Anonymous transactions on Lightning.

SWIRL is a pooled mixing layer for Lightning payments: a continuously deepening anonymity pool, uniform denominations, blinded paths in both directions — and a submarine-swap exit that leaves the chain with nothing to cluster.

GENESIS AIRDROP OPEN THE DAPP HOW IT MIXES

THE PROTOCOL

Three layers. Zero linkage.

Privacy is a property of systems, not primitives. SWIRL stacks three independent layers — identity, flow, settlement — each engineered to close a different oracle.

01Silent Receive

A static BOLT12 code that never names your node. Payers negotiate one-time invoices over onion-routed messages, and every reply ends in a blinded path whose final hops are ECDH-derived pseudonyms.

02Pool Mixing

Deposits enter a pool that never closes, over unannounced channels. Exits are cut into uniform denominations, shuffled against every live deposit, and released through a randomized delay queue — amount, order and timing all carry zero bits.

03On-chain Unlink

When funds touch layer 1, they cross a hashlock-atomic submarine swap into a fresh UTXO with no shared history. In ≠ out — on the graph and on the chain.

HOW IT MIXES

From payer to ghost in three moves

1. Publish

Post one static code. It mints one-time invoices indefinitely.

2. Mix

Payments dissolve into one deep, shuffled pool.

3. Settle

Exit atomically to a UTXO with no past.

WHAT STAYS HIDDEN

Lightning is fast. It was never private.

Every payment that crosses the public graph leaves a metadata trail: node identities, channel positions, timing signatures. SWIRL is engineered so that this trail never forms in the first place.

VANILLA LIGHTNINGSWIRL

Node pubkeyExposedHidden

Channel graph positionExposedHidden

Sender ↔ receiver linkExposedHidden

On-chain money trailExposedHidden

Accounts, logs, KYCExposedHidden

UNDER THE HOOD

The protocol, in the open

BOLT12 · TLV

# Offer anatomy — a static code with no identity inside.
$ swirl offer create --silent --label "donations"

lno1zcp8x4vq...k9w7
  ├─ signing pubkey   ← ephemeral, derived per-offer
  ├─ blinded path     ← intro hops + ECDH-blinded tail
  └─ node id          ∅  (never encoded)

THE TRUST ROADMAP

Four routes. Each one strips a power from the coordinator.

R1 · BLIND

SNARK exits. The pool sees a proof, never a link.

R1.5 · BOXED

Timelocked refunds, multisig legs. Worst case is refusal — never theft.

R2 · GRAPH-CLEAN

PTLCs re-blind every hop. The public graph loses the thread.

R3 · TRUSTLESS

BitVM3 fraud proofs settle the large lanes. No operator needed.

Read the full ZK roadmap →

THE LEAKS

What chain analysis already knows about Lightning

Invoice resolution reveals the receiver's node. Gossip reveals its channels. Channel closes reveal its UTXOs. Chaining exactly these public signals, researchers have already linked 46% of the network's nodes back to on-chain entities.

SWIRL breaks that chain at every link.

THE CROSS-LAYER PIPELINEarXiv:2007.00764

01INVOICE RESOLUTIONBOLT11 payee field + fallback address→ receiver node pubkey

02GOSSIP INGESTchannel_announcement + channel_update stream→ topology, capacity, fee policy

03ROUTE OBSERVATIONper-hop amount + CLTV deltas→ flow endpoints, balance estimates

04CLOSE SURVEILLANCEcooperative close transactions→ settlement UTXOs → entity clusters

Four public signals, chained end to end. Result:46% of nodes re-identified

HOW A MIX RUNSBOLT12 / LOOP-OUT

01Payer→Payer resolves your static offerpayer scans static code lno1zcp8x4...k9w7

02SWIRL→A one-time invoice is negotiated privatelyfresh one-time invoice via onion message

03Mix→Payment routes to blinded pseudonyms3 blinded hops — sender ↔ receiver severed

04Mix→It dissolves into the deep poolsubmarine swap — in ≠ out on-chain

05Payer→You exit on-chain — unlinkablesettled — no node, no route, no trace

Privacy should be the default, not the discipline.

No accounts. No KYC. Built in public.

FOLLOW @swirlbtc