Reflecting on privacy in the cryptocurrency environment, one can note that cryptocurrencies are often presented as anonymous means of payment, although there is also a claim that tracking the movement of digital funds is much easier than tracking the movement of fiat currencies such as the dollar. To reconcile these two claims, it is first of all necessary to understand what privacy means in the cryptocurrency world. Answering this question is not as simple as it seems at first glance, because the term «privacy» in the field of blockchain technologies can denote a multitude of different phenomena. At the same time, understanding it is extremely important for developers, investors and other participants in the crypto-economic system. Let's try to make sense of this question.

Let's consider three main aspects of privacy in the context of digital assets, which include: the personal information of the user making a cryptocurrency transaction; data about the operation being carried out; general information about the state of the blockchain, obtained by combining data about all transactions. In order to make access to this information, or obtaining it by calculation, impossible (or theoretically extremely difficult) for an outside observer, cryptography may be used in the protocol. At the same time, those who seek to obtain some information about the blockchain may combine individual fragments of it in order to learn the information they are interested in or at least make corresponding assumptions. In this sense, the main task from the standpoint of privacy is to develop a protocol that will disclose to potential attackers the minimum possible amount of information about specific transaction attributes.

It is important to note that the privacy of certain attributes is far from an unambiguous phenomenon. For example, certain information may be known to some observers and unknown to others, or observers may make certain assumptions without being fully confident in them. This duality often makes claims such as «Cryptocurrency X guarantees privacy» or «Cryptocurrency X is more private than Cryptocurrency Y» meaningless. Moreover, when used carelessly, such statements can lead to confusion and incorrect interpretations, and that is precisely why they can be used to deliberately mislead users. We believe that it is far more reasonable to make more specific statements such as «in Monero the transaction amount is private» or «in ZCash the senders' addresses are anonymous to a certain degree». As we will see later, in some cases cryptographic tools such as zero-knowledge proofs can help in analyzing such statements or even provide solid arguments in their favor.

So, let's consider each of the aspects of privacy with respect to cryptocurrencies separately. Privacy of personal information (anonymity) Anonymity is the first thing that comes to people's minds when they hear the word «privacy». Anonymity means the absence of a link between a user's actions and his real identity. One of the most easily ensured varieties of it is so-called «pseudonymity»: in essence, this is exactly what various online services guarantee us by assigning pseudonyms such as bitcoinlover2008 instead of our real names. In this situation, in most transactions involving other users of the protocol, data about the natural or legal person of the user bitcoinlover2008 will not appear. In most cryptocurrency networks, including Bitcoin, users are assigned a public and a private key. The public one serves as an analogue of a login, and the private one as an analogue of a password. Whoever obtains the private key, on legal grounds or by theft, can generate messages «signed» with your name, and with the help of the public key anyone can verify and confirm their authorship. Thanks to this function, users can, for example, receive bitcoins on one or several public keys-addresses and control their funds and send them using the private key – and all this without the intervention of centralized bodies. These concepts form the foundation of modern mathematical cryptography and are of great interest in themselves. However, for our purposes, possessing a combination of a public and a private key simply means a way to implement the concept of pseudonymity in the context of decentralized networks. Because of this pseudonymity usually inherent in cryptocurrency protocols, representatives of the media and the general public form a mistaken impression that cryptocurrencies are anonymous or, at the very least, provide much greater anonymity than merely using pseudonyms. It is not surprising that this misunderstanding leads to people beginning to use cryptocurrencies for illegal purposes, whether it be online gambling or transactions on the darknet.

However, the actual level of anonymity of cryptocurrencies may seriously disappoint such users: they do indeed send and receive coins to public addresses, and their real names are not disclosed when making transactions, yet as a result of certain actions these addresses can quite well be linked to their real personal data.

Firstly, most users acquire bitcoins on exchanges for fiat funds. Carrying out transactions in ordinary currencies, as a rule, requires interaction with the banking system and the provision of real personal data. As we mentioned earlier, in Bitcoin all information about transactions is public in nature, so anyone who has access to an exchange's database can link public addresses to users' real names. For example, if Alice withdraws 0.1 BTC through Coinbase to an address belonging to her, the service will be able to link her real name to this key. And if she sends 0.2 BTC to the address of an illegal site that accepts online sports bets, then an outside observer can conclude that Alice is participating in illegal gambling activity and even provide incontrovertible public evidence of this fact. Such techniques are called blockchain analytics and are used by companies such as Chainalysis to group public addresses by user, establish their connection to real identities and analyze transaction flows.

