Stellar private payments hide counterparties on testnet

A deposit enters the Stellar Private Payments pool in full view: the transaction’s ext_amount is positive. A withdrawal leaves the same way. But when money moves from one user to another inside the pool, `ext_amount` is 0—the transfer happens inside encrypted commitments, with neither the recipient’s address nor the amount appearing on the public ledger.

The system was built by Nethermind and is now available as a working testnet implementation for developers. A user deposits an asset into a shared pool, where the deposit becomes a commitment in a Merkle tree—a cryptographic record proving that value exists without revealing its owner. To spend it, the user publishes a zero-knowledge proof, which shows that the notes are valid and owned without identifying them; a nullifier prevents the same note from being spent twice.

That privacy is about counterparties, not simply confidential amounts. Stellar says the design fits B2B payments or donations where the relationship between two parties is sensitive. Its protection gets stronger as more accounts use the same pool: with only two participants, matching timing and amounts could still make a transfer easy to correlate. Users can keep a private balance and pay multiple counterparties before withdrawing to a public address.

The preview also puts controls around how a pool is deployed. Association Set Providers can configure a pool as a block-list, an allow-list or both, with each transaction proving membership or non-membership without revealing a user’s history. An optional global view key can give a designated auditor visibility across in-pool transactions. These tools are presented as ways for deployers to address compliance obligations without exposing every transaction to the public.

So what changes in practice? Developers can test a payment flow in which the public chain shows funds moving into and out of a pool, but not who paid whom in between. That could give organizations a way to explore private B2B transfers or donations on public rails. The limits are clear: Stellar calls this a developer preview, the contracts are unaudited and under development, and the implementation is not yet approved for mainnet.