Privacy on Ethereum

Ethereum Korea One: Genesis · Day 2 · 2026-09-29 · 31:58 · In Korean

Can onchain finance go mainstream if a single address reveals your entire financial life? At Ethereum Korea One: Genesis, Seungmin Jeon of Sunnyside Labs shares how his team built fast onchain privacy that keeps self-custody intact.

Watch on YouTube

Speakers

Seungmin Jeon, Core Engineer, Sunnyside Labs

About this session

This talk covers the problems and technical tradeoffs the team faced while building Privacy Boost, Sunnyside Labs' onchain privacy solution. It walks through the limits of existing solutions, why the team combined ZK and TEE, the choice of Groth16, a design that lets users withdraw even if the server disappears, and the V2 features, followed by Q&A.

Key takeaways

If one wallet receives your salary, pays at a cafe, covers rent, and puts funds to work in DeFi such as Aave, a single address exposes your whole financial life. If a company pays salaries onchain, employees learn each other's pay. Jeon said that, personally, he sees onchain privacy as important for mass adoption.
When the team discussed development in November 2025, it set three requirements. First, speed (Railgun can take from several seconds to over 10 seconds for a ZK proof depending on the device, and a chain scan to view balances can take minutes). Second, working with existing wallets such as EOAs, Safe, and MPC, and with Ethereum's liquidity. Third, letting users withdraw on their own even if the server disappears.
Client-side ZK (Railgun, Privacy Pools) struggles with speed, privacy chains like Aztec must bootstrap users and liquidity, and FHE is roughly 100x slower than ZK. Privacy Boost generates ZK proofs inside a TEE server instead of on the user's device, producing proofs in under a second and serving balance and transfer history APIs without chain scans. Because ZK and the contracts define which state transitions are valid, even a hacked TEE cannot take funds at will.
For the proof system, the team chose the veteran Groth16. Since the circuit mostly checks Merkle proofs and ZK-friendly hashes, there was no reason to accept zkVM overhead such as STARK wrapping or compressing proofs of hundreds of KB. Halo2 was complex to implement, and Noir, reviewed early this year, cost about 2M gas to verify onchain. The price is redoing a trusted setup every time the circuit changes.
Like an L2 escape hatch, each transfer's counterparty and amount are encrypted with the user's viewing key and stored onchain, so if the TEE server disappears, users can decrypt them, generate a ZK proof, and force a withdrawal. Note ownership was also changed from a spending public key to an account ID, linked via an Auth Registry to EOAs, smart accounts, Safe, and MPC wallets. This slightly raises proving costs but makes key rotation and compatibility with existing wallets much easier.
After the first launch in March, V2 around August added Safe and MPC support, an exchange-style deposit address (an EOA delegating auto-shield code via EIP-7702), and Gateway for interacting with external DeFi such as Morpho and Uniswap. It is live on Base and OP Mainnet, targeting under 500ms of latency per transfer. In Q&A, Jeon said liveness depends on the TEE server, but HA and multi-region setups reduce the single point of failure, and if a Gateway trade fails on tight slippage, the principal is reshielded. His conclusion: there is no perfect privacy solution, and users unwilling to trust a server are better served by client-proving designs like Railgun.

Chapters

← Videos · EK1 Genesis event record