Secondly, carrying out a transaction using cryptocurrency requires sending some information over the internet. Under certain circumstances, metadata about such interactions can be used to track the IP address of the user who carried out the operation, and even the use of anonymizers such as Tor does not prevent this. The combination of these two factors makes carrying out fully anonymous transactions using the property of pseudonymity alone an extremely difficult task. Privacy of transaction information When speaking about the privacy of cryptocurrencies, people usually mean the privacy of some aspects of transactions. Loosely speaking, a transaction is an action that a user performs in order to change the state of the blockchain. For example, Alice can send X coins from her wallet to Bob's wallet. Even in such a seemingly innocent situation, several fragments of data can be obtained at once: one of Alice's addresses – the connection between Alice's and Bob's addresses; one of Bob's addresses; the amount of coins sent. More complex transactions can contain other types of information as well. A vivid example of this is the smart-contract code in Ethereum. Different blockchains present transaction data differently, and some of these methods make it possible to hide certain aspects from an outside observer who sees only the «raw» data recorded in the blockchain. That is precisely why we titled this section «Privacy of transaction information» rather than «Privacy of transactions», since the degree of privacy of various types of transfer data can differ. The most important information that can be hidden is the addresses of Alice and Bob. If they are private, then determining the sender and recipient of a transaction from the information about it will be impossible. This can also hinder the conduct of blockchain analysis. Thus, if Alice buys the cryptocurrency Monero, which has such a characteristic, through the popular exchange Binance and then withdraws it from there, Binance will not be able to link this withdrawal to any of Alice's subsequent operations with these coins. And if Alice transfers Monero to Bob, then he will also not be able to learn that the coins were bought on Binance. Moreover, the answer to the question of whether a certain fragment of information about a transaction is private cannot be binary.

In the example with Alice's address, the degree of privacy can be assessed by the value of the anonymity set. The anonymity set is the minimum set of addresses by which it is possible to compute the sender of a transaction, based solely on blockchain data. The higher its value, the less information about the sender is contained in the blockchain data. For example, in the case of Bitcoin the value of the anonymity set for the simplest and most straightforward transactions equals one, since the sender's address is contained in the transfer information, whereas for Monero this figure will be much higher. Privacy of information about the full state of the blockchain In the case of Bitcoin, all transaction data is public. This means that an outside observer, having access to the records in all the blocks of the chain, can reconstruct the ledger of balances of each of the addresses (although they can be divided into different UTXOs (Unspent Transaction Output), or unspent transaction outputs – indivisible parts of a bitcoin tied to a specific owner). This is what we call information about the full state of the blockchain.

However, if some aspects of transactions are private, then knowledge of all the records in the blockchain will not give a user knowledge of the full state of the blockchain. It is distributed among different users, and the blockchain guarantees the consistency of their knowledge. Despite the fact that a user's knowledge of certain aspects of the blockchain's state depends only on the protocol and awareness of the transactions that led to the formation of the current state, the connection between them can create complex interactions. As a result, various attributes of the full state of the blockchain may turn out to be private to different degrees, for example: the list of all addresses; the balance of an individual address (for example, the wallet 0x2569C92345013F55CFb47C633c57F2f5756B9acA holds 1 ETH); the smart-contract code at a specific address (for example, the code of the CryptoKitties smart contract at the address 0x06012c8cf97BEaD5deAe237070F9587f8E7A266d); information associated with a contract (for example, the data stored in the CryptoKitties contract).

Here is a simple example: in ZCoin the amount of each transaction is public, however the information about the sender and recipient is private, which means that the data about the balance of their wallets also remains private. On the other hand, in Mimblewimble the security of information about the state of users' accounts is ensured differently: here transaction amounts are private, while information about the sender and recipient is public. Mimblewimble users must store their funds themselves, and the blockchain only stores enough information to rule out the possibility of expenditures exceeding the amounts belonging to the users. In most cases, hiding the characteristics of transactions is beneficial to individual users, but in the context of the blockchain this is not always so. For example, if the total number of coins of a particular cryptocurrency is private, then users cannot verify such characteristics of the protocol as, for instance, the issuance schedule. In addition, under such conditions it is difficult to notice an attacker who exploits cryptographic vulnerabilities or loopholes in the protocol for the unauthorized issuance of new coins.

Therefore, when reflecting on privacy in the cryptocurrency environment, instead of general phrases such as «MyCoin is more private than TheirCoin», try to answer the following questions: are certain fragments of information (which ones?) about the state of the world (at what moment?) private (to what degree?) for certain people (for whom?). Such an approach will allow us to assess privacy technologies and their trade-offs more objectively.