Two Privacy Cash withdrawals, and the transfers that gave them away

Privacy Cash is a privacy pool on Solana: SOL goes in from one wallet and comes out to another, with no on-chain link between the deposit and the withdrawal. That holds as long as nothing else connects the two ends.

In this case, something did. Iris matched two withdrawal wallets back to the wallet that funded them, with a 97% and a 69% match, then found direct transfers tying all three wallets together.

The evidence: the case report and the Explorer board.

What happened

• The deposits. A personal wallet, 68r1…D11S (about $787 in assets, 61 transactions), sent 53.52 SOL into the Privacy Cash pool across 13 deposits.
• Withdrawal 1. 3mRa…in1p withdrew from the pool with a 97% match to those deposits, on amount and timing.
• Withdrawal 2. 7DpV…yrQ5 withdrew with a 69% match.
• Direct link 1. Outside the mixer, the depositor and 3mRa…in1p exchanged 5.34 SOL in one direct transaction.
• Direct link 2. The depositor and 7DpV…yrQ5 exchanged 3.98 SOL in one direct transaction.

How Iris links them

Privacy Cash takes a fixed fee on every withdrawal: 0.35% plus 0.006 SOL. So a withdrawal is always slightly smaller than the deposit behind it, by an amount that can be calculated.

Iris knows that fee. For each deposit, it searches the withdrawals that follow for amounts that fit it, then weighs how close in time they are. The result is a score per candidate withdrawal. 97% is strong on amount and timing alone. 69% would be weak on its own.

The link the mixer can't hide

Then there are the direct transfers. Each withdrawal wallet also sent or received SOL straight to or from the depositor, outside the pool: 5.34 SOL with the first, 3.98 SOL with the second.

These don't depend on Iris's scoring. They're plain transfers recorded on-chain, which anyone can check in a block explorer, and they connect both ends of the mixer. They also turn the 69% match into a strong one: two independent links point at the same owner.

Other explanations remain possible, such as shared custody, or two people who pay each other and both happen to use Privacy Cash. With two independent links, they're much less likely.

Not a flaw in Privacy Cash

The pool did its job. What linked these wallets is how they were used: withdrawals that fit the deposits, and wallets that kept paying each other after the money came out.

If you use a privacy pool on Solana:

• Never send funds between the two ends. One direct transfer between a withdrawal wallet and the depositor undoes everything the pool did.
• Wait before withdrawing. Hours or days, not minutes. Every deposit made in between widens the set your withdrawal could have come from.
• Withdraw a different amount. Split a deposit, or take out a different sum than you put in.

See the evidence

The full case, with every link backed by its transactions: the case report.

The board itself, to explore the wallets and flows: the Explorer board.

Iris traces Privacy Cash and Cloak withdrawals the same way, and follows money through exchanges, swap services, bridges and peel chains on Solana and EVM chains. Paste any wallet at iriscan.app to start. And read how the same method linked four Cloak withdrawals to one wallet.