The last chapter separated AI output, human forecasts, and market prices. Privacy is a different frontier: ZK privacy markets—designs where zero-knowledge proofs let participants prove rule compliance, solvency, or eligibility without publishing wallet identity, full positions, or corporate hedging intent to every browser with a block explorer. Privacy is a feature for treasuries and researchers; it is a bug for surveillance, manipulation detection, and dispute resolution unless engineers and lawyers design around that tension. Cryptography does not erase jurisdiction; verify where you may trade.
What zero-knowledge means for traders (no math lecture)
You care about outcomes, not circuit diagrams. A proof of valid trade might show “order accepted” on your screen while the chain stores encrypted or hashed legs. Proof of balance might let you withdraw without leaking your whole portfolio map. Proof of eligibility might gate a restricted SKU without putting a passport on-chain. Proof of resolution input might count a vote without naming the voter.
The question is always whether counterparties, certifiers, and regulators can still trust settlement when they cannot see the book.
Why prediction markets want privacy
A corporate hedger on a public chain risks competitors front-running policy bets from wallet clustering. A whistleblower thesis risks retaliation if every fill is searchable. Retail political exposure has produced doxxing and harassment from public profit-and-loss maps. Regulators, meanwhile, want provable compliance—not necessarily public compliance theater.
Election hedging and geopolitical desks from the professional applications block treated leakage as operational risk, not paranoia. Privacy tools address observability risk; they do not remove resolution risk or INVALID wording.
The integrity tradeoff
Hidden positions raise confidentiality and lower the ease of spotting wash trading. Hidden oracle voters raise bribery-and-coordination opacity—the dispute cases from on-chain history are the warning. A common compromise is public resolution, private trades: cleaner disputes, masked sizes. Fully public chains are easiest to audit; privacy AMMs need new trust gadgets because bootstrap liquidity fails when nobody can see depth.
Conditional efficiency assumes someone can reconcile open interest; hidden aggregates can look deep until you try to trade size.
Treasury hedging a rumor
A regulator might approve “Deal X” by June 30. A public thin market shows 44¢ YES; the treasury needs two million dollars of notional hedge; the stock moves when wallets are known. A privacy venue offers accredited eligibility proofs and hidden size. You still scout belief blind, use limits, and read the PDF. If approval pays, ERP records the hedge line; if denied, loss stays inside size rules; if INVALID, the adverb in the certifier text matters more than the cryptography.
Privacy removed who saw you trade; it did not remove what settles the contract.
Reputation without doxxing
A researcher might lock forecasts before events, then publish a zero-knowledge proof that Brier score beat a threshold over N events—hash on chain, wallet unnamed. Reputation markets could price “verified forecaster” with caveats: check N, check domains, check whether the proof circuit was audited. Academic replication wants calibration without exposing a lab’s live political book.
Attacks and mitigations (forward-looking)
Sybil voters with fake identities, forged proofs from circuit bugs, ghost liquidity that claims hidden depth, jurisdiction shopping behind VPNs, selective-reveal extortion—privacy shifts manipulation from public wash to proof gaming. Mitigations look like staked identities, audited circuits with slow rollout, proof-of-reserves at size tiers, compliance proofs instead of IP geolocation alone, and legal paths for court-ordered disclosure where law requires.
Builders should fail closed: if a dispute cannot access evidence, do not list marquee politics on privacy rails.
Should you trade there?
Ask whether loss is bounded if the proof system fails, whether resolution byte-matches a liquid reference you trust, whether depth is verifiable at your size, whether counsel accepts the compliance story, and whether the oracle path is documented. Two “no” answers mean treat the venue as shadow-only—log ideas, do not size them.
Bank bilateral confidentiality names the counterparty and answers subpoenas; ZK on-chain designs vary. Mandates that need named counterparties may stay on the TradFi path in the next chapter.
Regional posture (high level)
US experiments may sandbox privacy features while political retail stays contested. EU data-minimization culture aligns with selective disclosure in principle; national gambling law still fragments products. UK innovation paths exist product by product. Global crypto defaults to public ledgers; ZK becomes differentiation—not a geo bypass.
Journalists and identical resolution
A cabinet resignation by Friday might trade on a public venue and a privacy venue with the same thesis and identical resolution hash. The public wallet risks a doxxing case study; the private leg reduces path visibility. INVALID from wording drift hits both—spec beats privacy tech every time.
Liquidity bootstrapping under privacy
Market makers hesitate when they cannot see inventory; privacy AMMs compensate with proof-of-reserves tiers, aggregate open-interest bands, or delayed public snapshots. None of these replace the efficiency test from foundations: if you cannot verify depth at your clip, the mid is decorative. Bootstrapping grants from treasuries—whether DAO or corporate—still need surveillance hooks regulators can audit even when wallets are masked.
Compliance officers and privacy
Counsel will ask who can deanonymize under court order, how travel rules apply at bridges, and whether hidden whales can move political SKUs. A privacy feature that blocks dispute evidence is a product liability, not a marketing bullet. Tiered participation—retail public, corporate permissioned—may be the compromise law accepts before global anonymous political books.
Public chain habits you may need to unlearn
On-chain traders grew up with open profit-and-loss maps and wallet labels. Privacy venues ask you to trust proofs instead of explorers. That shift is uncomfortable—and necessary for some corporates. It does not remove the habit of reading resolution first, simulating effective price, or journaling theme exposure. Privacy changes observability, not discipline.
When public books remain default
If your mandate requires named counterparties, surveillance the compliance officer understands, and tax reporting the CPA has seen before, public regulated books may remain default for size. Privacy legs are overlays for specific hedges, not a moral upgrade for every ticket.
How this fits Module 15
Arbitrage still needs observable prices on at least one leg. Geo and KYC do not vanish behind proofs. On-chain dispute literacy still applies. Less social pressure when profit and loss is hidden does not remove the need to journal trades you care about.
Selective disclosure in plain terms
Selective disclosure means proving “I am eligible” or “I had collateral” without showing the world your full book. It is attractive for corporates and frightening for monitors. The implementable middle path is often aggregates public, legs private—enough for integrity checks, not enough for front-running. Demand that middle from builders if you size on privacy rails.
Key ideas to carry forward
ZK privacy trades observability for confidentiality—integrity needs stronger proofs, not weaker rules. Corporates and researchers face leakage risk public chains amplify. Dispute resolution gets harder when voters and whales hide. Traders add compliance and oracle evidence to the same gates you already use before size. Corporates and researchers face leakage risk public chains amplify. Dispute resolution gets harder when voters and whales hide; phased rollout beats launch-first marketing. Traders add compliance and oracle evidence to the same gates you already use before size.
Oracle voters under privacy
When dispute voters are hidden, bribery and coordination are harder to detect and harder to disprove. Protocols that care about legitimacy may publish voter weights after disputes conclude while keeping live votes private—a compromise monitors can live with. Traders should price higher dispute tail risk on venues that cannot show any post-hoc accountability.
What comes next in Module 15
Privacy answers confidentiality; regulated integration answers custody and surveillance the compliance officer already understands. Most users will live in hybrid stacks—read prices globally, size where law and depth allow.
Next: 15.4 TradFi Integration — Kalshi Blueprint—how regulated event contracts plug into clearing, brokerage, indices, and the compliance stack mainstream capital already trusts.