Private payments where the proof is post-quantum and the promises are honest.

Stealth has two rails: transparent (XST, public — what settles payments today) and shielded (XSS), where a coin is a note whose only public footprint is a commitment that reveals nothing.

You move value by spending notes and creating new ones. Each spend publishes a one-time nullifier that prevents double-spending — without ever linking back to the note it came from.

Every shielded transfer carries one zk-STARK binding membership, nullifiers, new commitments, and value-in = value-out. STARK security rests entirely on hashes (via FRI) — no elliptic curves — so the guarantee that supply can’t be inflated and notes can’t be forged is post-quantum by construction.

The sender can prove one specific payment — its recipient, amount, and memo — and that it really happened, without exposing any other note or any history.

It’s sender-cooperative: it proves a payment, it can’t compel a reveal — exactly what a receipt or an audit needs. This is also what makes a private x402 payment possible.

Value enters and leaves the shielded pool through a consensus-managed custody pool — no committee, no federation, no multisig, no operators to trust. The shielded transfers are trustless cryptography; the peg in and out is enforced by the network itself.

Validity and soundness are post-quantum (STARKs), and the confidentiality transport — note delivery — is sealed with a post-quantum KEM. Both halves of a shielded payment are post-quantum: the proof that authorizes it and the encryption that hides it.

Neither half leans on elliptic curves, so a captured shielded payment holds nothing a future quantum computer can unmask — no harvest-now-decrypt-later window.

A private payment leans on three pieces of cryptography — proving a transaction is valid, encrypting who paid whom, and signing to authorize it. On Stealth all three are post-quantum where it counts: the proofs are hash-based zk-STARKs, the notes are sealed with a post-quantum KEM, and consensus signs blocks with ML-DSA-65. The one classical piece is the transparent rail’s own ECDSA signature — hardened by a commit-reveal spend, no giant signature required.