Ethereum: L2BEAT Ranks Privacy Protocols Against 5 Adversaries

From layer-2 to privacy protocols. The L2BEAT platform has just launched a new section that evaluates each privacy protocol based on several criteria. The analysis platform, which has become the unofficial arbiter of the decentralization of Ethereum rollups, applies the method that has earned it its reputation: breaking down trust assumptions instead of distributing labels.

Tired of rankings based on TVL, volume, or other metrics that are not always relevant, L2BEAT offers a technical approach by analyzing the core of the protocols, their decentralization, and the trade-offs induced by their structure.

Key Points

• L2BEAT now evaluates each privacy protocol according to five distinct adversary profiles, without a single overall score.
• The grid ranges from the passive observer of the blockchain to the state adversary capable of coercing an operator.
• No protocol protects against all five: Zcash, Privacy Pools, or Railgun make different trade-offs.
• The platform adopts the Stages method that pushed Ethereum rollups to reduce their administrative powers.

L2BEAT Filters Privacy Protocols Through the Lens of Five Adversaries

L2BEAT has built its reputation by refusing the easy path of ranking by TVL or volume. Initially, the platform allowed for the comparison of different layer-2 solutions on Ethereum. Its risk roses and its three-tiered L2 advancement scale, from Stage 0 to Stage 2, have compelled Arbitrum, Optimism, and their competitors to publicly document the building blocks of their infrastructure. Their emergency keys, the composition of their security councils, and their withdrawal times have all been scrutinized. Now, the platform aims to apply the same approach to an even more obscure domain: privacy solutions.

List of 11 privacy solutions analyzed by L2BEAT -- Source: L2BEAT.

Indeed, not all privacy solutions are created equal. They do not all have the same approaches and degrees of privacy. For instance, a mixer can obscure the link between a deposit and a withdrawal for someone who only reads the chain. However, the mixer can deliver the user's IP address to the RPC provider relaying their transaction, undermining the attempt at privacy.

To measure these different solutions, L2BEAT has identified five attacker profiles ranging from the most mundane to the most well-armed:

• the passive observer, who only exploits public chain data;
• the transaction counterparty, who already knows part of the context;
• the infrastructure operator (relay, sequencer, RPC node), who sees the metadata;
• the protocol team, often holding update keys or a secret from the trusted setup, the ceremony for generating the initial parameters of a proof system;
• the state adversary, capable of coercing an operator, assigning a host, and correlating network traffic.

Currently, no protocol checks all five boxes. Zcash's shielded pool performs very well against on-chain analysis but much less so against targeted network surveillance. Systems built on association sets, Privacy Pools leading the way, accept leaving a door open for verifying the origin of funds. Ranking these different solutions in the same classification finally makes comparison possible for a user who has neither the time nor the skills to audit a cryptographic circuit.

Aztec, Zcash, Kohaku: Crypto Privacy Has Changed Scale

The timing is not coincidental. Earlier this year, Vitalik Buterin published Ethereum's roadmap for the horizon 2029. This reaffirms the intention to bring native privacy to Ethereum.

Privacy also seems to be at the heart of user needs. Thus, we have seen several recent increases in the price of Zcash, notably driven by the influx of funds into its shielded pool. Aztec has opened its public testnet after seven years of work on zero-knowledge proofs. Railgun, Privacy Pools, and a series of younger projects are now competing for users who had no serious tools to differentiate their respective guarantees.

Legal pressure is also increasing. Indeed, the European anti-money laundering regulation will prohibit digital asset service providers from holding anonymous accounts and processing privacy cryptocurrencies starting in July 2027. In the United States, the OFAC removed Tornado Cash from its blacklist in spring 2025, but the partial verdict rendered against its developer Roman Storm keeps the criminal threat hanging over code authors. Knowing precisely against which adversary a protocol protects is no longer a mere curiosity for cryptographers.

L2BEAT is already inviting the concerned teams to contest their ratings on its Discord, just as it did for the rollups. Several chains had then delivered their fraud proofs and trimmed their administrative powers to achieve Stage 1, under the gaze of a dashboard consulted by the entire ecosystem. Applied to privacy protocols, the same mechanism will force each team to write down the exact limits of what it promises.