Felix Schäfer

Helping Ethereum teams reduce public exposure of @Safe treasury operations → DM for privacy @Haven_Wallet access

[Felix Schäfer @feIixschaefer]

Building Haven Wallet. Follow to stay up-to-date

[Felix Schäfer @feIixschaefer]

Never shield your tokenized Tesla stock into Railgun.

Shield USDC and swap into it instead.

The shield step is public. Etherscan shows your wallet, the token and the amount.

Tokenized stocks have low volume. So a TSLA shield stands out. Few deposits means few possible owners. Anyone can match it to you later.

USDC or ETH is different. High volume, thousands of deposits that look alike. Your shield disappears in the crowd.

The flow:

→ Shield USDC or ETH
→ Swap into the tokenized stock inside Railgun
→ Hold it there

Under the hood, the swap unshields, trades on a DEX and shields the result back in one transaction. A broadcaster submits it, not your wallet.

On-chain you see that someone swapped USDC for TSLA. Not who bought it. Not who owns it now.

The asset you shield matters more than the asset you end up holding.

How many people shielded the same token as you last week?

[Felix Schäfer @feIixschaefer]

You can buy Tesla and NVIDIA stocks on Uniswap with zero KYC.

A traditional broker would never allow that. But a broker would never let strangers see your portfolio either.

On Etherscan, anyone can see what you hold.

@RAILGUN_Project fixes that: you shield funds into a shared pool, and swaps inside it can't be linked back to your address.

No ID check. No visible portfolio.

Shareholders become ghosts in the system.

[Felix Schäfer @feIixschaefer]

Your tokenized Tesla stock is not a Tesla share.

Take Ondo's TSLAon. It works like an ETF: a company holds the real shares, you hold a token that tracks them.

→ Backed 1:1 by Tesla shares at a US broker
→ Shares are in the issuer's name, not yours
→ Dividends are reinvested, not paid out
→ No voting rights
→ Shares are protected if the issuer fails

Minting and redeeming also works like an ETF, but with one difference. ETF creation is limited to large institutions. Here any KYC-approved user can mint or redeem, even small ones (Ondo only serves non-US persons).

Buying an ETF always requires a KYC'd broker. Buying this token on the secondary market, like Uniswap, doesn't. You only need a wallet, and it trades 24/7.

The catch: you never hold the stock. Say nobody wants to buy your token. Without KYC, you can't redeem it either. So what do you actually hold? A claim on shares in someone else's name, for as long as the issuer, the broker and the regulator keep playing along.

Which of the three do you trust most?

[Felix Schäfer @feIixschaefer]

You can buy Tesla and NVIDIA stocks on Uniswap with zero KYC.

A traditional broker would never allow that. But a broker would never let strangers see your portfolio either.

On Etherscan, anyone can see what you hold.

@RAILGUN_Project fixes that: you shield funds into a shared pool, and swaps inside it can't be linked back to your address.

No ID check. No visible portfolio.

Shareholders become ghosts in the system.

[Felix Schäfer @feIixschaefer]

@SimonHoiberg I was very surprised when i saw the low corporate tax rate. Is definitely on my top 5 list of countries i think about moving to

[Felix Schäfer @feIixschaefer]

@pete_rizzo_ They cant turn it off so they try to ban it

[Felix Schäfer @feIixschaefer]

You can buy Tesla and NVIDIA stocks on Uniswap with zero KYC.

A traditional broker would never allow that. But a broker would never let strangers see your portfolio either.

On Etherscan, anyone can see what you hold.

@RAILGUN_Project fixes that: you shield funds into a shared pool, and swaps inside it can't be linked back to your address.

No ID check. No visible portfolio.

Shareholders become ghosts in the system.

[Felix Schäfer @feIixschaefer]

If Web2 companies operated with full financial transparency, none of them would survive. Why should crypto businesses be any different?

[Felix Schäfer @feIixschaefer]

➡️ Why private stablecoins are the missing piece for crypto businesses:

The pitch: run your business on-chain. Programmable money. Global payments. No one can freeze your funds or shut down the network.

The reality: every transaction you make is visible to everyone.

