The Ethereum Foundation put a tool on mainnet this week that lets people pay for AI model access without the provider learning who they are. On its second day, the contract holding the money contains 0.4488 ETH, worth about $1,195.
That figure is not a footnote. It is the measure of how much privacy the system can currently give anyone.
What it does
A user deposits ETH into a vault contract, where the balance becomes a private note. For each request the user’s own device produces a zero-knowledge proof that the note holds funds, without revealing which note it is. A server checks the proof and returns a short-lived, capped API key carrying no name and no payment detail. The provider sees the prompt. The payment layer sees the spend. Neither sees both.
The client exposes standard OpenAI and Ollama interfaces on localhost, so existing apps work by pointing at it. zkAPI was built with the Open Anonymity Project and announced by Vittorio Rivabella, Davide Crapis and Vitalik Buterin.
Privacy is a crowd, not a proof
A zero-knowledge proof hides which note paid. What it cannot do is hide that note inside a short list. Deposits land on a public chain, so if there are very few of them the proof narrows to a handful of candidates and timing and amounts close most of the remaining gap.
The number that decides it is the anonymity set, and anyone can check it. The vault sits at 0x4386fdbda35d995beb3bf8625118ec5982ec81fe, verified on chain. It has processed 58 transactions and holds 0.4488 ETH. Its Merkle tree is 32 levels deep, which is room for 4.29 billion private notes.
Capacity is not the constraint here. Company is.
What is not in the vault
No USDC. The contract holds no ERC-20 tokens at all, despite USDC appearing across the launch coverage as a funding option and in the Foundation’s own description of the vault. Whatever the code allows, every deposit so far has been native ETH.
The Foundation is direct about two further gaps, naming “the lack of network anonymity, and privacy leakage via prompt contents”. A stable IP address can correlate requests, for which it suggests routing over Tor, and an inference provider can re-link sessions through writing style, reused conversation history or the same project documents. The protocol is described as experimental, and no formal audit has been published.
None of this makes the design weak. The cryptography is not the open question. Adoption is, and for once it is a privacy claim a reader can audit for themselves at a published address.
