Private withdrawals
Withdraw to any fresh address. The relayer pays the gas, so the new wallet never needs funding from the old one.
Private HYPE transfers on Elysium. Deposit from one wallet, withdraw to a fresh one: a zero-knowledge proof made in your browser shows the pool you own a clean deposit, without ever saying which one.
Privacy you can check, built on audited open-source contracts.
Withdraw to any fresh address. The relayer pays the gas, so the new wallet never needs funding from the old one.
Every withdrawal could have come from any approved deposit of at least its size. Each new deposit makes the rest harder to single out, and the app shows you the size of your crowd before you withdraw.
Every deposit is screened against the OFAC list and known scam wallets. Your proof shows you are in the clean set, so honest users never share a crowd with hackers.
The owner role was renounced at deploy. Nobody can upgrade, pause or move funds. Ragequit always returns a deposit to the wallet that made it.
Before you confirm, the app rates the withdrawal from the public deposit set and says what is weak. Split it into smaller parts at random times, to different wallets, in one step.
Your 12-word Veil Key, your notes and every proof stay in your browser. The site sees a proof, an amount and a recipient, and nothing that links them to you.
See what anyone can see about a wallet: where its money came from and where it went, across Robinhood, Ethereum, BSC, Base and Solana.
Three steps. The secret part happens on your device.
Create a 12-word Veil Key. Your wallet sends HYPE with a commitment derived from it: a hash that hides who can spend it.
The deposit is screened for about 30 minutes. Meanwhile others deposit too. Everyone approved is your anonymity set.
Your browser builds a zero-knowledge proof: "I own one of these clean deposits." The relayer submits it to a fresh address and pays the gas. A meter rates how well the withdrawal hides before you confirm it.
These are the circuits and contracts the pool runs on.
// circuits/withdraw.circom (excerpt)
// 3. Your note is somewhere in the pool tree…
component stateRootChecker = LeanIMTInclusionProof(maxTreeDepth);
stateRootChecker.leaf <== existingCommitment;
stateRootChecker.siblings <== stateSiblings;
stateRoot === stateRootChecker.out;
// 4. …and its deposit is in the clean (ASP) set
component ASPRootChecker = LeanIMTInclusionProof(maxTreeDepth);
ASPRootChecker.leaf <== label;
ASPRootChecker.siblings <== ASPSiblings;
ASPRoot === ASPRootChecker.out;
// 6. A spent note can never be spent again
nullifierEqualityCheck.in[0] <== existingNullifier;
nullifierEqualityCheck.in[1] <== newNullifier;
nullifierEqualityCheck.out === 0;Honest limits. If a privacy tool promises more, be careful.
You hide in a crowd. A small pool is a small crowd. Wait, and let others deposit, before you withdraw.
Deposits and withdrawals are public. Depositing 3.712 and withdrawing 3.712 is easy to match. Use round amounts.
Flagged deposits are denied. They can only ragequit, publicly, back to the wallet that sent them.
No accounts, no custody. Your 12-word Veil Key is the only way to withdraw. Write it on paper.
No. Funds sit in a smart contract with no owner. Only someone holding a note's secret can withdraw it, and only the depositing wallet can ragequit.
We run the keeper. Inside a 30-minute window it can deny a deposit a private exit. It cannot move or freeze funds: a denied deposit can always ragequit back to its sender, and after the window anyone can approve a deposit.
The contracts keep working without us. Your Veil Key rebuilds your deposits from the chain, and ragequit needs nothing but the contract.
So hacks can be reported before stolen funds get a private exit, and so more people deposit after you.
A live rating of the withdrawal you are about to make, computed in your browser from the deposit list everyone can read. It counts how many deposits could have been the source, warns when you are taking out exactly what you put in, and tells you when you are withdrawing too soon. Nothing about you is sent anywhere to compute it.
One thing is checked: the wallet that sent the deposit. It is denied if that wallet is on the OFAC sanctions list or on a short list of known scam wallets. Nothing else: no risk score, no chain-analysis vendor, no profile of you. A denied deposit is never frozen, and the denial is an on-chain event with its reason in plain text. Details in the docs.
No protocol fee and no relayer fee: the relayer pays the gas of your withdrawal itself. The contract caps any relayer fee at 0.5%. The minimum deposit is 0.1 HYPE.
Live on Elysium mainnet with real HYPE. The pool contracts are audited upstream; our additions are not audited yet.