One more thing - we forgot to explain the system itself.
We spent quite a bit of time thinking through the design, so here is a simpler overview.

At first, we considered making every transaction anonymous. But that would create noticeable computational overhead on the user’s device, which is unacceptable for us. We aim for the same level of optimization as Telegram and TON. That means cryptographic operations must be cheap for the CPU on any device. Because of that, we even decided to support both current cryptographic standards and post-quantum-ready ones.

That said, the topic here is not encryption but anonymity. So what is the solution?

When a user joins a chat, the blockchain sees it as an anonymous entry. You are assigned an internal chat ID, and that is the identifier that appears in the blockchain history. Using a zero-knowledge proof, the blockchain can verify that it was indeed you who joined the chat, without learning your real identity. As a result, instead of generating a zk-proof for every message, we only require it once at the moment of joining.

After introducing this approach, we had to revisit the models for rate limits, moderation, and several other parts of the messenger. Fortunately the migration did not significantly alter the core domain model, so we were able to adapt quickly.

Building a decentralized messenger on top of a custom blockchain is quite a quest.