DeFi

when

Metis

Threshold

<a href="https://www.usenix.org/system/files/usenixsecurity24-choudhuri.pdf" rel="noopener noreferrer nofollow" target="_blank">Batched Threshold Encryption (BTE)</a> builds on foundational concepts such as <a href="https://en.wikipedia.org/wiki/Threshold_cryptosystem" rel="noopener noreferrer nofollow" target="_blank">threshold cryptography</a>, which enable secure collaboration among multiple parties without exposing sensitive data to any single participant. BTE is an evolution of the earliest TE-encrypted mempool schemes, such as Shutter, <a href="https://cointelegraph.com/news/applied-mev-protection-via-shutter-s-threshold-encryption" rel="noopener noreferrer nofollow">which we have covered previously</a>. For now, all existing work on BTE remains at the prototype or research stage, but it could shape the future of decentralized ledgers if successful. This creates a clear opportunity for more research and potential adoption, which we will explore in this article.&nbsp;
On most modern blockchains, transaction data is publicly viewable in the <a href="https://cointelegraph.com/learn/articles/what-is-the-bitcoin-mempool" rel="noopener noreferrer nofollow">mempool</a> before it is sequenced, executed and confirmed in a block. This transparency creates avenues for sophisticated parties to engage in extractive practices known as Maximal Extractable Value (<a href="https://cointelegraph.com/learn/articles/what-is-mev-ethereums-invisible-tax" rel="noopener noreferrer nofollow">MEV</a>). MEV exploits the block proposer’s ability to reorder, include or omit transactions for financial gain.&nbsp;
Typical forms of MEV exploitation, such as frontrunning and sandwich attacks, remain pervasive, particularly on Ethereum, where, during the flash crash on Oct. 10, an estimated <a href="https://eigenphi.io/mev/ethereum/dailyReport/arbitrage/2025-10-10" rel="noopener noreferrer nofollow" target="_blank">$2.9 million was extracted</a>. Accurately measuring total extractive MEV remains difficult because <a href="https://dl.acm.org/doi/10.1145/3487552.3487811" rel="noopener noreferrer nofollow" target="_blank">roughly 32%</a> of these attacks were privately relayed to miners, with some involving over 200 chained subtransactions in a single exploit.
Some researchers have sought to prevent MEV with mempool designs, where pending transactions are held encrypted until block finalization. This prevents other blockchain participants from seeing what trades or actions the transacting users are about to take. Many encrypted mempool proposals use some form of <a href="https://en.wikipedia.org/wiki/Threshold_cryptosystem" rel="noopener noreferrer nofollow" target="_blank">threshold encryption (TE)</a> for this. TE splits a secret key that can unveil the transaction data among several servers. Akin to a multisig, a minimum number of signers must work together to combine their key shares and unlock the data.
<h2 id="strong-why-bte-matters-strong">Why BTE matters</h2>
Standard TE struggles to scale efficiently because every server must decrypt each transaction separately and broadcast a partial decryption share for it. These individual shares are recorded onchain for aggregation and verification. This creates a server communication load that slows the network and increases chain congestion. BTE solves this limitation by allowing each server to release a single constant-sized decryption share that unlocks an entire batch, regardless of size.&nbsp;
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-10/019a06fd-cf4a-7e86-9f09-8a904e28bafb" title="" alt="How Batched Threshold Encryption could end extractive MEV and make DeFi fair again">
</figure>
The first functional version of BTE, developed by <a href="https://www.usenix.org/system/files/usenixsecurity24-choudhuri.pdf" rel="noopener noreferrer nofollow" target="_blank">Arka Rai Choudhuri, Sanjam Garg, Julien Piet and Guru-Vamsi Policharla</a> (2024), used the so-called <a href="https://eprint.iacr.org/2023/1350.pdf" rel="noopener noreferrer nofollow" target="_blank">KZG commitment scheme</a>. It lets the committee of servers lock a polynomial function to a public key while keeping that function initially hidden from both users and committee members.
Decrypting transactions that are encrypted to the public key requires proving that they fit into the polynomial. Because a polynomial of fixed degree can be fully determined from a set number of points, the servers only need to collectively exchange a small amount of data to provide this proof. Once the shared curve is established, they can send out a single compact piece of information derived from it to unlock all transactions in the batch at once.&nbsp;&nbsp;
Importantly, transactions that do not fit within the polynomial remain locked, so the committee can selectively reveal a subset of the encrypted transactions while keeping others hidden. This guarantees that all encrypted transactions outside the selected batch for execution remain encrypted.
