Built for the Money That Was Never Going to Move in Public
# Whitepapers
# Private Payments
# Privacy
# Product Launches
A look at the thinking behind Arc's new privacy whitepaper, and the features that set our approach apart from every other swing at onchain privacy.
Tim Baker
Everything onchain is visible to everyone, forever. That isn't a flaw. It's the feature that lets a stranger trust a ledger without trusting the operator, the broker, or the person on the other side of the trade. It's also a ceiling. The world's financial workflows were never meant to run as public data feeds, and most of them still can't.
We just published Arc's privacy whitepaper, formally titled "Arc Privacy Sector." Arc is designed to be the Economic OS for the internet, an open platform for the world's financial markets, real-time money movement, and agentic economic activity, and this paper is about how confidentiality is designed to live inside that platform instead of bolted on beside it. One flag up top: this is a proposed design, and the features it describes are not live yet. Read it as a direction, and as a paper worth arguing with.
Why privacy is the unlock
The paper starts from a plain observation: most blockchains expose transaction data and smart-contract state by default, and that breaks the moment a workflow looks like real finance. In its words, "trade secrets and regulation alike require companies to safeguard financial data."
It gets concrete. A payroll contract can't broadcast compensation amounts, employee identities, and schedules to the market. A lending protocol can't ask every borrower to publish collateral and liquidation risk in real time and pretend that doesn't move the market against them. An issuer needs to enforce transfer rules and vesting without making its cap table globally readable. Intraday repo is more sensitive still: collateral, counterparties, and funding needs can reveal a firm's liquidity position before a trade even settles.
The paper argues that the missing piece was never just "privacy." It's confidentiality with an access model. Regulated finance can't use a black box any more than it can use a glass box. Compliance teams, auditors, and sometimes regulators need defined visibility; the public may not. Privacy, with governed visibility, not anonymity.
The hard part was adoption, not cryptography
The paper's central claim is one line from the introduction: "The primary obstacle is no longer pure cryptography."
The industry has had privacy techniques for years. Most never became the default for onchain finance because they change too much about how you build. Zero-knowledge designs tend to fit narrow flows better than arbitrary composable contracts. Fully homomorphic encryption runs orders of magnitude too slow for general transaction processing. Multi-party computation makes you reason in secret shares instead of ordinary contracts. Enclave systems get closest to normal execution, but usually live as standalone chains, which turns private state into somewhere you bridge into and out of.
Arc Privacy goes at the adoption problem instead. Keep the EVM. Keep existing Solidity close to untouched. Keep public and private execution under one consensus process, and let builders choose where confidentiality belongs rather than rebuilding the whole app around a separate privacy universe.
Two environments, one chain
The proposed design is one blockchain with two execution environments. Public activity runs on Arc in the clear. Private activity runs in a private EVM inside hardware enclaves. You sign with a normal EVM key, encrypt the payload to the network's public key, and submit through an Arc precompile. Under the proposed architecture, the public chain sees a precompile call and opaque ciphertext; the enclave decrypts, executes, and commits an encrypted private state root into the Arc block.
The part that matters is that public and private state finalize together, in the same consensus round, in the same block. The paper names this synchronous execution and treats it as its core distinction. Most privacy systems are standalone chains or asynchronous Layer 2s, so a private contract has to bridge back to the public world and wait. Here a private contract and a public one coordinate inside a single block, with no separate chain and no delayed bridge. Privacy stops being a side room and becomes part of the building.
Value crosses the same boundary through a controlled bridge: you shield a token to move it into the private side, where the Arc-side asset is locked or burned and a private mirror is minted, and unshield to reverse it. Supply stays in parity, so a wrapped private balance can't mint tokens that don't exist on Arc.
Governed visibility
The query model is where this gets useful for institutions. There are three ways to read private state: an unauthenticated plaintext query for public-safe reads, an unauthenticated encrypted query that protects the request on the wire while the caller stays anonymous, and an authorized query where the caller proves identity through an EIP-712 signature and the contract answers based on who's asking.
The governed, identity-based query is the real institutional unlock. A compliance team gets the view it needs, an auditor gets the access required for an audit, a counterparty sees the slice relevant to its trade, and everyone else gets nothing. That's not anonymity, it's access control over private state, and for real financial applications that distinction is the product.
Underneath it all, no single validator holds the keys. The master secret is split across validators and only reconstructed inside an attested enclave, at a threshold tied to Arc's BFT safety bound, so a colluding minority can't decrypt private state. Encryption on the wire is hybrid post-quantum, classical paired with post-quantum, to blunt harvest-now-decrypt-later.
What it unlocks
The workflows the paper reaches for are the ones public-by-default chains have kept offchain. Payroll, where compensation logic runs onchain while amounts, recipients, and schedules stay sealed and audit access is preserved. Lending, where positions and collateral activity stay private through their lifecycle instead of becoming an open target map. Asset issuance, where transfer rules, vesting, and holder activity are managed without publishing every detail. Intraday repo, where terms and counterparties settle programmatically without broadcasting a firm's funding pressure. Each runs in the same block as the public activity it touches, which is the part that wasn't possible before.
In the paper's three-node enclave benchmark, none of this slows the public chain: public throughput holds near 2,800 TPS while private transfers land around 1,070.
Arc's privacy features reflect a proposed design that includes selective shielding of certain onchain data elements. The scope, functionality, and rollout timeline of the Arc privacy features are subject to change and may be modified, delayed, limited, or discontinued at any time in the sole discretion of Arc Network Services LLC.
Arc testnet is offered by Circle Technology Services, LLC ("CTS"). CTS is a software provider and does not provide regulated financial or advisory services. You are solely responsible for services you provide to users, including obtaining any necessary licenses or approvals and otherwise complying with applicable laws.
Arc has not been reviewed or approved by the New York State Department of Financial Services.
The product features described in these materials are for informational purposes only. All product features may be modified, delayed, or cancelled without prior notice, at any time and at the sole discretion of Circle Technology Services, LLC. Nothing herein constitutes a commitment, warranty, guarantee or investment advice.
