Track me if you can: Ephemeral coin tracing
2026-08-10 • Cryptography and Security
Cryptography and SecurityDistributed, Parallel, and Cluster Computing
AI summaryⓘ
The authors address the problem that current privacy-focused payment systems allow authorities to trace suspicious transactions without limits, risking user privacy. They propose a new method called ephemeral coin tracing (ECT) which limits tracing to a fixed number of users and transaction steps, after which the trace disappears. This means that authorities can only follow suspicious activity for a short, controlled time and cannot track transactions indefinitely. The authors provide formal definitions and two ways to build this system using advanced encryption techniques.
privacy-preserving payment systemscentral bank digital currencies (CBDCs)financial crime tracingtransaction graphephemeral coin tracing (ECT)ElGamal encryptionDamgård–Jurik encryptionledger deanonymizationcryptographic tracing
Authors
Ignacio Amores-Sesar, Christian Cachin, Rohit Chatterjee, Luiza Soezima, François-Xavier Wicht, Michelle Yeo
Abstract
Privacy-preserving payment systems are well understood, yet their adoption in regulated settings, such as central bank digital currencies (CBDCs), institutional stablecoins, and other compliant payment infrastructures, has been limited by concerns over their potential misuse for illicit activities. Regulators counter financial crime with a toolbox of complementary measures to identify, trace, and stop criminal actors. Tracing is one key tool: acting on outside evidence that a user is implicated in a crime such as money laundering, law enforcement follows the suspect's funds through the ledger to uncover laundering routes and accomplices. The tracing schemes proposed in the literature, however, grant authorities unbounded capabilities: once initiated, tracing propagates through the transaction graph or persists across all future transactions of a user, and may eventually deanonymize the entire ledger. Only the goodwill of the authority, or the honesty of a committee, keeps surveillance targeted and temporary. We introduce ephemeral coin tracing (ECT), a primitive whose tracing capacity is bounded by construction, both in the number of simultaneously traced users and in the number of hops each trace survives. The authority issues tracing tags that degrade at each hop; after a protocol-defined number of hops, a tag collapses into a value indistinguishable from that of an untagged coin. Within a tracing period the bound is absolute: no authority, however motivated, can follow a tag past its budget. We formalize ECT, define its security and privacy guarantees, and give two constructions, one over exponential ElGamal and one over Damgård--Jurik encryption.