Xochi: Somos axolotls.

Soft-bodied, observable. Spawn point shouldn't determine whether you get privacy. Named for Lake Xochimilco, because the water doesn't care who's swimming.

The Agentic Dark Pool on Ethereum

Privacy in crypto today forces a bad choice: full transparency (Uniswap, CoW) or full privacy (Tornado Cash, now sanctioned). Dubai banned all anonymity-enhancing tools in January 2026, but the ban's definition excludes assets with "mitigating technologies" for traceability.

ERC-8262 (opens in new tab) "Xochi's ZK Compliance Oracle" specifies proofs over private compliance witnesses. Next, the Oracle is qualified on Base Sepolia and, after an external audit, deployed on Base; it is not in the live trade path yet.

What Xochi Does

You sign an intent, solvers compete to fill it (~2s typical, <6s P95).

Trust scoring is designed to lower fees and unlock deeper privacy, with ERC-8262 compliance proofs as its verifiable input. It is not live yet: every wallet trades at the Standard trust tier today. AES-256 and SHA-256, used throughout the stack, are already quantum-resistant. Xochi's ZK Compliance Oracle circuits can migrate from SNARKs to hash-based STARKs when needed.

ZK Compliance: Link credentials to unlock better rates and deeper privacy once trust scoring launches. Settlement: Public wallet and stealth (ERC-5564 + gasless ERC-4337 claim, Ethereum or Base) are live. Next is Private: settlement to an Aztec account you own, keys and backups held by you. Recipient-private, not amount-private: the source deposit, its amount and token, stay public. A testnet tracer (Base Sepolia to the Aztec v6 public testnet) runs first. The first production corridor then pays zk.money's enclave-backed DAI (OXDAI) on Aztec mainnet to privately allowlisted recipients, before the XSP custody contracts and an independent security audit, which come later; zk.money's enclave sees each recipient and amount, and an outage there stops payments. Sovereign is not in the first release.

Stealth payout links are cleared once a trade has been completed, failed or refunded with no further update for 7 days (an expired trade keeps them until its record is deleted), and trade records are deleted 90 days after the trade's last update in a final state; a retention hold delays both (privacy policy).

Xochi ID (XID): Onboard with a WebAuthn passkey (biometric), no wallet required. No username stored server-side. Credentials encrypted in KV with AES-256-GCM. Login is biometric only via discoverable credentials. Wallet connection is optional. Wallet-only users get Standard tier (0.22% on stablecoins, public settlement). XID holders are designed to earn trust via attestations for lower fees and deeper privacy once trust scoring launches. The server never learns which XID controls which wallet. WebAuthn's algorithm agility provides a migration path to post-quantum credential types. Agents transact as Guests (anonymous, x402 pay-per-call) or under a Member's Mandate (per-request EIP-712 envelope, inherits the Member's tier). See whitepaper Section 3.

The Problem

Nothing on-chain is both private and compliant. Privacy tools got sanctioned. Dark pools offer no regulatory path. Since The Merge, $1.1B+ has been extracted via MEV (Maximal Extractable Value) per ESMA's July 2025 risk analysis. Bots see your pending transaction and trade ahead of it (frontrunning) or sandwich it, buying before and selling after your trade to pocket the price difference. A protocol treasury rotating from USDC to EURC signals the move to every bot on Base. Bigger trades bleed more.

How We Solve It

The Xochi ZK Compliance Oracle is designed to generate cryptographic proofs that a trade is AML (Anti-Money Laundering) and sanctions-compliant without revealing the trade itself. Next, it is qualified on Base Sepolia and, after an external audit, deployed on Base; it is not live yet. Tokens settle into stealth smart accounts: one-time receiving addresses that can't be linked back to you (ERC-5564), deployed as smart contract wallets (ERC-4337) that the recipient claims without needing ETH for gas. You sign what you want, solvers compete to fill it. Nothing hits the mempool (the public queue of pending transactions).

Where Xochi Sits

The privacy stack has layers. Xochi is the execution layer; the others sit elsewhere.

