Arcium, Umbra Bet on Encrypted Execution as Blockchain Privacy Erodes

Every search, every purchase, every location ping, every transfer now leaves a permanent trail across systems explicitly designed to retain and monetize it. Governments treat data as strategic infrastructure. Platforms treat it as inventory.

And finance is where asymmetry collapses most violently. Money is the most legible expression of intent a person produces, and the financial system already retains every signal. Banks log it. Card networks resell it. Regulators compel its disclosure on demand. For most of the modern era, the trade-off was at least bounded – data sat with intermediaries who, however imperfectly, operated under legal constraint.

The era of bounded surveillance is slowly dissolving. The blockchain and tokenization era is rebuilding financial pipes on rails where every signal is public by default. But blockchains’ founding promise was never transparency.

Speaking with Sandmark, Arcium co-founder and CEO Yannik Schrade points out that “transparency was the workaround” when blockchains took shape. Public ledgers were not an ideological choice but a “technological shortcut” – the only way early protocol designers managed to achieve distributed consensus without a trusted operator.

A decade later, the shortcut has hardened into doctrine. The rails that were supposed to liberate capital are quietly assembling the most granular surveillance infrastructure in financial history, one programmable freeze function away from weaponized money.

Schrade said, “Censorship is a byproduct of surveillance. A censorship-resistant financial system requires privacy.”

HTTPS for the encrypted economy 

Custody, counterparty risk and regulatory clarity were the biggest pushbacks against institutional adoption of public chains. Qualified custodians, prime brokers and clearer frameworks across the US, EU and Asia closed each one in turn.

Baked-in disclosure remains the only area where the institutional case breaks. Institutions retreated to permissioned chains and consortium ledgers, the supposed compromise between blockchain efficiency and operational privacy, but the compromise is worse than what it replaces. No serious allocator runs size on a venue where every order exposes the blotter, every position telegraphs the trade and every fill broadcasts the strategy.

Closed private ledgers, Schrade argues, are “bad for institutions” because they essentially expose strategies, patterns and positions to the consortium running the infrastructure. Dark pools work because regulation polices the operator. Closed crypto rails are dark pools without the SEC (the US Securities and Exchange Commission).

Arcium’s bet is that the way forward is not more transparency, and it is not more opacity. It is encrypted execution, performed by a network with no privileged operator. Arcium is an encrypted execution engine – similar to how HTTPS works in web browsers – enabling anyone to take encrypted data and collectively compute over it without having to share it. The model removes the centralized authority that hoards data, and with it the inevitability of that data falling into the wrong hands.

The architecture rests on Multi-Party Encrypted Execution Environments (MXEs), a configurable virtual machine run by independent nodes, none of which ever sees the underlying data in the clear. The distinction from prior privacy primitives is categorical. Zero-knowledge proofs (cryptographic methods that allow one party to prove a statement is true without revealing the underlying data) protect isolated states, a model Schrade calls inherently limited because it only allows for one-dimensional interactions.

Arcium does something different. MXEs enable multidimensional interaction, meaning encrypted inputs from any number of parties can interact, transact and compose with a shared logic, the same way they would on a transparent network – a verifiable blackbox computation over joined inputs.

Schrade says, “We don’t want to have to trust anyone, because that would constitute a single point of failure that will inevitably fail.”

The gap between confidential transfers and a functioning confidential market is precisely what the alternatives keep failing to close. Trusted Execution Environments (secure hardware enclaves that isolate sensitive computations), fashionable across cross-chain intent protocols, are provider-dependent, and whoever has access to the machine has access to the data. The trust model collapses onto a single operator and a single supply chain – the same failure as routing private transactions through centralized intermediaries. Both trade one problem for another. Both reduce to a go-between with a single point of failure.

Arcium removes the operator entirely. Trust placed in any single node, Yannik argues, constitutes a single point of failure that will inevitably fail once the economic incentive grows large enough. That is the architectural premise: no privileged participant, no privileged hardware, no privileged anyone.

