Confidentiality is a pipeline, not a promise.
Confidentiality here is produced, not asserted. A one-time holding address, staggered hops, a mixing stage, a pooled reserve, a private ledger. This page walks the whole run, states what each stage buys, and names the four things none of it does.
- Settlement
- Robinhood Chain · Arbitrum Orbit L2
- Chain ID
- 4663 (0x1237)
- Assets
- USDG · native ETH
- Privacy model
- Operational, not cryptographic
One deposit, six stations, and no edge back to you.
A full-privacy deposit never travels in a straight line. It lands in an address created for it alone, leaves in pieces on staggered timing, passes through a mixing stage that changes both their order and their size, and joins a reserve where it stops being a distinguishable amount.
One-time holding address
Every full-privacy deposit gets a fresh address generated for it alone. It is deterministic, so if any later step fails your funds stay recoverable there. Deposits fail safe, never silently.
Split across staggered hops
The deposit leaves in two to four randomized portions across separate intermediate wallets, on staggered timing, with amounts randomized or rounded to fixed denominations so they cannot be recombined by arithmetic.
Mixing stage
Portions enter and leave in a different order at different sizes. The order change is what breaks correlation by sequence; the size change is what breaks correlation by amount.
Pooled reserve and ledger
What arrives joins one aggregate balance. Your spendable amount is tracked on the private ledger instead, where transfers between accounts settle instantly with no chain footprint at all.
Privacy is a dial, not a switch.
A binary control forces one bad answer onto every payment. Three levels let rent and a dinner bill be different decisions — and the Public setting exists precisely so nobody has to pretend this is only for hiding.
Full
ETHRouted through the whole pipeline: a one-time holding address, split into randomized portions across staggered hops, a mixing stage, then the pooled reserve. Your spendable balance lives on the private ledger.
On-chain: Nothing an observer can pair to you.
Partial
USDGThe deposit is a visible transfer into the shared pool. Everything after it spends from the pool, so amounts and recipients are decoupled from your address.
On-chain: Your deposit. Not your spending.
Public
USDGA normal token transfer on Robinhood Chain. Cheapest and fastest, and we say plainly that it is fully visible.
On-chain: Everything, like any other transfer.
USDG when you want dollars. ETH when you want the strongest privacy. You choose per payment, and the deposit screen tells you which you are getting.
Where a deposit goes after you sign it.
A one-time holding address
[01]Choose Full in the Deposit modal and the asset switches to native ETH. The minimum is 0.003 ETH. The app checks your wallet holds that amount plus a small gas headroom before it asks for anything, then you sign one plain ETH transfer to an address generated for this deposit and nothing else. That address is deterministic. If any later stage of the pipeline fails, the funds are still sitting in it and still recoverable. Deposits fail safe, never silently. Your balance is credited when mixing completes, typically a few minutes.
Split across staggered hops
[02]The deposit does not travel as one object. It is broken into two to four parts, each sent through a separate intermediate wallet, and released on staggered timing rather than in a burst. Amounts are randomized or rounded to fixed denominations, so the parts cannot be matched back into a whole by size. A watcher sees several unremarkable transfers that share no obvious relationship with each other.
The mixing stage
[03]The parts are forwarded through the mixing stage in randomized portions. Ordering and sizing are decoupled there: what enters in one shape leaves in another, on a schedule that carries no relationship to yours. This is the stage that cuts the correlatable edge between the deposit and the balance. It is an internal stage of the protocol, not a third-party service, and it is the reason full privacy is the slowest level on the dial.
Pooled reserve and private ledger
[04]Funds land in a pooled reserve that carries no on-chain edge back to the depositing wallet, and your spendable balance is tracked on the private ledger from that point on. Paying another Hood USDB user is then an internal ledger transfer: instant, free, and with no chain footprint at all. Withdrawals pay out real ETH from the reserve, which has no link to anything you deposited.
Your wallet never signs the outbound transaction.
Withdrawals and transfers out are signed and broadcast by the protocol relayer. The address a block explorer records as the sender belongs to the pool, not to you, and it has no connection to the deposit that funded the balance it is paying from. You still authorise the amount and the destination with a wallet signature. What you do not do is appear on-chain as the origin.
- 01Applies at every level, not only Full — a Public transfer is still visible, but the payout leg is still relayer-broadcast
- 02The relayer pays the gas, so a recipient needs no ETH of their own
- 03ETH withdrawals carry a 1.5% fee, shown before you confirm
- 04Withdraw to a fresh wallet and the receiving address has no history linking it to you. A clean break.
A public ledger is a permanent, searchable record of your finances
Transparency was the point, and for settlement assurance it still is. But the same property means a salary, a rent payment and a medical bill are all readable by anyone who knows one of your addresses — forever, and retroactively.
- Balances are queryable by address
- Counterparties are inferable from repeated pairs
- History cannot be revoked once published
- Analysis improves over time; your old transactions do not get more private
Separate the balance from the address, and the payout from the payer
Nothing here tries to make the chain forget. It changes what there is to remember: your address stops being where your money lives, and it stops being what signs the transactions that move it.
- The pool holds the balance, not your address
- Splitting and the mixing stage break deposit-to-spend correlation
- The relayer signs every payout, so you are never the sender
- Internal transfers never touch the chain at all
We say private, not magic.
Operational, not cryptographic
This is privacy against on-chain observers, achieved by routing and pooling. It is not a cryptographic guarantee. FHE-encrypted balances and an on-chain proof system are on the roadmap and are not shipped.
You are trusting an operator
Your balance sits in a reserve Hood USDB operates and is recorded on our ledger, so withdrawals are processed by our backend rather than claimed from a contract. That is a trust assumption, and you should weigh it.
Off-chain adversaries are out of scope
Someone holding data we never see — an exchange record, a device, a subpoena — is outside what routing can address. We state the boundary rather than let you assume there is not one.
Confidential rails, on a regulated chain.
Privacy protocols carry a legitimacy problem, and the honest answer is not to argue about it but to settle somewhere it does not apply. Robinhood Chain is built for regulated finance, and USDG is a regulated dollar.
| Property | Value |
|---|---|
| Chain | Robinhood Chain (Arbitrum Orbit L2) |
| Chain ID | 4663 (0x1237) |
| Gas token | ETH — relayer-paid on payouts |
| RPC | https://rpc.mainnet.chain.robinhood.com |
| Explorer | https://robinhoodchain.blockscout.com |
| USDG token | 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 |
| Mainnet since | June 30, 2026 |
| Sequencing | First-come-first-served — no gas-auction MEV |
Confidentiality is half of it. Reach is the other half.
A private balance you can only send to existing wallet addresses solves one problem and leaves the bigger one. Pay links, @usernames and x402 requests are how it actually reaches people.
Pay Links