Confide — private block trades for tokenized stocks
Confidential delivery-versus-payment on Solana. Exchange tokenized stock for stablecoin in
one atomic transaction. Each side verifies the other's encrypted amount before signing, and
everyone else sees nothing that moved — no size, no price, no position. Confide builds the
zero-knowledge proofs the chain will not assemble for you, with nobody in the middle.
One correction to the video, 2026-09-30. It says "every tokenized stock on Solana". The
measurement is 1,992 mints from three issuers' catalogues — exhaustive over that list, not a
census of the chain. Everything the video counts is unchanged; only the population's name was
wrong. The narration is left as recorded because it is the record of what was said —
docs/cwf-2026/THE-POPULATION.md.
Why now
On 17 September 2026 the SEC gave tokenized stock five years of relief — and set the
conditions: AMM-executed trading only, every fill's size, time and direction published within
ten minutes, a Tier 1 name capped at 0.25% of average daily volume. Block trades have always
settled away from that tape, and a desk cannot go where every fill is published. Confide settles
off it — and is not a venue, so the exemption neither covers it nor is needed.
What is on chain, and what Token-2022 does not provide
All 1,992 tokenized-equity mints from three issuers' catalogues already run Token-2022 with
confidential transfers on and the auditor slot empty — every mint in the list checked, not
sampled, and the list is a catalogue rather than a census. The
same 1,992 carry permanentDelegate, pausableConfig and a transfer hook. Token-2022's only
disclosure model is mint-wide — one auditor key, reading every transfer made while it is set,
scoped to nobody. Every holder's transfer amounts, or no one's; there is no setting in between. Why the slot is
empty is not measured — an empty slot is also what a zero-initialised mint gets by default
(THE-PINCER.md).
And a confidential account cannot receive anything until its issuer signs for it.
Which makes the first trade an issuance
Of 518,744 live accounts, two have asked for a confidential balance and none has been
approved. So the party who can open the account is one of the two parties to the trade — and the
first trade through that gate is not a swap between holders. It is an issuance.
What runs today — a trade that settles without publishing either side
The gate, both ways — the first trade, which is an issuance. The same 20,000-share allocation
against $3,500,000, sent twice. ./scripts/issue-e2e.sh
issuance: REFUSED, the issuer had not signed for the account
error {'InstructionError': [0, {'Custom': 24}]} (expected)
issuance: the same allocation, after the issuer signed
error none 2 signatures 59,804 compute units
One instruction from the issuer stands between the two. The auditor slot is empty throughout —
the issuer is the sender and needs no key to read what they sent.
5fqZLgbj… refused ·
29coq95v… settled
Then between two strangers, sharing nothing but public keys. Run it yourself with
MODE=dvp ./scripts/swap-e2e.sh; these three are on devnet now.
$ MODE=dvp ./scripts/swap-e2e.sh
50,000 shares ↔ $8,750,000 $175/share, agreed off chain
one transaction 2 signatures 59,804 compute units 1,074 bytes
alice, stock (delivered) 123,000 units bob, stock (received) 50,000 units
bob, cash (paid) 250,000 units alice, cash (received) 8,750,000 units
All four accounts are ordinary associated token accounts — what a wallet creates — and all four
still report a public balance of 0. Nobody watching the chain learns the size of the trade or
the price it implies.
| devnet |
|---|
| stock for stock | 2RksP5AM… — 29,417 CU, 1,006 bytes |
| stock for cash | 4gzku3FW… — 29,849 CU |
| stock for cash, on a mint shaped like PYUSD | 5ZrJPGRL… — carries confidentialTransfer and confidentialTransferWithFee in one transaction |
The numbers
| |
|---|
| 1,992 | tokenized stocks ship confidential balances — every one of them |
| 518,744 | live token accounts across Apple, NVIDIA, SpaceX, Anthropic and AMC |
| 2 | have asked for a confidential balance — one on NVDAx, one on AAPLx |
| 0 | have been approved. Nobody is through the gate. |
Counted from mainnet by ./scripts/usage-scan.sh, on six mints — two per issuer — on 2026-09-28. The
feature is shipped and gated on every mint in the list; on the six counted, no issuer has approved an
account yet — so where we looked, nobody is using it yet. The other mints
in the list have not been counted.
Go and do it yourself — devnet, nobody's permission
The whole flow, one command, then re-read from the chain by a separate keyless process:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