Current TE implementations, such as <a href="https://eprint.iacr.org/2022/898.pdf" rel="noopener noreferrer nofollow" target="_blank">Ferveo</a> and <a href="https://ieeexplore.ieee.org/document/10174966" rel="noopener noreferrer nofollow" target="_blank">MEVade</a>, could therefore integrate BTE to preserve privacy for non-batch-included transactions. BTE also fits naturally with layer-2 rollups such as <a href="https://docs.metis.io/hyperion" rel="noopener noreferrer nofollow" target="_blank">Metis</a>, <a href="https://docs.espressosys.com/network/" rel="noopener noreferrer nofollow" target="_blank">Espresso</a> and <a href="https://docs.theradius.xyz/" rel="noopener noreferrer nofollow" target="_blank">Radius</a>, which already pursue fairness and privacy through time-delay encryption or trusted sequencers. By using BTE, these rollups could achieve a trustless ordering process that prevents anyone from exploiting transaction visibility for arbitrage or liquidation gains.
However, this first version of BTE had two major drawbacks: It required a full reinitialization of the system, including a new round of key generation and parameter setup each time a new batch of transactions was encrypted. Decryption consumed significant memory and processing power as nodes worked to combine all partial shares.
Both of these factors limited BTE’s practicality; for instance, the required frequent DKG execution for committee refresh and block processing made the scheme effectively prohibitive for moderately sized permissioned committees, let alone any attempt to scale to a permissionless network.
For cases of selective decryption, where validators only decrypt profitable transactions, BTE makes all decryption shares publicly verifiable. This allows anyone to detect dishonest behavior and penalize offenders via slashing. It keeps the process reliable as long as a threshold of honest servers remains active.
<h2 id="strong-upgrades-to-bte-strong">Upgrades to BTE</h2>
Choudhuri, Garg, Policharla and Wang (2025) made the first upgrade to BTE to improve server communication through a scheme called the <a href="https://www.usenix.org/system/files/usenixsecurity25-choudhuri.pdf" rel="noopener noreferrer nofollow" target="_blank">one-time setup BTE</a>. This scheme only required a single initial <a href="https://en.wikipedia.org/wiki/Distributed_key_generation" rel="noopener noreferrer nofollow" target="_blank">Distributed Key Generation (DKG)</a> ceremony that runs once across all decryption servers. However, a multiparty computation protocol was still required to set up the commitment for each batch.
The first truly epochless BTE scheme came in August 2025 when Bormet, Faust, Othman and Qu introduced <a href="https://eprint.iacr.org/2024/1533.pdf" rel="noopener noreferrer nofollow" target="_blank">BEAT-MEV</a> as a single, one-time initialization that could support all future batches. It achieved this using two advanced tools, puncturable pseudorandom functions and threshold homomorphic encryption, allowing servers to reuse the same setup parameters indefinitely. Each server only needed to send a small piece of data when decrypting, thus keeping server communication costs low.
<h3 id="strong-overview-of-projected-performance-strong">Overview of projected performance</h3>
Down the line, another paper called <a href="https://eprint.iacr.org/2025/1419.pdf" rel="noopener noreferrer nofollow" target="_blank">BEAST-MEV</a> introduced the concept of Silent Batched Threshold Encryption (SBTE) that removed the need for any interactive setup between servers. It replaced repeated coordination with a non-interactive, universal one-time setup that allows nodes to operate independently.
However, combining all the partial decryptions afterward still required heavy interactive computation. To fix this, BEAST-MEV borrowed BEAT-MEV’s sub-batching technique and used parallel processing to let the system decrypt large batches (up to 512 transactions) in under one second. The following table summarizes how each successive BTE design improves on the original BTE design.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2025-10/019a072f-f78a-7695-975b-2e3dbaf259ed" title="" alt="How Batched Threshold Encryption could end extractive MEV and make DeFi fair again">
</figure>
BTE’s potential also holds for protocols such as <a href="https://docs.cow.fi/" rel="noopener noreferrer nofollow" target="_blank">CoW Swap</a> that already mitigate MEV through batch auctions and intent-based matching, yet still expose parts of the order flow in public mempools. Integrating BTE before solver submission would seal that gap and provide end-to-end transaction privacy. For now, Shutter Network remains the most promising candidate for early adoption, with other protocols likely to follow once implementation frameworks become more mature.
This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.
Cointelegraph does not endorse the content of this article nor any product mentioned herein. Readers should do their own research before taking any action related to any product or company mentioned and carry full responsibility for their decisions.

How Batched Threshold Encryption could end extractive MEV and make DeFi fair again

Table of Contents

Cointelegraph

Other articles published on Oct 21, 2025

Join our free newsletter for daily crypto updates!