Mainnet Alpha went live on Solana (SOL) in February, with the network designed to extend to other chains and well beyond crypto-native use cases over time. The encrypted ecosystem is already compounding – over $7.5mn raised across more than a dozen teams, three flagship applications live, and primitives spanning private finance, opportunity markets and sealed-bid auctions that simply cannot exist on transparent infrastructure. The most consequential of them is Umbra.

From scratch, together

The cleanest test of whether infrastructure works is whether someone will stake a company on it. Umbra is that someone – the largest application running on Arcium and, in Schrade’s words, the biggest team built 100% on top of the network. But the relationship is not the arms-length integration that the phrase usually implies.

Built on top of typically means a team was handed a Software Development Kit (SDK) and left to plug into it. Umbra and Arcium built alongside each other from the earliest days, Umbra suggesting architectural decisions on Arcium’s end while Arcium pressure-tested developer experience on Umbra’s. The two teams broke things together and fixed them together, and Umbra got to stress-test the network before anyone else, making sure not just the protocol but its team was production-ready.

The arrangement improved both products. Umbra understands the encrypted stack at a depth most application teams never reach because it watched the thing get built from scratch. And for Arcium, having a real application running on the infrastructure during development meant a constant feedback loop on what needed building versus what was merely theoretical.

That history is why Kru Shah, Umbra’s co-founder, regards the Arcium team as “friends and family” at this point – trust built through tough moments, the one thing a partnership announcement is not enough to manufacture.

Kru Shah said, “Confidential transfers will become the default trail for anything involving financial value onchain.”

Incognito mode 

Umbra is a private financial layer operating natively on Solana, providing encrypted balances, confidential transfers and shielded swaps, delivered through a consumer wallet and an SDK other applications can embed. The mainnet product is a significant departure from its earliest builds, collapsing the entire model into a one-tap user experience with a single address that sends, receives and holds assets in an end-to-end encrypted shared state.

The architecture inverts the usual privacy default. Funds are encrypted the moment an address exists, not when a user remembers to shield them, which closes the metadata gap that toggled privacy always leaves open. Inside the shielded zone, balances and transfers stay encrypted end to end; two parties can settle without either the amount or the counterparty ever surfacing on-chain, and capital can exit to a transparent address or remain shielded and keep moving. This is the property that isolated privacy systems never delivered – an encrypted state interacting with another encrypted state, which Arcium’s multi-party computation supplies and zero-knowledge proofs alone cannot.

Set against the alternatives, the gap is one of design philosophy rather than degree. Railgun gives Ethereum (ETH) a comparable shielded SDK, but each interaction sits in its own isolated encrypted state, airtight per transaction but barely composable beyond it. Mixers sit lower, shuffling coins without encrypting balances or shielding ongoing activity, leaving users to stagger their deposits and withdrawals against the pattern-matching that re-links them anyway.

Umbra’s wager is that privacy is only worth anything where capital moves. Idle capital does not need hiding, but capital moving fast through live liquidity does, and it needs to stay composable with the DeFi (decentralized finance) ecosystem already on the chain rather than quarantined on a privacy island of its own.

The engineering details are where that philosophy becomes concrete. Withdrawals are unlinkable, cutting the on-chain thread between entry and exit that mixers leave hanging. There are no per-deposit account-rent costs, the overhead that quietly taxes most Solana privacy designs. Relayers absorb gas, so the flow is one tap rather than a multistep process that signals the user is doing something worth hiding. Speed seals it: a private swap that costs twenty minutes elsewhere clears in under thirty seconds here, at roughly half the fee of a public swap on a standard Solana wallet. Compliance is built into the default rather than bolted on after, screening through a range across most chains and blocking flagged wallets at account creation, while time-scoped viewing keys let a user disclose a week of activity to a counterparty or a year to a regulator without surrendering spending authority or exposing the other side of any trade.

Privacy that is slow, costly or conspicuous is privacy no one uses, and privacy no one uses protects no one. The version that wins disappears into the experience the way HTTPS did – assumed, invisible, slowly becoming the silent default beneath anything carrying financial value.