⬇️ Thread

[Felix Schäfer @feIixschaefer]

This means:

✓ Price stability of USDC
✓ Privacy of Monero
✓ No wrapped tokens
✓ No bridge risk
✓ Same Ethereum ecosystem
✓ Works with existing Safe multisigs

You don't choose between stability and privacy anymore.

You get both.

[Felix Schäfer @feIixschaefer]

But here's the issue:

Unlike privacy coins, every stablecoin transfer on Ethereum is completely public. Your treasury balance. Payment amounts. Recipients. All visible.

Looking for private USDT directly on Ethereum? Follow us to be the first to know when our solution launches.

[Haven Wallet @haven_wallet]

You do not need a company’s org chart to start mapping its financial relationships.

Open a public treasury wallet on Etherscan.

You can inspect its transactions, recipients, timestamps, and amounts.

Then follow the addresses receiving those funds.

Click into related wallets and inspect their visible incoming and outgoing transfers.

Over time, recurring addresses, payment timing, and repeated transfers can reveal relationships and operating rhythms.

You may not always know who ultimately controls every wallet.

But you can still follow the transaction history that is publicly visible and build a picture from repeated activity.

Specialized wallet-analysis tools can make this much faster by organizing transactions and wallet relationships across large amounts of public blockchain data.

That is why Haven treats treasury privacy as a problem of repeated public relationships, not just individual transactions.

[Felix Schäfer @feIixschaefer]

We looked at payment patterns across crypto businesses.

The result: over 80% of day-to-day transactions happen in stablecoins, not volatile tokens.

Payroll? USDT.
Vendor invoices? USDT.
Recurring payments? USDT.

You need predictable value for predictable operations.

Quick question: what asset do you use most for on-chain business operations?

[Felix Schäfer @feIixschaefer]

How do you make USDC private on Ethereum without wrapping it or moving to another chain?

@RAILGUN_Project uses a shielded pool model. When you deposit USDC into the Railgun contract, it gets added to a shared pool. The protocol proves you own the right to withdraw a certain amount without revealing which deposit was yours.

Every withdrawal could be anyone's deposit. Breaking the on-chain link between sender and receiver.

The USDC never leaves Ethereum mainnet. It stays as standard ERC-20 USDC inside the Railgun smart contract. No wrapped tokens. No bridges. No new asset to trust.

You just prove you have the right to move X amount privately.

That's how you get private stablecoins that businesses can actually use. Same asset. Same chain. Different visibility.

[Felix Schäfer @feIixschaefer]

You can't run a business on Monero.

Negotiate a $5,000 monthly salary. Two weeks later XMR drops 20%. Now that employee is getting $4,000 in purchasing power.

Do you renegotiate? What about invoices? What about recurring vendor payments?

Volatility breaks everything.

That's why every crypto company runs on USDC, DAI, USDT. Price stability isn't optional.

But here's the problem: every stablecoin payment on Ethereum is completely public.

Your treasury balance. Employee salaries. Vendor payments. Customer transactions. All visible to anyone with an Etherscan link.

Railgun lets you shield stablecoins on Ethereum. Keep the stability of USDC. Add the privacy of Monero.

[Felix Schäfer @feIixschaefer]

@runeswap_io Fair enough. The problem is that the swap itself is still public, and recurring swaps can reveal a pattern too. So you’re making the asset private, but not necessarily the payment workflow.

[Felix Schäfer @feIixschaefer]

You can't run a business on Monero.

Negotiate a $5,000 monthly salary. Two weeks later XMR drops 20%. Now that employee is getting $4,000 in purchasing power.

Do you renegotiate? What about invoices? What about recurring vendor payments?

Volatility breaks everything.

That's why every crypto company runs on USDC, DAI, USDT. Price stability isn't optional.

But here's the problem: every stablecoin payment on Ethereum is completely public.

Your treasury balance. Employee salaries. Vendor payments. Customer transactions. All visible to anyone with an Etherscan link.

Railgun lets you shield stablecoins on Ethereum. Keep the stability of USDC. Add the privacy of Monero.

[Felix Schäfer @feIixschaefer]

Have you ever looked at your public Ethereum activity and wished outsiders could not see so much of it?

