How it works
Sanctum separates who decides a trade from who makes it. You decide. One shared wallet makes it. A private ledger keeps track of what is yours.
Everything left of the shared wallet stays off chain.
A trade, start to finish
- 1Open an account
Your browser makes a key. That key is the account: it signs every request, and it never leaves your device. There is no email, no password and no wallet connection required. You can also derive the key from one wallet signature, so the same account opens on any device.
- 2Deposit SOL
Each account has its own deposit address. Send SOL to it from any wallet or exchange. When the transfer confirms, the ledger credits your balance and the SOL is swept into the shared wallet.
- 3Place an order
A buy, a sell, or a rule such as a stop loss. Your browser signs the order and sends it to Sanctum. No transaction is broadcast and no wallet pops up.
- 4The shared wallet trades
Sanctum checks the coin is safe, builds a swap through Jupiter, simulates it to confirm it can only move what the order allows, then sends it from the shared wallet. The ledger moves the coins to your account.
- 5Withdraw
Ask for a payout to any Solana address. The shared wallet sends it. The chain shows Sanctum paying that address; it does not show which account asked.
Why it is private
A normal trade is signed by your wallet, so your address is on it forever. Here the only address on any trade is the shared wallet's, and it is on everyone's trades. An observer sees a stream of swaps from one wallet and cannot tell which account asked for which, how much any one account holds, or what orders are waiting. Orders that have not filled exist only in the ledger. Payments between accounts are two ledger entries and never become a transaction.
Two things are visible: a deposit (someone sent SOL to an address) and a withdrawal (the shared wallet paid an address). For the cleanest separation, deposit from an exchange and withdraw to a fresh wallet. See exactly what the chain sees at each step.
What keeps the funds safe
Sanctum holds funds while you trade, the way an exchange does. That is the cost of privacy here, so the design assumes you should not have to take it on trust.
Every change is appended to a journal on disk before it takes effect, and each line extends a hash chain. The balances are whatever replaying that journal gives.
What the ledger owes is compared with what the shared wallet holds. A SOL shortfall stops all trading and withdrawals. A shortfall in one coin freezes that coin.
A swap built by a third party is inspected instruction by instruction and simulated against every token account the wallet has. If it would spend more than the order, or touch other holdings, it is refused.
Coins with a freeze authority, a transfer tax or other extensions that let a creator take tokens back are not traded at all.
Each signed request carries a timestamp, is accepted once, and expires after two minutes.
Every five minutes a fingerprint of all balances is published, and every hour it is written to Solana. Your browser can verify your balance is in it.