rely on a common set of tools and focus on decentralized application design and UX.

For institutions and regulators, this is a live experiment in privacy by design, a way to test how far Ethereum can go with confidentiality without sacrificing control and legal transparency.