Your customers may be able to see where payments go.

Employees may be able to observe payroll-related transfers of other employees.

Competitors may be able to follow recurring treasury movements.

Partners, suppliers, grant recipients and other counterparties can sometimes become visible through repeated on-chain activity.

That does not mean your team is doing anything wrong.

It means Ethereum was designed to make transaction activity publicly verifiable.

Railgun shows that there is another possible model: keep the assets on the same underlying chain while making much more of the activity private.

We are interested in hearing how companies actually think about this problem.

If your company could make one part of its Ethereum activity less publicly exposed, which would matter most?

[Haven Wallet @haven_wallet]

How do you make Ethereum private without building another Ethereum?

@RAILGUN_Project takes the privacy system to the smart-contract level.

It does not require users to move onto a separate Layer 2 or privacy chain.

Instead, assets enter a set of Railgun smart contracts and become part of a shared private pool.

Here is the basic flow.

1. Start with a normal wallet

You hold ETH, USDC or another supported token in a regular Ethereum wallet.

That wallet has a public 0x address.

2. Shield the assets

You transfer the assets into Railgun.

This transaction is public because the funds have to come from your public wallet.

An observer can therefore see that your address deposited assets into Railgun.

But that is where the normal transaction trail changes.

3. Enter the private pool

Inside Railgun, the assets are represented as private balances rather than ordinary public wallet balances.

A simple way to think about it is a large pool containing funds from many users.

One person may put in 10,000 USDC.

Another may put in 50,000 USDC.

Another may put in 500 USDC.

People can hold those assets for different lengths of time and use them in different ways.

Railgun uses cryptographic proofs to keep track of who is allowed to spend which funds without publishing the normal details of those balances.

4. Transact inside the pool

This is where the private activity happens.

Users can send funds privately.

They can also swap or interact with supported DeFi applications privately.

That activity creates more transactions and more possible relationships inside the pool.

Imagine 100 deposits and 100 withdrawals.

Some deposits are followed by activity after an hour.

Some funds remain inside for weeks.

Some users swap tokens.

Others send funds to another private balance.

The public blockchain still records that Railgun is being used.

But there is no simple public list matching each private action back to the original depositor.

5. Unshield

Eventually, a user can withdraw funds to a normal 0x address.

That exit is public again.

An observer can see that Railgun sent funds to that address.

But seeing the public entry and the public exit does not automatically reveal which entry produced which exit.

That distinction is important.

Railgun is not trying to make Ethereum transactions disappear.

It changes what information is exposed while the assets are inside the private system.

Railgun provides a private environment inside an existing public blockchain, with public entry and exit points but private activity between them.

[Felix Schäfer @feIixschaefer]

This is how Railgun makes private transactions possible directly on public Ethereum.

Railgun runs through smart contracts directly on the underlying blockchain.

Assets enter from normal public wallets, become private inside Railgun, and can then be used for private transfers, swaps, and supported DeFi interactions.

Under the hood, private balances are represented as encrypted UTXOs inside a Merkle Tree.

In simple terms, zero-knowledge proofs let the smart contract verify that a user has valid funds and is allowed to spend them without revealing the underlying private balance or normal transaction details.

A nullifier then marks those private funds as spent so they cannot be spent twice.

The second part is the shared privacy set.

Many users can hold the same assets, move different amounts, and transact at different times that all originate from one shared asset pool within the contract. That makes it hard to connect one exit transaction back to one specific entry transaction.

Railgun's documentation identifies the number of users and shield interactions, TVL, and private activity as important factors for confidentiality.

Railgun shows that Ethereum can remain fully public at the protocol level without every financial activity remaining public.

[Haven Wallet @haven_wallet]

How do you make Ethereum private without building another Ethereum?

@RAILGUN_Project takes the privacy system to the smart-contract level.

It does not require users to move onto a separate Layer 2 or privacy chain.

Instead, assets enter a set of Railgun smart contracts and become part of a shared private pool.

Here is the basic flow.

1. Start with a normal wallet

You hold ETH, USDC or another supported token in a regular Ethereum wallet.

That wallet has a public 0x address.

2. Shield the assets

You transfer the assets into Railgun.

