Stealth payments · Solana · ML-KEM-768

Send SOL.
Leave no line.

Every payment lands on a fresh one-time address that only the receiver can open. Nothing on-chain ties it to them. Not today, not after Q-Day.

Run it in your browser Buy $OPAQUE
drag across the glass
illustration
1,184byte Opaque ID
1,088byte ciphertext per payment
1fresh address per payment
0lines back to you

01 · The glass, in your browser

Real post-quantum crypto.
Running on your device right now.

This is the actual ML-KEM-768 key exchange (NIST FIPS 203) that Opaque uses. Make an ID, send to it, then scan for it the way a receiver's wallet does.

DEMONSTRATION · the crypto is real, no SOL moves
A

Receiver

you

Create the one ID you share with everyone. It never appears on-chain next to your wallet.

B

Sender

anyone

The sender's wallet locks a secret to your ID and turns it into an address only you can open.

C

What the chain sees

everyone

A block explorer shows money arriving at a brand-new address, and a blob nobody can read.

waiting for a payment…

02 · Harvest now, decrypt later

The chain keeps every payment forever.
So privacy has to outlive the curve.

Classic stealth addresses hide links with elliptic-curve math. Every announcement stays on-chain, so a big enough quantum computer can go back and open all of them. Drag the qubits.

ILLUSTRATION
physical qubits1,000
today ~1k ~500k · est. to break 256-bit curves
(Google Quantum AI, Mar 2026) 10M
classic stealth · elliptic curve0 / 10 linked
opaque · ML-KEM-7680 / 10 linked

03 · How it works

Four steps. No pool. No custody.

Opaque is not a mixer. Your SOL never sits in a shared pot or with us. It goes straight to an address that only your keys can open.

  1. 01

    Publish your Opaque ID

    One ML-KEM-768 public key (1,184 bytes) plus a spend key. Post it in your bio, on your site, wherever you'd post an address.

    opaque id = mlkem.pk ‖ ed25519.spend
  2. 02

    Sender locks a secret to it

    Their wallet runs ML-KEM encapsulation: a 1,088-byte ciphertext plus a 32-byte secret that only the two of you can know. That secret becomes a fresh one-time address.

    ct, ss = encaps(pk) · addr = derive(ss, spend)
  3. 03

    Pay and announce

    The SOL goes to the one-time address and the ciphertext goes into the public Opaque announcement log. Nothing on-chain points at you.

    transfer → addr · memo → ct + 1-byte view tag
  4. 04

    Scan and sweep

    Your wallet checks new announcements. The view tag skips 255 out of 256, so scanning is fast. It finds yours, derives the key, and a relayer pays the gas so the sweep doesn't link back to you.

    ss = decaps(ct, sk) · key = derive(ss, spend)

Hidden

  • Who paid whom
  • That two payments went to the same person
  • Your main wallet, from anyone you get paid by
  • All of it after Q-Day, too

Still public

  • Amounts. Send round numbers
  • Timing. Don't sweep the moment it lands
  • What you do with it after you sweep

04 · $OPAQUE

Every private send
buys the token.

A small fee on each send. Half buys back and burns $OPAQUE, half pays the relayers' gas so sweeps stay unlinked. Hold enough and you send for free.

contract
Buy on pump.fun Chart X
50%50%
buy back + burn $OPAQUErelayer gas pool
private send fee0.3%
hold 1,000,000 $OPAQUEfree sends
creator fees100% to relayer pool
key exchangeML-KEM-768 (FIPS 203)
custodynone
padpump.fun

Fee and threshold are launch targets. Final numbers post at launch.