💻 computer science

Track me if you can: Ephemeral coin tracing

This paper introduces "ephemeral coin tracing" (ECT), a privacy-preserving primitive for regulated payment systems that cryptographically enforces strict, absolute limits on the duration and scope of law enforcement tracing to prevent unbounded surveillance while still enabling the investigation of illicit activities.

Original authors: Ignacio Amores-Sesar, Christian Cachin, Rohit Chatterjee, Luiza Soezima, François-Xavier Wicht, Michelle Yeo

Published 2026-08-11

📖 7 min read🧠 Deep dive

CC BY 4.0

Original authors: Ignacio Amores-Sesar, Christian Cachin, Rohit Chatterjee, Luiza Soezima, François-Xavier Wicht, Michelle Yeo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your digital wallet is a magical, invisible vault. You can send money to friends, buy coffee, or pay bills without anyone knowing who you are or how much you spent. This is the promise of "privacy-preserving payment systems," a field of cryptography that has been building invisible vaults for decades. But there's a catch: if these vaults are too perfect, they become hiding spots for bad actors. Criminals could use them to launder money or fund terror without a single trace. Governments and banks need a way to peek inside only when they have a good reason, like a warrant for a specific suspect, without stripping away the privacy of everyone else. The big question has always been: How do you give the police a flashlight to follow a criminal's money trail without accidentally blinding the entire city?

This paper introduces a clever solution called "Ephemeral Coin Tracing" (ECT). Think of it as a magical tracking sticker that fades away on its own. In the past, tracing tools were like a permanent, glowing paint that, once sprayed on a suspect, would follow their money forever, lighting up every transaction they ever made and potentially exposing innocent people who just happened to trade with them. The authors propose a new system where the "sticker" has a built-in expiration date. It can only travel a specific number of steps (or "hops") through the network. Once it hits that limit, the magic fizzles out, and the trail goes cold, becoming indistinguishable from a normal, untracked coin. This ensures that even the most determined authority cannot follow a suspect's money beyond a pre-set boundary, protecting the privacy of the vast majority of users who are not under investigation.

The Problem: The "Forever Flashlight"

For a long time, digital payment systems had a dilemma. If you wanted to stop money laundering, you usually had to give the authorities a "forever flashlight." Once they turned it on for a suspect, that light would follow the money wherever it went, through every transaction, every wallet, and every exchange. If a criminal passed money to a friend, and that friend passed it to a cousin, the light would follow all the way down the line.

The problem is that this light doesn't just follow the criminal; it illuminates everyone they touch. If a suspect buys a pizza, the pizza shop's other customers get lit up too. If the suspect transfers money to a legitimate business, that business's entire history might get exposed. The current tools in the literature grant authorities "unbounded capabilities." Once the tracing starts, it can spread through the whole transaction graph or follow a user's future transactions forever. The only thing stopping them from spying on everyone was supposed to be the "goodwill" of the authority or the honesty of a committee. But as the authors point out, relying on people to be nice isn't a very strong security system.

The Solution: The "Fading Ink" Sticker

The authors, a team of cryptographers from universities in Denmark, Switzerland, and Singapore, introduce a new primitive called Ephemeral Coin Tracing (ECT). They describe it as a "tracking sticker" that is mathematically programmed to fade away.

Here is how it works in their system:

The Setup: When a warrant is issued for a suspect, the authority doesn't just tag the money; they tag it with a specific "budget" of steps. Let's say the budget is 10 hops.
The Journey: Every time the money moves from one person to another, the tag takes a "step." With every step, the tag gets weaker. It's like a battery that drains a little bit with every transaction.
The Fade: After exactly 10 steps, the tag hits zero. It collapses into a value that looks exactly like a normal, untagged coin. Even the authority who put the tag there can no longer see it. It has become "ephemeral"—temporary and gone.
The Safety Net: Crucially, this fading process is built into the math of the system. No matter how much the authority wants to keep watching, they cannot force the tag to last longer than the budget. The limit is fixed by public parameters, meaning anyone can check the rules, and the authority cannot change them to spy more.

How the Magic Happens: The "Nilpotent" Trick

The paper gets technical here, but the core idea is a mathematical trick called "nilpotent degradation." Imagine you have a special ink that changes color every time you touch it.

Step 1: The ink is bright red (the suspect's tag).
Step 2: It turns orange.
Step 3: It turns yellow.
...
Step 10: It turns completely clear.

