How Husk works

Overview

Solana is a public ledger. Anyone can look up a wallet and read its balance, every token it holds, and every trade it ever made. Husk gives you wallets that are not connected to you, and wallets that cannot be emptied by a single stolen key.

It is non-custodial in the strict sense: your keys are generated in your browser and never transmitted, we hold no funds, and if this site disappeared your money would still be recoverable from your recovery phrase.

We did not write the cryptography. The shielded pool is Privacy Cash. Shared control is Squads v4. Our own code generates keys, manages the burner lifecycle and draws the screens.

The pool

A shielded pool is a shared vault that thousands of people deposit into. Once your SOL is inside, it stops being your wallet's money and becomes an encrypted note that only your browser can open.

1. Deposit. You send SOL from Phantom into the pool. This is public. Anyone can see that your wallet used a privacy tool, and that is all it tells them.
2. Withdraw. You take SOL out to any address, including a wallet created seconds ago. A zero-knowledge proof convinces the on-chain program that you own enough in the pool and have not spent it twice, without revealing which deposit was yours.

The link between deposit and withdrawal is broken cryptographically, not by obscurity. But a pool only hides you among people using it at the same time. See what we don't claim.

The four wallets

One generic wallet does every job badly. Husk gives each job its own.

Ghost

Hold and send privately. Your balance never sits on chain under your name, and whoever you pay cannot see where it came from.

Burner

A disposable wallet for one trading session. You export its key into any terminal, trade at full speed, then shed it.

Vault

Where the money you are not trading sits. Your phone is the only key that can approve a withdrawal, and it can kill one before it lands.

Multisig

Shared control for a team. A threshold of named people must approve, and a time lock gives everyone a window to stop it.

Burner lifecycle

This is the part most people come for, so here is exactly what happens.

1. Generate. Your browser produces a fresh keypair with the operating system's random number generator. It is never sent anywhere.
2. Fund. The pool pays that new address. Because the money came out of the pool rather than out of you, nothing on chain connects the two.
3. Export. You copy the private key into Axiom, GMGN, Photon or anything else that accepts one. No integration, no partnership, no permission from anyone.
4. Shed. One click closes every token account, which refunds roughly 0.00204 SOL of rent each, sweeps the remainder back into the pool, and the wallet is dead.

What this hides: who you are, your portfolio, your history, your total size, and the link between any two sessions. A copytrader following one burner gets one session and then it evaporates.

What it does not hide: the trades inside a single live session are public, because the terminal signs them publicly. Rotate per trade if that matters, at the cost of rent each time.

You can run several burners at once, which is a feature rather than a workaround: split your size across three and nobody sees your real position.

Vault and Multisig

Both run on Squads v4, a multisig program securing around $10B on Solana. We write no program of our own for these.

Vault

Configured as a threshold of one where only your phone can approve and the app key can only request and execute. A stolen key on your laptop cannot move anything, because it cannot vote.

When your phone approves, a delay you chose starts running. During that window your phone alone can cancel it. The delay starts at approval rather than at the request, deliberately: the alternative makes the phone a passive veto that fails whenever you are asleep.

Multisig

Members, a threshold, and an optional time lock. One important behaviour to know before you rely on it: rejecting an active proposal takes one vote, but cancelling an already-approved one takes a full threshold of cancel votes. One cancel vote does nothing and the transaction still lands.

Spending limits bypass everything. A limit lets a named key spend up to an amount with no approvals and no time lock, and that key does not even have to be a member. Removing someone from the team does not revoke their limit. Treat limits as a separate, dangerous permission.

Keys and recovery

There is no account, no email and no password on a server. Two ways in:

Connect a wallet

Your existing wallet signs one message and a password you choose is mixed into the derivation. Nothing to write down, and a signature alone is not enough to reach your balance.

Create a Husk wallet

A fresh random key with a recovery phrase shown once, unlinked to anything else you own.

The password encrypts the local copy on that device. It is not a login, nothing on a server checks it, and there is no reset. Lose the recovery phrase and the money is gone with nobody to appeal to.

One secret does both reading and spending. The spend key is derived from the viewing key, so there is no watch-only mode and anyone who can read your notes can spend them. We mention it because other projects imply otherwise.

What we can see

Nothing. Not by policy, by construction. We never receive a key, we store no user records, and there is no support flow that looks up a wallet because no such lookup exists.

That cuts both ways. We cannot help you recover anything, reverse anything, or tell you which burner was yours.

What Privacy Cash can see is a different question, and the honest answer is: more. Their relayer submits every withdrawal, so it sees your recipient address and which notes you are spending. The chain cannot link your deposit to your trading wallet. Their server could.

What it costs

The flat part of the withdrawal fee dominates small amounts. Moving 0.1 SOL loses 6.3%. Moving 1 SOL loses 0.95%. Moving 10 SOL loses 0.41%. Use larger burners, fewer times.

A deposit is often described as free. The pool charges nothing, but each one creates two accounts that are never closed, so about 0.00156 SOL does not come back. We would rather show that number than round it to zero.

What we don't claim

• Privacy is proportional to the crowd. If four withdrawals happened in the last hour, you are hiding among four people, not among everyone who ever deposited. The app shows that number and warns you when it is too thin to help.
• The relayer is a trusted party. Unlinkable on chain is not unlinkable everywhere.
• The delay is a window, not a wall. A Vault only protects you if you act during it.
• There is no watch-only mode, and there cannot be with this construction.
• A burner's live session is public. It is unattributed, not invisible.

If any of this changes, this page changes with it.