Early miles from mainnet

Two months off public mainnet, the raw TVL (Total Value Locked, a measure of assets deposited in a protocol) number – $458k as of 1 Jun, up from $180k at launch – understates what is actually happening inside the encrypted layer. Of the 3,814 lifetime UTXOs created since 23 Mar, only 1,086 correspond to external deposits. The remaining 2,728 – 71.5% of all recorded activity – are internal, including cross-account transfers, encrypted swaps and mixer operations that never surface as a TVL movement. The protocol is generating nearly three times more activity inside the encrypted environment than it is at its public entry points. For a two-month-old privacy wallet, that ratio is the signal – users are not depositing and leaving, they are actually transacting in the dark.

(Source: Umbra Protocol Metrics)

The TVL trajectory breaks into three phases. The first three weeks drew $178,858 in gross inflows at $7,452 per day, but TVL barely moved from its $180k launch base. Approximately 82% of that base was UMBRA, the protocol’s own token, whose price volatility quietly offset external capital deposits. The inflection arrived in mid-April: the week of 20 Apr alone generated $191,961 in gross inflows, followed immediately by $197,688 the week after. Over the following 30 days, the daily inflow rate more than doubled the opening rate to $15,822 – driving TVL from $202k to $431k. Since mid-May, the protocol has entered consolidation; inflows and outflows run nearly matched at approximately $7,000 per day. What kept growing through all three phases is ticket size – average deposit expanded 2.3x from the early period to today, from $576 to $1,334, as transaction count fell and individual positions grew more deliberately.

(Source: Solscan, Umbra's pools)

Asset behaviour breaks cleanly into two camps. USDC (a leading US dollar stablecoin) and wSOL (wrapped Solana) are the transactional assets – withdrawal ratios above 83%, average deposit sizes of $452 and $1,321, high transaction counts and daily-use behaviour. The UMBRA token is the holder asset accounting for most of the protocol’s TVL, with only 30% of the deposited value withdrawn so far, most of it sitting inside the encrypted layer. Across all assets, 84.7% of deposit transactions produced a withdrawal, but only 67.9% of deposited value has cycled out, meaning the protocol is retaining capital even as users move actively.

(Source: Solscan, Umbra's pools)

Umbra’s revenue compounds from a 0.35% protocol fee charged on withdrawals and cross-account transfers and 0.80% on encrypted swaps and DeFi interactions. Self-deposits are free of any charge, and a tiered structure scales down for high-volume activity whose specific thresholds remain undisclosed. On standard transfers, Umbra sponsors the Solana network base fee entirely through gasless abstraction to simplify onboarding and remove the last friction point between a user and their first private transaction.

Estimating what that fee structure has generated requires working backwards from observable data – a reverse-engineering exercise Kru confirmed is how even Umbra’s own team approximates user activity and revenue, given the encrypted layer is not directly readable.

(Compiled by Sandmark)

Of the 920 observed outflow transactions totaling $801,504 in withdrawals, the protocol generated an estimated $2,805 at 0.35%, assuming the fee applied uniformly across all exits. That is the closest onchain data gets to a confirmed fee figure with a high degree of confidence.

Internal activity adds the harder-to-measure layer – the 2,728 residual UTXOs in the anonymity set sitting between the 3,814 lifetime total and the 1,086 deposit transactions represent cross-account transfers, encrypted swaps, DeFi interactions and UTXO claims that never surface as a TVL movement and are therefore invisible to any external observer.

Assuming a blended rate of approximately 0.50% – a weighted approximation across transfers, withdrawals and DeFi interactions fee tiers – and treating all 2,728 internal UTXOs as fee-bearing at the conservative blended average of $520 – derived from gross throughput of $1.98mn across 3,814 lifetime UTXOs – per transaction adds an estimated $7,093 in additional protocol revenue, bringing total estimated fees since launch to approximately $9,900.

At the current run rate, protocol fees annualize to roughly $52k – early-stage numbers for a protocol two months off public mainnet, but the trajectory matters more than the absolute. TVL has grown 2.5x since launch, the anonymity set of 3,814 discrete encrypted outputs compounds at 54 per day, and the growing integration pipeline should compound both usage and fee throughput over time.

