Proving where funds did not come from
Association sets, and the Tornado Cash aftermath
What Proving where funds did not come from actually says
The 2023 Privacy Pools paper made a design argument that has held up: instead of hiding everything, let a depositor prove in zero knowledge that their withdrawal belongs to a chosen set of deposits, or does not belong to a flagged one. Honest users dissociate from illicit funds without revealing which deposit is theirs, and the policy judgement moves to an identifiable, contestable curator rather than sitting in the protocol. A mainnet implementation launched in 2025. The contrast with Tornado Cash is instructive rather than settled: the Fifth Circuit held in November 2024 that OFAC had exceeded its authority because nobody controls an immutable contract, and the sanction was lifted in March 2025. The criminal case against Roman Storm is a separate matter and remains live, so treat anything you read about it as provisional.
The instruments that matter
- Privacy Pools (Buterin, Illum, Nadler, Schär, Soleimani, September 2023)
- prove in zero knowledge that a withdrawal comes from a chosen association set, or not from a flagged one, without revealing which deposit is yours
- Van Loon v. Department of the Treasury (5th Cir., November 2024)
- OFAC exceeded its authority; immutable deployed contracts are not property of a foreign national because no one controls them
- Tornado Cash delisted March 2025
- following the ruling; the Roman Storm prosecution is separate and still live
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- Anonymity is not the same thing as confidentialityGlobal · Why two privacy designs get treated differently
- Central banks are building confidentiality themselvesGlobal · What the people writing the rules do when they design money
- Erasure against an append-only ledgerGlobal · The one collision with no clean answer yet
- Sanctions screening on a confidential ledgerGlobal · The genuinely open problem
- Selective disclosure as a compliance primitiveGlobal · Bilateral disclosure versus publishing to everyone
- The travel rule binds institutions, not ledgersGlobal · The rule everyone assumes ends on-chain confidentiality
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.