Wallet / deposit privacy (Railgun, Panther): Hide your wallet, but swaps still happen on Uniswap in public. MEV bots see the swap. Compliance means handing over view keys. That's delayed transparency, not privacy.

Deposit set membership (Privacy Pools by 0xbow): Prove your deposit isn't in a sanctioned set. Necessary but not sufficient. Doesn't cover jurisdiction-specific risk thresholds or anti-structuring. Composes with Xochi: clean withdrawal, then private execution.

Privacy L1s (Secret, Penumbra): Full privacy on a separate chain. Bridge in, trade, bridge out. No compliance path.

Privacy-native chains (Monero, Zcash, Litecoin MWEB): Stronger transaction privacy, no smart contracts, no ERC-20s, no compliance path. Different tradeoff: maximum opacity at the cost of operating outside regulated financial rails entirely. Xochi solves privacy where the assets already are.

Kohaku (Ethereum Foundation wallet SDK): Stealth addresses, per-dapp accounts, optional reveal for audits. Wallet-layer only. Once you trade, privacy ends. Complementary to Xochi: Kohaku is the wallet, Xochi is the DEX. A Kohaku stealth address can receive a Xochi stealth settlement directly, and a shielded one once that is live. GitHub: ethereum/kohaku (opens in new tab).

Xochi (execution venue): Hides the recipient and counterparty (amounts stay public), settles on Ethereum. Nine ZK proof types are designed to cover what regulators actually need. "Not in the bad set" is necessary but not sufficient. Xochi is built to prove the full claim. Formalized as ERC-8262 (opens in new tab) (Draft).

How It Works

Riddler is our solver, the entity that sources liquidity and executes trades. It pulls from its own inventory, centralized exchange books, decentralized exchange pools, and flash loans (uncollateralized loans repaid within a single transaction). Orders beyond available liquidity are rejected, not partially filled. Own API surface, own fee tiers, own settlement targets. External solvers can join without gatekeeping: solvers compete in a sealed-bid auction for the best output, Riddler posts a reserve bid so your quote is a guaranteed floor, and it backstops any winner that defaults. Settlement is designed to be non-custodial: origin funds sit in an on-chain escrow, released only against a proven fill or refunded permissionlessly, so the venue never holds your principal. Every non-Open, non-Public swap is cash-positive. Revenue model in whitepaper Section 7.

Mana (opens in new tab) is our Elixir Ethereum execution client (Apache 2.0 + MIT), a direct contribution to client diversity. The BEAM runtime provides fault isolation, hot code upgrades, and preemptive scheduling that no other execution client offers. Elixir fails differently from Rust, which is the point of client diversity. Hot code upgrades also enable signature scheme swaps without validator downtime, a practical path to post-quantum readiness.

Target Market

Protocol treasuries rotating reserves without signaling
DAO treasuries needing private FX (USDC/EURC) for contributor payroll
Crypto funds executing size without moving markets
Retail wanting basic privacy for free
AI agents transacting as Guests (anonymous, pay-per-call) or under a Mandate from a Member (inherit the Member's tier and privacy). Routes via Raxol (opens in new tab) (MIT-licensed, supports x402 HTTP payments and multi-path payment routing)

Status & Roadmap

Public and stealth settlement are live. Next, ERC-8262 qualifies on Base Sepolia (Oracle deployment, 0x04 credential proofs, signed 0x07 and 2-of-3 0x09, and a Base Sepolia proof verified in Xochi staging), followed by an external audit and the production Oracle on Base. Alongside it, recipient-private Aztec settlement runs as a testnet tracer, then launches its first production corridor on zk.money's enclave-backed DAI (OXDAI) before the XSP custody contracts and an independent security audit, which come later (recorded tech debt). Trust scoring, the Oracle and shielded settlement are not live yet, and no launch date is committed. See the shielded execution decision and launch gates.

Team

Name	Role	Background
DROO	Protocol Director	Lido, Blockdaemon, General Dynamics
Bloo	Protocol Specialist	DOJ Financial Intel, FBI AML, Pentagon

Full backgrounds in whitepaper.