This week: our waitlist hit 50K and we launched a mini-series on why private payments matter, Vitalik published a long-term roadmap for privacy at Ethereum's base layer, a new RWA privacy standard already has a leak flagged in review, and Aztec brought back zk.money before its own disclosed bug is fixed.
In House
A few things from our side first.
What happened at Raycash this week:
We just crossed 50,000 people on the waitlist.
We also kicked off a mini-series called They’re Watching You, a few short pieces on why private payments on chain actually matter in practice, not as an abstract idea. First one’s out now.
Join the waitlist at raycash.xyz →
On Our Radar
Here is what got us excited this week:
Vitalik lays out where Ethereum’s privacy is actually headed
Vitalik published a long essay this week walking through how different Ethereum will look by 2030 compared to 2015. The clearest part is a table he includes: privacy of writes goes from “hope nobody analyzes the transaction graph” to actual zero-knowledge proofs, privacy of account policy goes from nothing to SNARKs plus private account abstraction, and network-layer privacy moves from “assume most mempool nodes are honest” to onion routing and mixnets built in. He’s calling the end state a “cryptographic world computer.” Not really a blockchain in the 2010 sense anymore. Closer to a system where cryptography does the work trust used to do.
Coming from Vitalik specifically, this reads like something other teams will build against for years. Worth reading the table in full. It’s the most concrete version we’ve seen yet of what privacy at the base layer is actually supposed to look like once this ships.
A new Ethereum standard tries to make compliant privacy work, and a reviewer already found a leak
A developer opened a draft called ERC-8424 this week, extending an existing private-token standard to give issuers real controls: freezing, forced transfers, eligibility checks, all while balances stay encrypted. It’s built for RWA issuers who need both confidentiality and the power to step in when compliance requires it.
A reviewer flagged a real problem within days. Two of the functions in the draft have no restriction on who can call them, so an attacker could work out a hidden balance in as few as 64 queries.
Worth remembering next time a “privacy plus compliance” pitch sounds too clean. Getting the legal framing right is the easy part. Getting every function locked down correctly is where these things actually fail, and it’s already happening here before the standard is even merged.
Aztec brought back zk.money
Aztec Labs relaunched zk.money this week, the private payments wallet it shut down back in 2023. The original had 75,000 wallets and over $100 million in volume before it closed. The new version hides balances, amounts, and who you’re paying, runs on Aztec’s own network, and lets you send money to a readable name instead of a wallet address.
Here’s the part that actually matters. Aztec disclosed a critical flaw in its proving system back in August, and the fix isn’t shipping yet. They launched anyway, capping user transaction at $2,500 and daily protocol deposits at $50,000, specifically to limit what a worst case looks like while that fix is still in progress.
Credit where it’s due, that’s a more honest way to handle a known risk than most teams manage: cap the damage and say so out loud instead of hoping nobody notices. Still worth being straight about what it means. Use zk.money before V6 ships, and you’re choosing to trust a system with a disclosed hole in it, caps or not.
Thanks,
From the Raycash team
