Proof system
Halo2-KZG
No custom ceremony
Uses the public Powers of Tau setup, not a custom ritual. The verifier is generated by Axiom's snark-verifier, reviewed by Trail of Bits.
Live on
Sepolia testnet
Next
Ethereum mainnet
Arbitrum
A private balance for Ethereum.
Stop leaking your portfolio every time you pay. Shield ETH or USDT, send privately by Nox ID, and unshield to a fresh wallet. Every proof runs locally in your browser and is verified on-chain.
Encryption
Post-quantum memos
ML-KEM-768 + secp256k1
Every note memo is sealed to both keys at once, so its contents stay private even if a quantum computer later breaks elliptic curves.
Local proving
WASM prover
~20s browser proofs
Multi-threaded proving runs locally, so note secrets do not leave your browser.
State
On-chain IMT
Spend from next block
Notes enter the Merkle tree immediately and are spendable after confirmation. No aggregator, no batch queue.
Core flows
A wallet-shaped privacy pool.
The app is organized around normal payment actions, not protocol ceremony. Shield, Send, Receive, and Unshield each map to a concrete on-chain flow.
01
Shield
Deposit ETH or USDT into the pool. The contract reconstructs the note commitment from the actual asset and value, then inserts it into the Merkle tree.
02
Send
Transfer privately to a Nox ID or meta address. The proof hides the sender, recipient note, and amount while preserving balance correctness.
03
Receive
Share a standard Nox ID, a diversified receive address, or a pay link. Incoming notes are encrypted so the recipient can auto-discover them.
04
Unshield
Withdraw to any Ethereum address. Use direct withdrawal or the relay for gasless UX when the destination wallet starts empty.
Product layer
Private receiving, without the cryptographic address soup.
Nox wraps stealth meta-addresses in wallet-native surfaces: a readable Nox ID for repeat contacts, and custom pay links for invoices, people, or one-off deposits.
Nox ID
wintermute
Manage Nox ID
Current ID
wintermute
New ID
Available
+ Show full receive address
Custom pay links
Create a separate link for one person, invoice, or counterparty.
Acme Q2
1.234
Asset
ETH
Ethereum
Identity
Nox IDs
Human-readable names resolve to stealth meta-addresses, so users can share "wintermute" instead of a long cryptographic payload.
Receiving
Pay links
Reusable and custom links let anyone deposit to your private balance from a simple URL, without learning the underlying note format.
Compartmentalization
Diversified addresses
One identity per counterparty. Hand a different receive address to each invoice, friend, or service. All derived from the same keys, but unlinkable even if recipients compare what you gave them.
Account security
Two-factor keys
Your Nox keys come from a wallet signature plus a keyfile you save once. A phished signature alone cannot open your balance, and no secret is ever stored unencrypted.
Operational layer
Private UX, without giving custody to the app.
The supporting services make the wallet feel fast and recoverable, but the contract remains the source of truth for funds, nullifiers, roots, and emergency exits.
Gasless exits
Relay service
Withdraw to a fresh wallet that has zero ETH for gas. The relay broadcasts on your behalf and takes its fee from the shielded balance. It never touches your funds and never sees your keys.
Health and sync
Sentinel
Read-only: tracks escapes, exposes pool stats, and helps wallets sync the Merkle tree faster. Fully optional. The contract is the source of truth, the sentinel just makes browsing it easier.
Final recovery
Escape hatch
The app is open source and proofs run on your device, so you can always exit with your own proof and no relay. If proving ever breaks, pausing the pool opens a proof-free exit that pays only to your own address. Privacy is given up, the funds are not.
Deposit
~475k
pay-link deposit with memo, IMT insert
Private transfer
~935k
real Halo2-KZG proof with change
Direct unshield
~940k
real proof, change note, fresh address
Why different
Not a mixer. Not a custodial privacy app.
Nox aims for the useful middle: wallet-grade UX, private transfers, arbitrary amounts, and an explicit path to immutable contracts.
| Dimension | Nox | Tornado Cash | Railgun | Privacy Pools |
|---|---|---|---|---|
| Model | UTXO JoinSplit | Fixed-denomination mixer | UTXO JoinSplit | Association-set pool |
| Amounts | Arbitrary | Fixed denominations | Arbitrary | Arbitrary |
| Deposit gas | ~475k | ~1.1M | ~1.2-1.5M | ~300k est. |
| Withdrawal gas | ~940k | ~300k | ~500k | ~350k est. |
| Anon set | Global, arbitrary amounts | Per denomination | Global per token | Per-asset, curated subset |
| Settlement | Instant, next block | Instant | Instant | Pending approval queue |
| ZK system | Halo2-KZG | Groth16 | Groth16 | Groth16 |
| Trusted setup | Universal Powers of Tau | Circuit-specific phase 2 | Circuit-specific phase 2 | Circuit-specific phase 2 |
| Private pay links | Yes | No | No | No |
| Handles | Yes | No | No | No |
| Private memos | Post-quantum hybrid | No | Yes | No |
| Multi-token | ETH + ERC-20 unified pool | ETH + ERC-20 separate pools | ETH + ERC-20 shared pool | Segregated per-asset pools |
| Compliance | Sanctions screening on deposit and withdrawal | None | Viewing keys | Off-chain ASP + approval queue |
| Emergency recovery | Batch escape hatch | No | No | Ragequit exit |
| Browser proving | ~20s WASM | ~15-30s | ~60-120s | ~10-20s est. |
| Protocol fee | 0% | 0% | 0.25% | 0% |
Try it
Shield a small testnet amount.
Connect a Sepolia wallet (a regular account, not a smart-contract wallet), save your keyfile, create a Nox ID, and run the full private payment loop in a few minutes.