In the real world, if you mix a clear liquid with a red liquid, you usually get a pinkish mess. But in this cryptographic system, the "clear" liquid (the expired tag) is special. When it mixes with other tags, it doesn't ruin them; it just disappears. This allows the system to handle complex situations where money from a traced suspect mixes with money from innocent people. The traced part fades away on its own schedule, while the innocent parts remain invisible to the tracker.

The authors provide two ways to build this system:

Exponential ElGamal: This version uses a specific type of math group where the numbers get smaller and smaller until they hit zero. It creates very small, compact tags, which is great for speed, but the math gets tricky if you want to track a huge number of people at once.
Damgård–Jurik: This version uses a different mathematical structure that is a bit larger but allows for much more efficient tracking of many people at once. It's like choosing between a tiny, fast sports car (ElGamal) and a slightly bigger, more versatile SUV (Damgård–Jurik).

Why This Matters

The paper argues that this approach solves the "privacy vs. regulation" deadlock.

For the Innocent: If you are not a suspect, your privacy is untouched. Even if you trade with a suspect, the "flashlight" will eventually run out of battery before it can trace your entire history.
For the Authorities: They can still investigate crimes. They can follow a suspect's money for a specific number of hops to find accomplices or laundering routes. But they are forced to stop. They can't just keep watching forever.
For the System: The rules are transparent. The "hop budget" (how far the tag can go) is set in the public parameters. If a government wants to change the rules to allow longer surveillance, they have to change the public code, which everyone can see. They can't do it in secret.

What the Paper Does Not Do

It is important to note what this paper does not claim.

It does not solve the problem of retroactive tracing. If a crime happened in the past and no one was tagged at the time, this system cannot go back and tag that old money. It only works for "prospective" tracing—tagging money after a warrant is issued.
It does not automatically identify who the suspect is. It just follows the money. The system still needs the legal process to link the wallet to a real person.
It does not claim to be a "perfect" solution that eliminates all crime. It is a tool to make targeted tracing safer and more bounded.

The Verdict

The authors have mathematically proven that this system works. They showed that the tags will expire exactly when they are supposed to, and that the authority cannot alter the system to make them last longer. They also proved that the tags are indistinguishable from normal coins, so a user cannot tell if they are being watched or not.

In the end, this paper offers a new kind of balance. It suggests that we don't have to choose between a totally private world where crime runs wild and a totally transparent world where everyone is watched. We can have a system where the police have a flashlight, but the flashlight has a timer. It shines brightly enough to catch the bad guys, but it turns off before it blinds the rest of us. It turns the "goodwill" of the authority into a hard, mathematical rule that cannot be broken.

Technical Summary: Ephemeral Coin Tracing (ECT)

1. Problem Statement

Privacy-preserving payment systems, including Central Bank Digital Currencies (CBDCs) and institutional stablecoins, face a critical adoption barrier: regulators require mechanisms to trace illicit funds (e.g., money laundering) without compromising the privacy of law-abiding users. Existing coin-tracing schemes in the literature grant authorities unbounded capabilities. Once a trace is initiated, it either propagates indefinitely through the transaction graph or persists across all future transactions of a targeted user. This lack of cryptographic bounds means that, absent the "goodwill" of the authority or the independence of a committee, surveillance can eventually deanonymize the entire ledger. Current mitigations, such as threshold committees, bound who can trace but not how much can be traced; a qualified majority retains the same unbounded power as a single entity.

The paper asks: Can we design a simple and efficient protocol that bounds the surveillance capacity of the tracing authority (both in the number of users and the duration of the trace) while still allowing for targeted tracking of criminal activity?

2. Methodology: Ephemeral Coin Tracing (ECT)

The authors introduce Ephemeral Coin Tracing (ECT), a cryptographic primitive where tracing capacity is bounded by construction. The core mechanism relies on nilpotent degradation within an additively homomorphic encryption scheme.

Core Mechanism

Nilpotent Degradation: The system utilizes a plaintext ring containing a nilpotent element $\nu$ $ν$ of index $h$ $h$ (where $\nu^h = 0$ $ν^{h} = 0$ but $\nu^{h-1} \neq 0$ $ν^{h - 1} \neq = 0$ ).
- A tracing tag is an encryption of a user identifier.
- Each "hop" (a policy-defined step, such as an outgoing transfer) applies a public degradation operation that multiplies the plaintext by $\nu$ .
- After exactly $h$ hops, the plaintext becomes $0$ (the identity element).
- Once the value is $0$, it remains $0$ under further degradation. The tag becomes indistinguishable from a dummy (untagged) coin, even to the authority holding the secret key.
Merging and Positional Encoding:
- When funds from multiple sources merge, their tags are combined homomorphically.
- To prevent collisions between identifiers and degradation depths, the system uses a positional encoding (base- $r$ for identifiers, base- $q$ or base- $N$ for depths).
- This ensures that an expired contribution (value 0) acts as a neutral element, vanishing without destroying live contributions from other depths.
Security Guarantees:
- Indistinguishability: Users cannot determine if their coin carries a traceable tag or a dummy tag.
- Unlinkability: Rerandomization ensures that a tag before and after degradation cannot be linked.
- Unforgeability: Only the authority can issue valid tags; users cannot create tags that trace to unauthorized identifiers.
- Ephemeral Traceability: Once a tag exceeds its hop budget $h$ , the authority cryptographically loses the ability to recover the identifier. This is an unconditional guarantee, not reliant on computational hardness assumptions.

