Wormholes: moving ETH without a trace through burn and re-mint
Strawmap Beyond that (Long term) · wormholes
ETH is sent to an address no one can spend from, thereby burning it. Then only a proof that you know the secret is submitted, and the same amount is minted again at a new address. No trace linking the sender and the receiver remains on the chain.
Why it is needed
Ethereum transactions are visible to everyone. The sender and receiver addresses are recorded as they are, so once an address's identity is revealed, every later flow of funds follows it. Mixers such as Tornado Cash break this link, but the fact of having transacted with a mixer contract itself remains on the chain. Both the sender and the receiver can be flagged, and governments can easily block its use. Wormholes do not go through any smart contract and use only ordinary transfers between regular addresses. On the surface it is indistinguishable from sending ETH to a friend, so no one can prove that a privacy feature was used. Every account that has never sent a transaction is in the anonymity set by default, so there is plenty of room to hide. It is a large change that requires adding a function to Ethereum itself to re-mint ETH. The EIP-7503 document is currently marked Stagnant, meaning discussion has stalled, and in the Strawmap it sits in the farthest long-term column.
How it works
- Create a burn address from a secret You choose a secret that only you know and create an address from its hash. This address has no matching private key, so no one can withdraw funds from it. Sending ETH there looks like an ordinary transfer from the outside.
- Create a zero-knowledge proof Later, from a new address, you create a zero-knowledge proof. It hides which burn address it is and proves only that you know the secret of one of the burn transfers recorded on the chain.
- Re-mint with a new transaction type When you send a new transaction type that carries the proof, the protocol creates the same amount of ETH at the new address. A nullifier is recorded for each secret so it cannot be withdrawn twice, and you can withdraw only part and leave the rest as change. The limit is 32 ETH at a time.