Four Cloak withdrawals, linked back to the wallet that funded them
· 2 min read
Exact amounts out, seconds after they went in, then the money sent back to the start: how Iris matched four Cloak withdrawal wallets to one depositor, and how to avoid it.
Cloak is a privacy pool on Solana: you deposit SOL, and later withdraw it to a fresh wallet, with no link on-chain between the two. The cryptography does its job. What it can't hide is how a user moves the money around it.
We added Cloak to Iris's mixer tracing last week. On one of the first wallets we looked at, Iris linked four withdrawal wallets back to the wallet that funded them, each with a 100% match.
What happened
The wallet 65RS…Juko deposited SOL into the Cloak pool several times between September 25 and September 28, 2026.
- Sep 25, 19:17 UTC. 65RS…Juko deposited 1.068254 SOL. 40 seconds later, the pool paid out exactly 1.068254 SOL: 1.060049 SOL to the fresh wallet 6wcj…a15k, the rest being Cloak's fee.
- Sep 26, 18:46 UTC. 65RS…Juko deposited 1.145964 SOL. 26 seconds later, the pool paid out exactly 1.145964 SOL: 1.137526 SOL to 4r8b…faeZ.
- Two more wallets. Iris matches GUxe…uumK and Fz5b…i7tK to deposits from 65RS…Juko the same way, also at 100%.
- Sep 28, 12:38 to 12:42 UTC. All four withdrawal wallets deposited into Cloak again, within four minutes of each other (0.2066, 0.1905, 0.1275 and 0.1298 SOL). At 12:45, Cloak paid 0.390896 SOL and 0.110562 SOL out to 65RS…Juko: the money went back to where it started.
How Iris links them
A Cloak withdrawal pays the recipient what was taken out of the pool, minus a fixed fee: 0.3% plus 0.005 SOL. Iris knows that fee, so for every withdrawal it can work out the exact amount that left the pool, and compare it with every deposit made before it.
Take the first deposit: 1.068254 SOL. Take away 0.3% (0.003205 SOL) and 0.005 SOL, and you get 1.060049 SOL, which is exactly what 6wcj…a15k received 40 seconds later.
When a withdrawal takes out exactly what one deposit put in, seconds after it, with no other deposit of that size in between, the two are almost certainly the same money. The anonymity set, the number of deposits the withdrawal could have come from, is effectively one.
The last step removes any doubt: four "unrelated" wallets sending funds back to the depositor through the same pool, minutes apart.
Not a flaw in Cloak
None of this breaks Cloak's cryptography. Every link comes from how the pool was used: exact amounts, short gaps, and money sent back to the start. The same patterns would give away a user of any mixer.
If you use a privacy pool on Solana:
- Wait before withdrawing. Hours or days, not seconds. Every deposit made in between widens the set your withdrawal could have come from.
- Withdraw a different amount. Split a deposit, or take out a different sum than you put in.
- Keep the ends apart. Don't send funds from the withdrawal wallets back to the depositor, even through the pool.
See the evidence
The full case, with every link backed by its transactions: the case report.
The board itself, to explore the wallets and flows: the Explorer board.
Iris traces Privacy Cash and Cloak withdrawals the same way, and follows money through exchanges, bridges and peel chains on Solana and EVM chains. Paste any wallet at iriscan.app to start.