That framing is too simple for the problem Midnight is trying to solve.
Midnight launched publicly in March with a hybrid ledger designed to combine private and public data in a transaction, using zero-knowledge proofs and shielded assets while leaving room for compliance-oriented disclosure. The Block reported that the Cardano-linked network maintains its own ledger, consensus, smart-contract environment and dual-token model, while positioning privacy as an ingredient for real-world assets and institutional use.
The difficult engineering question begins after the private transaction succeeds: how can its owner prove one fact to one party without turning that proof into a durable public record or a standing surveillance permission?
That is selective disclosure. It should be treated not as a feature attached to a private ledger, but as a complete protocol for deciding who learns what, for how long, for what purpose and with what ability to reuse the evidence.
Trust boundary: only the proof crosses; neither the witness nor the full transaction history does
The proof is not the record
Midnight’s basic proposition is attractive because many institutional transactions cannot be fully public. A merchant may need to know that a payment is valid, an auditor may need evidence of provenance and a regulator may need confirmation that a transaction met an eligibility or reporting condition. None necessarily needs the sender’s entire financial history.
A user should therefore be able to make narrow claims:
- This payment exceeds the required amount.
- This wallet passed a required screening rule at a specified time.
- This asset originated from an approved issuance program.
- This account has enough collateral.
- This transaction is not connected to a restricted asset class.
The crucial word is narrow. A zero-knowledge proof can establish that a statement is true without delivering the underlying witness, such as a balance, identity credential, transaction graph or private contract state.
That distinction matters because a proof can be private while the surrounding system remains highly observable. A public commitment may reveal that some state exists. A recurring identifier can reveal that several claims came from the same holder. An onchain disclosure event can create a timestamped trail. An auditor with a persistent viewing key may acquire much more than an auditor who receives a single proof.
The disclosure design, not the existence of cryptography alone, determines which of these outcomes occurs.
Four viewers, four different truths
A hybrid ledger can serve distinct audiences without giving each audience the same data. But this only works if the protocol makes the difference explicit.
For a merchant, the appropriate proof may be that a payment settled, that it covers an invoice and that it has not been spent before. The merchant does not automatically need a persistent window into the customer’s wallet.
For an auditor, a proof may need stronger evidentiary properties. It may need a reporting period, an issuer reference, an attestation policy, a proof-generation timestamp and a way to validate that the proof was generated under the right rules. That is still different from handing over a key that exposes every subsequent transaction.
For a regulator, the claim might be more specific still: the holder was eligible at the moment of transfer, the asset stayed within a permitted distribution perimeter, or the transaction was screened against an approved list. These are compliance outcomes, not an argument for universal readability.
For an unrelated observer, the answer should generally be much less. The observer may see a transaction commitment, a fee payment or a state transition, but should not be able to link it reliably to balance, identity or counterparty.
The difference between those four positions is the practical meaning of selective disclosure. If a merchant, auditor and regulator all receive the same reusable access credential, the system has flattened them into one privileged surveillance class.
Design the disclosure flow before the transaction
A credible disclosure protocol needs more than a checkbox marked “private.” It needs rules for issuance, scope, expiration and verification.
First, a private state must produce a commitment that can be anchored to a ledger without publishing the sensitive information itself. Second, the user must hold the witness that supports a proof about that commitment. Third, the verifier must receive only the proof and any deliberately disclosed public inputs.
The public inputs need discipline. If the same identifier, destination or policy tag appears across multiple proofs, verifiers may be able to join records even if they never see the shielded state.
The proof should also be counterparty-specific. A proof intended for Merchant A should not automatically be usable by Merchant B. Binding a proof to a verifier identity, transaction context, invoice reference or challenge nonce can reduce replay risk.
Time matters too. A balance proof generated at 9 a.m. is not a general proof that the wallet remains funded at 5 p.m. An eligibility proof may need an explicit validity period. A provenance proof may be permanent in principle but still need to identify the issuance rules and version under which it was created.
That is why viewing keys and one-time proofs should never be treated as equivalents. A viewing key is an access relationship. A proof is evidence of a specified claim. The former may expose a stream of activity. The latter should establish only one proposition.
Revocation is where privacy systems meet operational reality
Revocation is often described loosely, but several different things can be revoked.
A protocol can revoke a credential, invalidate an eligibility status, rotate a viewing key, blacklist an issuer attestation, supersede a compliance policy or mark a prior proof as no longer acceptable after expiration. It cannot make a verifier forget data that was already disclosed.
That sets the practical limit. The best revocation mechanism is often minimizing what was handed over in the first place.
Revocation can stop future acceptance, but cannot erase disclosed evidence
Audit evidence therefore needs its own boundary. A verifier may need to preserve proof receipts, policy versions and validation results. But an audit archive that includes permanent transaction identifiers, raw customer credentials or reusable viewing material can quietly recreate the public database that the private system was meant to avoid.
The test is simple: could a later analyst combine the audit records to rebuild a participant’s activity history? If the answer is yes, the compliance workflow may be more revealing than the ledger.
Metadata remains the hard part
Even a well-scoped proof does not erase metadata. Timing can expose business activity around a known announcement. Fees can reveal transaction class. Transaction size and contract-call patterns can distinguish one application workflow from another. Reused addresses, public deposits and withdrawals, or application-level account state can link otherwise shielded actions.
This is especially important for institutions. The Block’s May 7 institutional privacy analysis argued that public transaction visibility has become a hurdle to institutional adoption, citing the competitive sensitivity of trading and settlement data. It also described differing approaches across chains, including Midnight’s hybrid ledger, Solana’s confidential balances and Avalanche’s permissioned networks.
Those approaches are comparable only at the level of the problem: controlling business-sensitive data while enabling settlement and compliance. They are not interchangeable architectures. A permissioned network controls who may enter. Confidential balance systems control what a ledger reveals. A hybrid ledger seeks to make public and private state coexist, then lets applications decide which facts cross the boundary.
CoinDesk’s interview with Midnight Foundation president Fahmi Syed framed the project around “rational privacy,” a concept aimed at balancing institutional requirements and individual control. The phrase is useful only if the controls are concrete: narrowly defined claims, verifier binding, limited retention, revocation checks and defences against metadata correlation.
Midnight’s launch makes private transactions possible. Its harder test is whether developers and institutions build disclosure systems that preserve the difference between proving a fact and granting access to a life.
Jesica Davis is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and gpt-5.6-terra. Out on the live web: gpt-5.6-terra and gpt-5.6-luna. Pictures: gpt-image-1 and flux. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Jesica Davis's usual length and in Jesica Davis's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.