How Ghost works

On Solana, every swap is public. Anyone can see which wallet bought which token, when, and for how much. Ghost breaks that link by moving your funds through a privacy hop. Your SOL goes in at one address and comes out at a new address that has no history with you. There are three hops, from a confidential swap that takes seconds to a round trip through Zcash that takes about ten minutes.

Two services do the work:

• NEAR Intents handles the hop, either as a confidential SOL-to-SOL swap or by converting SOL into native ZEC or NEAR and back again, using independent solvers.
• Relay handles the Solana side, swapping SOL for any token (and back) at the best available price.

Ghost is non-custodial. It never holds your funds or your keys. Every transaction is signed in your browser, and the temporary keys a trade needs are created and stored there too.

1. 1You enter an amount and pick a hop. Ghost gets live quotes for every leg and shows what you will receive, the total route cost and the expected time.
2. 2When you confirm, your browser creates a one-time wallet that has never been used before. The hop is reserved with the one-time wallet as its destination.
3. 3You sign a single transfer of SOL from your wallet into the hop. This is the only transaction your wallet signs.
4. 4NEAR Intents moves your SOL through the hop and delivers fresh SOL to the one-time wallet. On the confidential hop this is a single private swap; on the others your SOL becomes ZEC or NEAR and then SOL again.
5. 5The one-time wallet buys the token through Relay and sends it to your privacy wallet. Any leftover SOL is swept there too, which is how the privacy wallet gets gas for selling later. If it holds less than 0.01 SOL, the buy keeps back enough to top it up.

Your privacy wallet is one Solana wallet that all your private buys deliver to. You can also choose to deliver a buy to your own wallet instead; the hop still hides where the SOL came from, but the token then sits next to the wallet that paid for it.

You can close the page during the hop. The order is saved in your browser and picks up where it left off the next time you open Ghost on the same device.

1. 1You enter how much of the token to sell and pick a hop.
2. 2Your privacy wallet sells the token for SOL and sends that SOL into the hop in one transaction. Your browser signs it with the privacy wallet's key, so there is no wallet prompt, and the privacy wallet pays the gas. Selling from your own wallet works the same way, with your wallet signing.
3. 3NEAR Intents converts the SOL through the hop and pays the proceeds out from an unrelated address, either to your wallet or to any other wallet you choose.

Sending proceeds to a different wallet gives the strongest separation, since the SOL then lands somewhere with no visible connection to the wallet that sold.

Ghost gives every user a second Solana wallet, the privacy wallet. Private buys deliver tokens to it and private sells spend from it, so your tokens never sit in the wallet that paid for them. Nothing on-chain connects the two.

How it is created. The first time you trade privately, or press Unlock in Portfolio, your wallet asks you to sign a short message. It is a plain message, not a transaction, so it cannot move funds.

1. 1Solana signatures are deterministic: the same wallet signing the same message always produces the same signature, and no other wallet can produce it.
2. 2Your browser hashes that signature into a 32-byte seed and turns the seed into a Solana keypair. That keypair is your privacy wallet.
3. 3The key is kept in this browser only. Ghost's servers never receive the signature or the key.

Nothing to back up. Because the key comes from your signature, signing in with the same wallet on any device and signing the message again restores the same privacy wallet. If you clear your browser data, you only need to sign once more. You can also reveal the key in Portfolio and import it into any Solana wallet.

The message mentions blackhole.exchange, Ghost's domain. Only sign it on this site: anyone who gets that signature can rebuild your privacy wallet's key.

Gas. The privacy wallet pays its own network fees when it sells. Every buy that delivers to it checks its SOL balance, and if it holds less than 0.01 SOL, part of the buy is kept back as SOL to top it up, never more than a fifth of the buy. The trade panel shows this as “Gas to privacy wallet”. Leftover SOL from each buy is swept there too.

Never send SOL to it from your own wallet. That one transfer would publicly link the two wallets. If the privacy wallet runs low on gas, make another small private buy, and the hop will refill it.

You choose how your funds pass through the hop. It is a trade-off between speed and how hard the route is to follow. All three are settled by NEAR Intents.

