Internet of things (IoT) development tends to reduce the reliance on centralized servers. The zero-trust distributed system combined with blockchain technology has become a hot topic in IoT research. However, distribution data storage services and different blockchain protocols make network interoperability and cross-platform more complex. Relay chain is a promising cross-chain technology that solves the complexity and compatibility issues associated with blockchain cross-chain transactions by utilizing relay blockchains as cross-chain connectors. Yet relay chain cross-chain transactions need to collect asset information and implement asset transactions via two-way peg. Due to the release of user transaction information, there is the issue of privacy leakage. In this article, we propose a cross-chain privacy protection protocol based on the Groth16 zero-knowledge proof algorithm and coin-mixing technology, which changes the authentication mechanism and uses a combination of generating functions to map virtual external addresses in transactions. It allows fast cross-chain anonymous transactions while hiding the genuine user’s address. The experiment shows that, in a zero-trust IoT context, our scheme can effectively protect user privacy information, accomplish controlled transaction traceability operations, and guarantee cross-chain transaction security.