darkpool
Know exactly what stays visible.
Darkpool reduces linkability between your wallets. It does not make you anonymous. This page lists precisely what the protocol hides, what remains public, and how patterns can still give you away.
Hidden inside the pool. Public at the edges.
Everything that crosses the pool boundary is an ordinary, public Ethereum transaction. What happens between those crossings is protected by zero-knowledge proofs.
Hidden
- Which notes fund an action (a withdrawal, a Ghost Buy, a swap).
- Who owns which note in the pool.
- The amounts of private transfers inside the pool.
- The sender and recipient of a private send between Darkpool addresses.
Public
- Deposits: the depositing address, asset, amount and time.
- Withdrawals: the recipient, amount and time.
- Ghost wallets, their balances and every trade they make.
- Fees paid, and when transactions happen.
- Network metadata such as IP addresses seen by the relayer and RPC providers.
Darkpool does not promise anonymity. A small pool, distinctive amounts or telling timing can let observers correlate a deposit with a later withdrawal or trade.
An observer sees the edges and tries to match them.
Picture a block explorer. It shows Address A depositing 1.0 ETH, and some time later Address B receiving 0.4 ETH, or a fresh wallet buying a token. It cannot see a path between them. Its only tools are statistics: how many people used the pool in between, whether amounts match, and whether the timing lines up.
The set of deposits that could plausibly have funded an action is called the anonymity set. It is larger when more people use the pool, when amounts are common, and when more time passes. In an early, capped beta the set is small, so take extra care.
Ways privacy can fail.
Unique amounts
Depositing 3.14159 ETH and withdrawing 3.14159 ETH minus a fee is easy to match.
Quick round trips
A withdrawal minutes after a deposit, with few other users in between, narrows the anonymity set.
Linked destinations
Withdrawing to a wallet that has interacted with your depositing wallet reconnects them.
Merging ghost wallets
Sending tokens from several fresh wallets to one place, or back to your main wallet, links them.
Network metadata
The relayer and RPC providers see IP addresses and which addresses you query. Use a network you trust.
Your device
A malicious browser extension or compromised device can read an unlocked wallet. Privacy starts with a clean device.
Every party, and what it learns.
| Party | Can see | Cannot see |
|---|---|---|
| Anyone on Ethereum | Deposits, withdrawals, ghost wallets and trades, fees, timing | Which notes fund an action; note ownership; private transfer amounts |
| The relayer | Your request, its public outputs, and network metadata such as your IP address | Your seed, your other notes, or which notes you spent |
| RPC providers | Which events and balances your wallet queries, including ghost wallet balances | Your seed or note secrets (matching runs locally) |
| A private-send recipient | The amount they received | Your other notes or your public wallets |
| darkpool.website | Normal web requests to the site | Your seed, which never leaves your device |
Habits that keep the funding link broken.
- Wait between deposit and withdrawal. Let other activity happen in between.
- Avoid unique amounts. Use round, common amounts, and don’t withdraw exactly what you deposited.
- Don’t withdraw to linked wallets. A recipient that has touched your depositing wallet reconnects the two.
- Keep ghost wallets separate. Don’t merge them or send their tokens back to your main wallet.
- Protect the device. Lock the wallet when idle and keep the seed offline.
Privacy check
The wallet warns when a withdrawal looks linkable, for example the same amount soon after a deposit.
Scheduled and split withdrawals
Break one withdrawal into several amounts and times.
Viewing keys
Share read-only history with someone you choose, such as an accountant. A viewing key reveals that history to whoever holds it.
Privacy for ordinary users, not cover for crime.
Deposits from sanctioned addresses are refused: the pool checks the visible depositing address before accepting new funds. This is a screening of the depositing address, not a proof of where funds came from. Screening never blocks withdrawals or exits. An optional association-set “proof of innocence” is . How screening is governed.