This transaction is public because the funds have to come from your public wallet.

An observer can therefore see that your address deposited assets into Railgun.

But that is where the normal transaction trail changes.

3. Enter the private pool

Inside Railgun, the assets are represented as private balances rather than ordinary public wallet balances.

A simple way to think about it is a large pool containing funds from many users.

One person may put in 10,000 USDC.

Another may put in 50,000 USDC.

Another may put in 500 USDC.

People can hold those assets for different lengths of time and use them in different ways.

Railgun uses cryptographic proofs to keep track of who is allowed to spend which funds without publishing the normal details of those balances.

4. Transact inside the pool

This is where the private activity happens.

Users can send funds privately.

They can also swap or interact with supported DeFi applications privately.

That activity creates more transactions and more possible relationships inside the pool.

Imagine 100 deposits and 100 withdrawals.

Some deposits are followed by activity after an hour.

Some funds remain inside for weeks.

Some users swap tokens.

Others send funds to another private balance.

The public blockchain still records that Railgun is being used.

But there is no simple public list matching each private action back to the original depositor.

5. Unshield

Eventually, a user can withdraw funds to a normal 0x address.

That exit is public again.

An observer can see that Railgun sent funds to that address.

But seeing the public entry and the public exit does not automatically reveal which entry produced which exit.

That distinction is important.

Railgun is not trying to make Ethereum transactions disappear.

It changes what information is exposed while the assets are inside the private system.

Railgun provides a private environment inside an existing public blockchain, with public entry and exit points but private activity between them.

[Felix Schäfer @feIixschaefer]

Monero showed crypto could be private. Now Ethereum is finally getting serious privacy infrastructure.

For years, the normal answer to private crypto transactions was to use a privacy-focused chain.

But that creates a basic limitation:

Your privacy only exists inside that ecosystem.

The most important assets, stablecoins, smart contracts and DeFi applications that businesses already use are on Ethereum though.

@RAILGUN_Project adds a private transaction system on existing public chains just with smart contracts.

You can move assets into it, transact privately, swap, and interact with supported DeFi applications without moving to a separate privacy chain.

[Haven Wallet @haven_wallet]

How do you make Ethereum private without building another Ethereum?

@RAILGUN_Project takes the privacy system to the smart-contract level.

It does not require users to move onto a separate Layer 2 or privacy chain.

Instead, assets enter a set of Railgun smart contracts and become part of a shared private pool.

Here is the basic flow.

1. Start with a normal wallet

You hold ETH, USDC or another supported token in a regular Ethereum wallet.

That wallet has a public 0x address.

2. Shield the assets

You transfer the assets into Railgun.

This transaction is public because the funds have to come from your public wallet.

An observer can therefore see that your address deposited assets into Railgun.

But that is where the normal transaction trail changes.

3. Enter the private pool

Inside Railgun, the assets are represented as private balances rather than ordinary public wallet balances.

A simple way to think about it is a large pool containing funds from many users.

One person may put in 10,000 USDC.

Another may put in 50,000 USDC.

Another may put in 500 USDC.

People can hold those assets for different lengths of time and use them in different ways.

Railgun uses cryptographic proofs to keep track of who is allowed to spend which funds without publishing the normal details of those balances.

4. Transact inside the pool

This is where the private activity happens.

Users can send funds privately.

They can also swap or interact with supported DeFi applications privately.

That activity creates more transactions and more possible relationships inside the pool.

Imagine 100 deposits and 100 withdrawals.

Some deposits are followed by activity after an hour.

Some funds remain inside for weeks.

Some users swap tokens.

Others send funds to another private balance.

The public blockchain still records that Railgun is being used.

But there is no simple public list matching each private action back to the original depositor.

5. Unshield

Eventually, a user can withdraw funds to a normal 0x address.

That exit is public again.

An observer can see that Railgun sent funds to that address.

But seeing the public entry and the public exit does not automatically reveal which entry produced which exit.

That distinction is important.

Railgun is not trying to make Ethereum transactions disappear.

It changes what information is exposed while the assets are inside the private system.

Railgun provides a private environment inside an existing public blockchain, with public entry and exit points but private activity between them.