How it works

Sanctum separates who decides a trade from who makes it. You decide. Shared wallets make it. A private ledger keeps track of what is yours.

A trade

You

A key in your browser signs the order

signed order

The Sanctum ledger

Private record of who owns what

one swap

A trading wallet

One of several shared wallets

swap

Solana

Sees a wallet swap on Jupiter

public on chain amount hidden (Privacy Rings) never on chain

Everything left of the trading wallet stays off chain. The chain's record of the trade names Sanctum's wallet, never an account.

A trade, start to finish

1
Open an account
Your browser makes a key. That key is the account: it signs every request, and it never leaves your device. No email, no password, no wallet needed. You can also make the key from one wallet signature, so the same account opens on any device.
2
Deposit SOL
Send SOL to your own deposit address from any wallet or exchange, or deposit through Privacy Rings so the amount is encrypted. Either way the ledger credits your balance and the SOL ends up in the main wallet.
3
Place an order
A buy, a sell, or a rule such as a stop loss. Your browser signs the order and sends it to the engine. No transaction is broadcast and no wallet pops up.
4
A trading wallet makes the trade
The engine checks the coin is safe, picks the trading wallet, builds a swap through Jupiter, simulates it to confirm it can only move what the order allows, and sends it. The ledger moves the coins to your account.
5
Withdraw or pay
Ask for a payout to any address, an encrypted payout to your private wallet, or a private payment to someone else. The main wallet sends it; nothing on chain says which account asked.

Why it is private

A normal trade is signed by your wallet, so your address is on it forever. Here the only addresses on a trade are Sanctum's, and they are on everyone's trades. An observer sees swaps from shared wallets and cannot tell which account asked for which, how much any one account holds, or what orders are waiting.

Orders that have not filled exist only in the ledger. Payments between @names are two ledger entries and never become a transaction. See what the chain sees at each step.

Trading wallets

If every account's coins sat in one address, that address would show up in a coin's holder list as a single large holder: it looks like a whale, and it tells everyone how much Sanctum's users hold in total. So trades go out from several trading wallets, each holding only a small share of any one coin.

A coin's holder list

One shared wallet

Sanctum9.0%

Holder B2.1%

Holder C1.8%

Holder D1.2%

Holder E0.9%

Holder F0.7%

Several trading wallets

Holder B2.1%

Holder C1.8%

Sanctum · 11.5%

Sanctum · 21.5%

Sanctum · 31.5%

Sanctum · 41.5%

Main wallet

Deposits, payouts, the reserves memo

round top-ups

Trading wallets

Buy and hold the coins

swaps

Jupiter

Any Solana coin

Each trading wallet adds to a coin only while it stays under 1.5% of the supply. The fullest wallet with room buys; when those are full an empty one opens; when every wallet holds the coin and none has room, the buy is refused. The wallets are topped up from the main wallet in round amounts, and all of them are listed on the Reserves page.

What this does and doesn't hide. It changes how holdings look in a holder list. It does not make the wallets secret: they are funded from the main wallet and listed on the Reserves page, so that the reserves can be checked. One order is never split across wallets, so a single large buy of a very small coin can still put one wallet above 1.5%.

Privacy Rings

Helius Privacy Rings is a shielded pool on Solana: balances and transfers inside it have their amounts encrypted. Sanctum uses it for money moving in and out, where an ordinary transfer would show exactly how much you deposited or took out.

Ways in

Instant depositAny account. Seconds.

Any wallet or exchange

amount shown

Your deposit address

Yours, and it never changes

swept

Sanctum main wallet

Encrypted depositAccounts made from a wallet. About a minute.

Your wallet

amount shown

Your private wallet

Made from your account key

amount hidden

Sanctum main wallet

public on chain amount hidden (Privacy Rings) never on chain

Ways out

To a walletAny account. Under a minute.

Sanctum main wallet

amount shown

Any address you name

Encrypted withdrawalAccounts made from a wallet.

Sanctum main wallet

amount hidden

Your private wallet

amount shown

Your wallet

When you choose to move it

Private pay to an addressAny account. The recipient needs a Privacy Rings wallet.

Sanctum main wallet

amount hidden

Their private wallet

Someone outside Sanctum

Pay a @nameBetween two accounts. Instant and free.

Your balance

two ledger entries

Their balance

public on chain amount hidden (Privacy Rings) never on chain

On the public ring the two addresses of a private transfer are visible; only the amount is hidden. In every case the sender is Sanctum's wallet, not your account.

Your private wallet

Every account has a Privacy Rings wallet made from the same key, so there is nothing extra to back up. It lives in your browser, signs its own transfers, and reads its balance from the chain each time it opens.

What the ring hides, and what it doesn't

On the public ring a private transfer hides the amount and the asset. The two addresses involved are still visible. Private payouts can also be sent in batches, several in one transfer, so that one cannot be matched to a deposit by its timing.

What keeps the funds safe

Sanctum holds funds while you trade, the way an exchange does. That is the cost of privacy here, so the design assumes you should not have to take it on trust.

What runs in the background

every 5–10 s

Deposits are looked for

Each one is credited once, by its transaction

every 10 s

Waiting orders are checked

Limit, take profit, stop loss and DCA fire when due

every 30 s

The audit

Owed against held, across every wallet. A shortfall halts everything

every 5 min

A reserves snapshot

Written to Solana once an hour

One ledger, written first

Every change is appended to a journal on disk before it takes effect, and each line extends a hash chain. The balances are whatever replaying that journal gives.

Swaps are checked before signing

A swap built by a third party is inspected instruction by instruction and simulated against every token account the trading wallet has. If it would spend more than the order, or touch other holdings, it is refused.

Risky coins are refused

Coins with a freeze authority, a transfer tax or other extensions that let a creator take tokens back are not traded at all.

Requests can't be replayed

Each signed request carries a timestamp, is accepted once, and expires after two minutes.

Proof of reserves

Anyone can count what the wallets hold, because they are public. The harder question is whether the ledger owes more than that. The proof answers it without publishing anyone's balance.

Proof of reserves

Every 5 minutes

A new root is published

memo

Every hour

The root is written to Solana

compare

Your browser

Rebuilds the root from your proof

Your balance is split into four random pieces mixed in with everyone else's (one of yours is lit here). Every branch records the hash of its two children and the sum of their balances, so the root fixes the total owed. Your browser walks the lit path from each of your pieces up to the published root.

Fees

Buy or sell1% of the SOL going in or coming out

Network cost per trade0.0004 SOL, plus 0.00204 SOL when a wallet first holds a coin

Withdrawal or private payment0.002 SOL

Deposit0.000005 SOL network cost

Pay a @nameFree

Up to 2 SOL per trade, withdrawal or private payment. The exact limits are in the Docs.

Open the terminal Read the docs Check the reserves