On most public blockchains, anyone can look up how much is sitting in a wallet. That sounds harmless until a scammer uses it to pick a target. In a new post published November 5, Midnight Foundation CTO Sebastien Guillemot puts it plainly: "on a blockchain, or any network, privacy is security."
The post is part two of a series. Part one explained how shielded assets (tokens whose amounts and owners are hidden on the ledger) help stop targeted phishing. This time, Guillemot opens the toolbox and shows how the hiding actually works.
Why simple scrambling is not enough
You might think a balance could just be run through a hash (a one way math function that turns data into a fixed jumble of characters). The problem, according to the post, is that attackers can pre-calculate hashes "for every common number, such as balances between 1 and 1,000," then simply match them up.
Sealed envelopes with a secret ingredient
Midnight instead uses note commitments. Think of a note as a sealed envelope holding some tokens. The protocol hashes "the note's value combined with the token type, the owner's key, and this random secret," so guessing common numbers no longer works. The post also points to nullifiers (markers that show a note has been used, so it cannot be spent twice) and zero-knowledge proofs (math that proves a transaction is valid without revealing its details).
Viewing keys: share with care
Midnight also offers viewing keys, which give limited visibility into a wallet. Per the post, a viewing key "does not reveal outgoing spends, does not display a cumulative balance, and cannot be used to sign transactions or move assets." Even so, the advice is clear: treat your viewing key like a password and never hand it to untrusted services. Users should also connect only to trusted DApps (decentralized apps), because they "can request your current balance directly from your wallet."
Why it matters
Guillemot's bottom line is that "true security requires protecting people's private data, not publishing it on-chain where it can be accessed and exploited." For everyday users, the takeaway is practical: Midnight builds privacy into the network, but how you share your keys still matters.