privacy pool
A privacy pool is a next-generation mixer that tries to give honest users strong privacy while letting them prove their funds are not connected to known-illicit money. The motivation is the central dilemma of mixers: a simple pool like Tornado Cash gives everyone the same anonymity set, which means law-abiding users are cryptographically indistinguishable from criminals laundering stolen funds — a property that invited sanctions. A privacy pool rebuilds the mixer so that you can keep your privacy and simultaneously demonstrate, in zero knowledge, that you are not in the bad crowd.
The key construction comes from the 2023 paper 'Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium' co-authored by Vitalik Buterin, Ameen Soleimani and others, and realised in implementations such as Privacy Pools on Ethereum. Deposits, as in any zk-mixer, insert a commitment into a Merkle tree. The new ingredient is the association set: when you withdraw, instead of proving membership in the entire deposit set, you prove membership in a chosen subset — an association set — that includes your own deposit but excludes deposits flagged as illicit. Independent parties called association-set providers publish these curated sets (for example, 'all deposits except those traced to known hacks'), and your withdrawal proof commits to the association-set root you used.
The effect is a voluntary, provable dissociation from bad actors without revealing which deposit is yours within the honest set. An honest user picks an association set that screens out tainted deposits and thereby signals cleanliness to exchanges and observers; a launderer cannot construct such a proof against a strict set without including their own dirty deposit, which would fail. Crucially, this is membership-proof based and does not require a trusted operator to approve withdrawals, nor does it deanonymise anyone within the honest subset — your privacy among the remaining honest depositors is preserved.
Privacy pools are a genuine attempt at a practical equilibrium, but they are not a panacea, and honesty about the limits matters. The privacy you get is bounded by the size of the honest association set you choose; choosing a very strict set can shrink your anonymity set. The system depends on the quality, neutrality and governance of association-set providers, which reintroduces a subjective judgement about what counts as 'illicit'. And it addresses the dissociation problem, not all metadata leaks — timing, amounts and network-level correlation still require care.
Two users deposit 1 ETH into the same pool: an honest user and a thief whose deposit is publicly flagged. On withdrawal, the honest user proves membership in an association set defined as 'all deposits minus the flagged ones', which still contains her deposit — her proof verifies and she stays private among the honest. The thief cannot build that proof, because the only set containing his deposit also includes the flag that excludes it.
An association-set membership proof lets the honest withdraw while excluding flagged deposits.
The clever asymmetry is that proving you are NOT in a set of bad deposits is something only an honest depositor can do; a thief cannot exclude their own tainted deposit and still produce a valid membership proof for a strict association set.