Constructions

The paper provides two concrete instantiations of the ECT template:

Exponential ElGamal:
- Operates in a cyclic group of order $q^h$ (where $q$ is prime).
- The nilpotent element is the prime $q$ ; degradation raises ciphertexts to the power of $q$ .
- Pros: Compact tags.
- Cons: Tracing complexity is exponential in the number of simultaneously traced users ( $K$ ) due to a meet-in-the-middle search; requires non-standard DDH assumptions in prime-power-order groups.
Damgård–Jurik Encryption:
- Operates over the ring $\mathbb{Z}_{N^s}$ where $N$ is an RSA modulus and $s=h$ .
- The nilpotent element is the modulus $N$ ; degradation raises ciphertexts to the power of $N$ .
- Pros: Tracing is polynomial-time ($O(nh)$) regardless of the number of traced users; relies on the standard Decisional Composite Residuosity (DCR) assumption.
- Cons: Larger tag sizes compared to the minimal ElGamal construction.

3. Key Contributions

Definition of ECT: The first coin-tracing scheme with cryptographically enforced expiry. The hop budget $h$ is fixed in public parameters and cannot be exceeded by the authority.
Bounded Surveillance: The scheme bounds both the breadth (number of simultaneously traced users, limited by the plaintext modulus) and the depth (number of hops, limited by the nilpotent index).
Efficient Merging: A novel method for merging tags from different users and different degradation depths without collision, preserving live tracing signals while allowing expired ones to vanish.
Two Constructions: Formal security proofs for two distinct instantiations (ElGamal and Damgård–Jurik) satisfying trace correctness, merge correctness, indistinguishability, ephemeral traceability, unforgeability, and unlinkability.

4. Results and Performance

Correctness: The authors prove that tags degrade exactly as intended: a tag issued with budget $h'$ remains recoverable for $h'$ hops and becomes indistinguishable from zero thereafter.
Security: The scheme satisfies all defined security properties. Notably, Ephemeral Traceability is proven unconditionally (information-theoretic) for the degradation step, meaning no amount of computational power can recover an identifier once the budget is exhausted.
Efficiency Trade-offs:
- ElGamal: Suitable for small hop budgets and few simultaneous traces (e.g., 0.75 KB tags for $h=10$ ). Tracing cost scales with the number of active targets.
- Damgård–Jurik: Suitable for larger sets of targets and heavily merged tags (e.g., 4.1 KB tags for $h=10$ ). Tracing cost is independent of the number of active targets, scaling only with the system parameters.

5. Significance and Claims

The paper claims that ECT fundamentally shifts the privacy-regulation tradeoff from a matter of institutional restraint to one of cryptographic design.

Explicit Bounds: The authority's surveillance capacity is made explicit and auditable via public parameters ( $h$ and $n$ ). No authority, however motivated, can silently widen the scope of surveillance beyond these parameters.
Targeted Privacy: ECT allows for targeted investigations without deanonymizing the general user base. The "overwhelming majority" of users retain full privacy guarantees, as their coins carry dummy tags that are indistinguishable from traced ones.
Prospective Nature: The authors explicitly note that ECT is prospective. It can only trace funds from the moment a warrant is issued forward. It does not support retrospective mass surveillance of past transactions, which limits its potential for abuse compared to unbounded tracing schemes.
Application Scope: The primitive is designed for permissioned, account-based payment systems (like CBDCs) and can be integrated with existing regulatory tools (e.g., account freezes, transaction limits) but does not replace them. It requires the ledger to carry and validate tags but avoids the heavy computational overhead of running Secure Multi-Party Computation (MPC) on every transaction.

In conclusion, the paper presents ECT as a "first step" that balances the necessity of regulatory compliance with strong privacy guarantees, ensuring that surveillance is temporary, bounded, and mathematically enforceable.