Private payments on QBC: classical, post-quantum, and unlinkable, all live

Most chains show you everything. Every amount, every sender, every receiver, in the clear, forever. QBC does not have to. Today we ran three different kinds of private payment end to end on the live chain, verified every step on-chain, and we are publishing the transactions so you can check the claim rather than take our word for it.

There are three tiers, and they are not the same thing:

1. Amount-hiding payments, using classical zero-knowledge range proofs.
2. Post-quantum amount-hiding payments, moving real value, using Plonky3 native-FRI zero-knowledge proofs that rely on hash functions rather than elliptic curves.
3. Post-quantum unlinkable spends, where a transaction reveals only a nullifier and a zero-knowledge proof, and does not reveal which note was spent at all.

All three are live. We ran one of each. Here is the evidence.

Tier 1: hide the amount (classical)

A confidential payment on QBC replaces the amount with a Pedersen commitment, C = v*B + r*H, and proves in zero knowledge that the hidden values are valid and that they balance. Nobody watching the chain learns the numbers.

We moved real QBC between two wallets and verified the value actually landed, with the transfer amount hidden the entire way:

• Shield. The sender shielded a transparent 0.5 QBC output into the confidential pool. Its public balance dropped and a commitment took its place. Shield at block 2083177, commitment 0xd8d40651....
• Private transfer. The shielded note was spent into a payment note and a change note in one transfer. Amounts hidden, balance and ranges proven in zero knowledge with Bulletproofs. The on-chain extrinsic carries only commitments and a proof, no cleartext value at all. Transfer at block 2083178, extrinsic 0x78352df5....
• Unshield. The payment note left the pool as a normal 0.4 QBC output at the recipient wallet, with the exit cryptographically bound to that address. Unshield at block 2083179, extrinsic 0x087747c8....

The proof it worked is the recipient's public balance: it rose from 0.499 QBC to 0.899 QBC, exactly 0.4 QBC more, while the 0.4 QBC transfer amount never appeared anywhere on the ledger. Real value moved, the amount stayed private, and both facts are checkable on-chain.

Bulletproofs are excellent, well-studied, and fast. They are also classical: a large enough quantum computer would eventually break their hiding assumption. That is why we did not stop here.

Tier 2: hide the amount, post-quantum, with real value

QBC deploys a natively post-quantum confidential pool. The proofs are Plonky3 native-FRI zero-knowledge arguments over the Goldilocks field. Their security rests on the collision resistance of a hash function, not on the discrete logarithm problem, so a quantum adversary does not get a shortcut.

We moved real value through it, from Wallet B back to Wallet A:

• Post-quantum shield. Wallet B shielded its 0.5 QBC into a post-quantum note. The client produced a Plonky3 open proof that the commitment opens to exactly 0.5 QBC, and nothing else. That proof is 121,440 bytes. On-chain, Wallet B's transparent balance went to zero and the pool's tracked value rose by 10. Shield at block 2082996, commitment 0xdd9432de..., extrinsic 0xcfb291a5....
• Post-quantum unshield. The note left the pool as a transparent 0.5 QBC output at Wallet A, again with a Plonky3 proof, bound to Wallet A's address so no relayer can redirect it. Unshield at block 2082997, extrinsic 0x7ed96338....

About half a QBC moved from one wallet's control to another, through a post-quantum zero-knowledge pool, with the amount hidden in transit. This is not a testnet toy and it is not classical cryptography. It is post-quantum confidential value, live.

Tier 3: hide which coin you spent (post-quantum, unlinkable)

Hiding the amount is powerful. Hiding the link is the frontier. In an unlinkable design, a spend does not point at the note it is spending. It publishes a nullifier, a unique tag that stops the note being spent twice, and a zero-knowledge proof that says only this: "there exists a note in the tree whose root is anchored on-chain, I know its secrets, and here is its nullifier and a valid new output, and value balances." The observer cannot tell which note in the whole tree was consumed.

We now run this with real value, end to end. A wallet shielded 0.5 real QBC into the unlinkable pool with shield_v7 (the pool's tracked balance rose by exactly 0.5), then spent that note unlinkably and cashed it out to a different wallet with unshield_v7:

• The client built a 243,998-byte Plonky3 proof of Merkle membership, correct nullifier derivation, and value balance, revealing none of the input note's secrets.
• The spend published nullifier 0x5c32fdf7..., spent the input without revealing which note it was, and paid out real QBC to the recipient. Unshield at block 2083398.
• The recipient's public balance rose by exactly the payment (0.49999999 QBC after a one-unit fee), and the pool's conservation counter returned to zero. Real value moved through a pool where the transaction graph is hidden.

We then battle-tested it: attempts to mint more than the pool holds, to replay a nullifier, and to forge a larger exit value were each rejected on-chain. A pallet-level conservation invariant makes net inflation impossible by construction: the pool can never pay out more real QBC than was shielded into it, whatever a circuit bug might attempt. This is Orchard-class privacy, made post-quantum, moving real value in live consensus. To our knowledge no other live chain combines all three at once: post-quantum soundness, full sender and receiver unlinkability, and real value, verified natively in the protocol rather than in a contract. The construction and constraint system are in our design paper, Post-Quantum Confidential Transactions with In-Runtime STARK Verification.

Exactly how to do it

The confidential operations are driven by the same primitives the wallets use. For the amount-hiding path, the shape is:

# shield a transparent output into a confidential note (amount hidden)
qbc-keytool conf-shield-utxo --keyfile A.json --rpc <rpc> \
  --submitter-suri <fee-payer> --utxo <txid:vout> --utxo-amount <units> \
  --blind-seed <secret>

# private transfer: split one note into a payment and change, amounts hidden
qbc-keytool conf-transfer --rpc <rpc> --submitter-suri <fee-payer> \
  --in "<value>:<blinding-hex>" \
  --out "<pay-value>:<seed>,<change-value>:<seed>" --fee <units>

# unshield a note back to a transparent output at a destination
qbc-keytool conf-unshield --rpc <rpc> --submitter-suri <fee-payer> \
  --value <units> --blind-seed <secret> --dest <address>

The post-quantum pool uses the same flow with the -v4 variants (conf-shield-v4, conf-unshield-v4), which produce and verify the Plonky3 proofs instead of Bulletproofs. The unlinkable spend uses the note-commitment tree and a transfer_v7 proof.

If you would rather click than type, the browser wallet at qbc.network/wallet carries the confidential panels, and the amounts and blindings never leave your device.

The honest boundary

We hold ourselves to a single rule about claims: label maturity precisely, and never let a design read as a deployment. So, exactly where each tier stands:

• Live and tested, real value: amount-hiding confidential payments, both the classical pool and the post-quantum pool. Demonstrated above with real QBC.
• Live, real value, unlinkable: the post-quantum unlinkable pool moves real QBC end to end (shield, unlinkable spend, payout), guarded by a conservation invariant that makes net inflation impossible, and exhaustively battle-tested on-chain (mint, double-spend, and value-forge attempts all rejected).
• The frontier, live today: to our knowledge no other chain runs all three at once, post-quantum soundness, full sender and receiver unlinkability, and real value, verified natively in consensus. That combination is what QBC runs now.

Hiding the amount is done, running, and holds real value, classically and post-quantum. Hiding the graph is deployed as a proving ground and moves to real value once the cryptography clears the review it deserves. That is the frontier, and every transaction above is on the chain right now for you to check.