Bridge. Arrive on Arc without bringing your history with you.
Circle's USDC Bridge moves USDC onto Arc in one transaction and publishes every part of it: who sent it, how much, and where it landed. Fund an agent that way and its whole treasury is legible before it acts. This bridges into a shielded pool instead — the deposit is still public, the withdrawal is still public, and which deposit paid which withdrawal is not.
The privacy here is a crowd, not a cloak. It is worth exactly as much as the number of deposits sitting in the pool alongside yours, and nothing at all when that number is one.
FIG.1
One transaction on Ethereum Sepolia, Base Sepolia or Arbitrum Sepolia. It names the gateway on Arc as both the payee and the only address allowed to deliver the message, and carries your deposit's commitment in the hook.
Visible · Your address, the amount, the time, and that it is going to this pool.
FIG.2
Circle attests the burn; anyone can deliver it. The gateway mints the USDC and puts it in the pool in the same transaction — it never holds funds between transactions and has no owner, no pause and no sweep.
Visible · A deposit of that amount joining the pool.
FIG.3
Your privacy is the deposits that arrive after yours. Withdrawing a minute later, for the same amount you deposited, tells anyone watching exactly which deposit was yours.
Visible · Nothing new. This step is the one that does the work.
FIG.4
A zero-knowledge proof, built on your device, says you know the secrets behind some commitment in the pool — without saying which. A relayer submits it and is paid out of the withdrawal, so the address receiving the money never needs gas.
Visible · A withdrawal to a fresh address. Not which deposit funded it.
FIG.1
Connect the wallet holding the USDC. Injected wallets only — WalletConnect would tell a third party which addresses open this page, which is a strange trade on a page about not being seen.
Disabled until the gateway is deployed. The transactions are built here and sent from your wallet; there is nothing to send them to yet.
FIG.2
The contracts build, the tests pass against Circle's live CCTP contracts on a fork of Arc mainnet, and a proof generated by this code verifies against the verifier that would judge it. None of that is a deployment. Until the addresses below are filled in, this page can show you the shape of the thing and refuse to pretend it can move money.
- Entrypoint
- not deployed
- PrivacyPool
- not deployed
- VeilGateway
- not deployed
- Relayer
- not deployed
Holds the pool registry and the association-set roots
Holds the USDC and the commitment tree
Turns a CCTP burn into a deposit
Submits withdrawals, so a fresh address needs no gas
FIG.3
The withdrawal proof is built in your browser from a 17 MB proving key, downloaded once and kept. It takes a couple of seconds. The secrets it consumes never leave the tab; what goes to the relayer is the proof and eight public numbers.
What this hides. And everything it does not.
What could go wrong. Including the parts that are not settled.
It cannot. The recipient, the fee and the pool are hashed into the proof's context, and the pool recomputes that hash before paying anyone. A relayer can refuse; anyone else can then submit the same proof.
It cannot. It receives a proof and eight public signals. None of them names a deposit.
The gateway never reverts after the mint. A bad hook, a dead pool, an amount below the minimum — each becomes a plain transfer to the refund address the burn named.
It is. A postman we run publishes the association-set root, and today it admits every label without filtering. If it stopped, a deposit could still be pulled back publicly through the gateway's ragequit, which needs nobody's permission — but its privacy would be gone.
The Entrypoint is upgradeable and the 2-of-3 Arcveil account holds that power. Two of three keys can change how withdrawals work. That is a real risk, it is on chain, and there is no timelock in front of it yet.
They will, if you let them. Depositing 1,234.56 USDC and withdrawing 1,234.56 USDC an hour later identifies you to anyone with a block explorer, whatever the cryptography does.
It can. Arc's USDC asks a compliance precompile whether an address is blocked on the mint path, and every transfer routes through a second precompile whose code nobody outside Arc can read. Nothing here can override either, and no test covers them — a fork has no precompile to run.
The pool contracts and circuits are Privacy Pools, unmodified, audited by Oxorio and Auditware. The gateway, the relayer and the postman are ours and are not audited by anyone.