Beyond the wallet SDK 

The wallet and SDK are the entry points. Every integration that routes capital through Umbra by default rather than by choice is what converts a privacy tool into a financial layer. The recent Streamflow partnership is a first attempt to walk institutional capital through it at scale.

Streamflow is Solana’s dominant token distribution infrastructure, serving protocols and users across vesting schedules, time-based locks and price-conditional releases. The platform currently holds $352mn in vesting TVL, down from a peak of $1.51bn in November 2025 but averaging $850mn across the full year. The integration with Umbra routes vested tokens directly into Umbra wallets, making every distribution private by default – recipients land inside the encrypted environment from the first unlock, with no opt-in and no separate shielding step. The vesting contract itself becomes the entry point into Umbra’s anonymity pool.

(Source: DeFiLlama)

Private vesting has not existed as a deployable product before. It has existed as a demand – one that is seen by anyone who has watched a token cliff get front-run, a contributor allocation get tracked wallet-to-wallet, or a VC position get publicly unwound the moment it is unlocked. Funds do not want their allocation sizes, entry prices or exit timing broadcast to the market they are participating in. Teams do not want contributor compensation made legible to competitors or to token holders watching for insider sell pressure. The mechanics of onchain vesting have always meant that the schedule, the recipient and the unlock timing were visible to anyone watching. Streamflow and Umbra close that exposure at the infrastructure level rather than asking projects to manage it themselves.

The TVL opportunity is a direct read from the data. At $352mn in current Streamflow vesting TVL, capturing 5% of distributions into Umbra wallets would add $17.6mn – a 38x increase on Umbra’s current base, but still very conservative math once private vesting becomes the default distribution rail across internet capital markets.

Every vesting contract routed through Umbra is a recurring inflow, with tokens dripping into the encrypted environment on Streamflow’s existing schedule, not as a one-time deposit but as a continuous stream. Every recipient who receives vested tokens in an Umbra wallet becomes a protocol participant by default, able to swap, transfer and interact with any Umbra SDK integration without a separate onboarding step. And every private vesting contract deepens the anonymity pool – each additional UTXO compounding the privacy guarantee for every other user and application on the network simultaneously.

Ownership, accessibility, transparency 

Crypto’s native token model has a structural fracture the industry spent a decade papering over. Tokens were the fundraising instrument that escaped equity constraints – no cap table, no dilution, no shareholder rights – but offered holders almost nothing enforceable in return. Governance was theatre. Revenue accrual was optional. The token was a speculative instrument dressed in the language of ownership, and the market is finally pricing that gap.

Token markets are maturing into something closer to equity markets, and the selection criteria are changing with them – the protocols surviving the current compression are the ones whose tokens actually accrue economic value through revenue sharing, treasury participation, and meaningful governance over capital allocation.

Umbra is MetaDAO’s most significant launch to date – $154.9mn in ICO commitments from 10,519 participants against a hard cap of $3mn – oversubscribed by 51.6x. MetaDAO is a governance platform that uses futarchy (a market-driven decision-making system) rather than traditional token voting. Umbra launched as an equity-aligned token from day one, and the alignment MetaDAO enforces is what separates it from every standard token launch.

MetaDAO’s futarchy model is the most structurally honest attempt to close the token-equity gap. Rather than a binary VC decision, futarchy continuously prices the probability that a team will deliver on its stated goals, forcing teams to actually ship to access capital.

Treasury and intellectual property sit under a DAO LLC in token holder control, with every capital decision, from audits to buybacks, going through the community. Product decisions stay with the team. Rights for token holders are programmatically enshrined rather than founder-discretionary, which means the token’s value becomes a direct function of protocol revenue rather than narrative cycles. For a crypto-native product built on removing trust from intermediaries and letting the market speak, MetaDAO is the only structurally aligned alternative to traditional venture funding.

Encrypted execution, equity-aligned governance and a private financial layer built from scratch – this represents one proposed infrastructure stack for a financial system with reduced surveillance of users. It is now live, and it’s called Umbra.