Private payments where the proof is post-quantum and the promises are honest.

Stealth has two rails: transparent (XST, public — what settles payments today) and shielded (XSS), where a coin is a note whose only public footprint is a commitment that reveals nothing.

You move value by spending notes and creating new ones. Each spend publishes a one-time nullifier that prevents double-spending — without ever linking back to the note it came from.

Every shielded transfer carries one zk-STARK binding membership, nullifiers, new commitments, and value-in = value-out. STARK security rests entirely on hashes (via FRI) — no elliptic curves — so the guarantee that supply can’t be inflated and notes can’t be forged is post-quantum by construction.

The sender can prove one specific payment — its recipient, amount, and memo — and that it really happened, without exposing any other note or any history.

It’s sender-cooperative: it proves a payment, it can’t compel a reveal — exactly what a receipt or an audit needs. This is also what makes a private x402 payment possible.

Value enters and leaves the shielded pool through a federated custody bridge — an m-of-n committee. The shielded transfers are trustless cryptography; the peg in and out rests on a threshold of operators behaving.

Validity and soundness are post-quantum today (STARKs). The confidentiality transport — note delivery — is classical key agreement until a post-quantum KEM replaces it, isolated behind one module for exactly that reason.

We never collapse the two: the proof is post-quantum; the encryption that hides the contents isn’t yet.

A private payment leans on three pieces of cryptography — proving a transaction is valid, encrypting who paid whom, and signing to authorize it. A quantum computer threatens each one on a different timeline, so we migrate in order of exposure: the proofs are already quantum-safe, the encryption is next, and the public-rail signatures come last.