How the confidential hop works.It uses NEAR Confidential Intents, which settles swaps on a private shard run by a permissioned set of operators instead of on a public chain. Observers see SOL going into NEAR Intents and SOL coming out, but cannot tie the two together. Settlement is internal, so there are no extra block confirmations to wait for. The trade-off is trust: the shard's operators can see the swap, and deposits are screened when they enter. The other two hops rely only on public chains.

Why not instant? Terminals that settle cross-chain swaps in a couple of seconds do it by having a solver pay you out before your deposit is confirmed. That is fast, but it leaves a direct, public path from your wallet to your trade, which is exactly what Ghost removes. The confidential hop is the fastest route that still breaks the link.

The confidential hop needs a NEAR Intents partner key on the server. If it doesn't appear in the trade panel, this deployment hasn't enabled it.

Monero is not available. Neither Relay nor NEAR Intents can settle Monero today, so there is no way to route through it without handing custody to a third party. It will be added if a non-custodial route becomes available.

Sign in with any of the following:

• A Solana wallet such as Phantom, Solflare or Backpack. It pays for your buys and receives the proceeds of your sells.
• Email or X. A new Solana wallet is created for you automatically. You can export its private key at any time from the account menu and import it into another wallet.

Either way, the wallet you sign in with is your public wallet. Tokens you buy privately go to your privacy wallet unless you choose otherwise in the trade panel. Your net worth in Portfolio adds up both.

Sign-in is provided by Privy. Ghost never sees your wallet's private key.

Ghost charges a 0.45% platform fee on every trade, paid in SOL as part of the token swap. On a buy it comes out of the SOL the one-time wallet spends, so your own wallet never pays it directly. On a sell it comes out of the SOL the sale produces, in the same transaction that sends the rest into the hop. The trade panel shows the exact amount before you confirm.

The route cost shown before you trade is the full difference between what you put in and what you get out, in dollars. It includes:

• The platform fee
• The spread and fees on the hop
• The swap fee and price impact on Relay
• Solana network fees and any new token account rent
• Transfer taxes built into some tokens

The minimum trade is 0.05 SOL, because the hop's fixed costs would take most of anything smaller. On a buy, 0.006 SOLstays in the one-time wallet to pay for the final swap, and whatever it doesn't use is returned to you.

Slippage applies to the token swap. If the price moves more than your setting before the swap lands, it fails instead of filling at a worse price. On a buy, the swap is then retried automatically with a fresh quote. On a sell, nothing is sent and you can simply try again.

Every order can be followed step by step under Portfolio. Here is what happens in each failure case:

• The hop can't complete its first step. NEAR Intents refunds your SOL to the wallet that sent it. On the confidential hop this covers every failure, since it has only one step. No action needed.
• The way back fails on the Zcash or NEAR hop. The ZEC or NEAR is refunded to a recovery key created in your browser. Open the order, reveal the key, and import it into a Zcash or NEAR wallet to claim it.
• The token swap keeps failing. After several retries the order pauses. You can retry the buy, or withdraw the SOL from the one-time wallet back to your own.

Don't clear your browser data while an order is in progress. The one-time wallet and recovery keys live only in this browser. Each order lets you reveal and copy its keys if you want a backup. Your privacy wallet is not at risk: signing the message again restores it.

Ghost removes the direct on-chain link between the two ends of a trade.

• On a buy, your wallet shows only a SOL transfer to a deposit address. The swap is made by a one-time wallet that has no history with yours, and the token lands in your privacy wallet, which has no on-chain link to your wallet either.
• On a sell from your privacy wallet, the sale is visible from the privacy wallet, but the proceeds cannot be followed to where they land.
• Every private trade uses the same privacy wallet, so anyone looking at it can see all of your private trades together, just not that they are yours. Never send SOL to it from your own wallet.

It does not make you anonymous. Keep these limits in mind:

• Timing and amounts can be matched. A distinctive amount that enters and leaves the hop within minutes is easier to connect. Round amounts and the slower Zcash hop make this harder. The confidential hop is the most exposed to this, because the deposit and the payout are seconds apart.
• Your wallet ends up holding the tokens. When you buy into your main wallet, the token balance itself is public. Selling to a fresh wallet gives the cleanest result.
• Service providers see the route. NEAR Intents and Relay see the addresses involved in the legs they process, as does the RPC provider that relays your transactions.