HOW MUCH STEALTH DOES A STEALTH ADDRESS GET YOU?

Give someone your Ethereum address and you hand them your financial history. Every payment you have ever received, every token you hold, every counterparty you have ever touched, are all indexed, searchable, and permanent. This transparency is a feature of the blockchain.

Stealth addresses are the protocol-level answer to this transparency. The idea predates Ethereum, it comes from the Bitcoin dark-wallet era and was industrialized by Monero. The EVM version is now standardized as ERC-5564¹ and ERC-6538², and the mechanics are quite elegant. You publish a pair of public keys once. When someone pays you, their wallet performs a little elliptic-curve handshake with your keys and derives a fresh, one-time address that has never appeared onchain before. To the chain, the payment goes to a stranger. Only your viewing key can detect that the stranger is you, and only your spending key can move the money.

Stealth addresses have two clauses:

• Anonymity: an observer cannot tell who was paid.
• Unlinkability: an observer cannot tell that two payments went to the same person.

This essay explores three generations of EVM stealth protocols, using nothing but public data; event logs, public explorer APIs, ENS reverse records, and the open web. Stealth addresses are useful for receiving money, but many users link their identity when sending the funds on. I measure how three generations of stealth protocols actually perform.

Umbra (2021) is the registry era. Your stealth public keys are published onchain in a StealthKeyRegistry, bound by a signature to your wallet, forever. A sender reads your keys from the registry, derives a fresh address, pays it, and the contract emits an Announcement, an ephemeral key and the stealth address, for your viewing key to scan.

When you want the money, you withdraw it yourself, from the stealth address, with your own transactions. It is the purest design of the three. There is no operator, no servers, and nothing to subpoena. It is deployed across Ethereum Mainnet, Arbitrum, Optimism, Polygon, Base, and Gnosis.

The design consequence is equally pure: registration is a permanent, public identity anchor, and every withdrawal is a user-signed transaction that can be seen by anyone.

Fluidkey (2024) is the smart-account era, and its first move was to delete the registry. Keys are derived client-side from a wallet signature; with Fluidkey's backend holding a BIP-32 viewing-key node so it can scan on your behalf. You get an username.fkey.eth name, but it is sealed: an offchain CCIP gateway returns a fresh stealth address on every resolution, and zero subnames ever touch the ENS registry.

Your stealth account is a counterfactual 1-of-1 Safe smart account, deployed only when you first spend from it, at the same address on every chain. An optional auto-earn module sweeps your balances into yield vaults, operated by Fluidkey's own relayer. Fluidkey stopped the registry leak, but in its place, a proprietary module-and-relayer stack that turns out to leave a rich, enumerable operational footprint. I enumerated the entire user base in an afternoon.

Cloaked (2026) is the gateway-and-7702 era. Your username.clkd.eth resolves through a CCIP gateway that mints a fresh stealth EOA on every query. The backend holds the child viewing key and, by its own documentation, sees everything. It cannot move your money, but nothing you do is private from it. Your receive page at username.clkd.id is a public web page that rotates a fresh address on every visit.

Spending is where it gets interesting: your stealth EOAs are converted into smart accounts via EIP-7702 delegations to Porto accounts, executed through a public Orchestrator and relayed by Cloaked's servers. Merging several stealth accounts into a single spend is not an accident; it is a product feature: a UX trade-off that unifies your receiving addresses. There is even an optional 0xbow Privacy Pools integration for "incognito balances," which can add more privacy.

The generational pattern is the first real finding of this study. Each protocol fixed the previous generation's onchain leak, but introduced a new one somewhere else. Umbra leaked at registration. Fluidkey sealed the registry and leaked at operations. Cloaked sealed the registry and the receive layer, and leaks at naming and spending.

There are two important definitions before we dive in:

• Linked - means an observer can prove that two or more stealth accounts share an owner, or tie a stealth account to a known wallet.
• Named - means linked to a human-readable identity: an ENS name or a published username.

On Ethereum mainnet, Umbra processed 24,988 stealth payments to 11,578 registrants. Of all payments, 56.2% are linkable to a publicly known wallet. Since 8.1% of recipients never touched their funds at all, this figure increases to 61.2%, among users who actually used the system. One in five payments, 21.3%, resolves to a human-readable ENS name. The largest single user's cluster contains 131 stealth addresses.

Kovács and Seres (2023)³, deanonymized 48.5% of Umbra Ethereum mainnet payments with data through mid-2023. With three more years of chain history and two additional heuristics, that figure rises 12.7 points to 61.2% of active receivers. Every additional transaction gives an analyst another opportunity to link addresses.

Across L2s, where Umbra is also deployed, I ran the same treatment on 266,339 announcements, ~11 times mainnet volume. The result is worse than mainnet: 73.3% of active receivers are linkable: Arbitrum 76.0%, Base 77.4%, Optimism 69.8%, and Polygon 72.2%.

Fluidkey has 31,263 stealth Safes on Base. Of the 28,681 I could observe onchain, 44.3% are linkable through shared withdrawal destinations, shared funders, and atomic co-creation: 40.6% of the entire census. A tenth of all Safes were born pre-linked, before moving a single cent.

Cloaked has 4,321 spend EOAs across Base and Ethereum. 40.1% of Base spenders and 61.1% of Ethereum spenders welded their stealth accounts together in the very act of spending. One user merged 51 one-time addresses in a single transaction.

Umbra's registry binds your stealth keys to your everyday wallet with an onchain signature. That transaction is public, permanent, and, crucially, usually sent from the wallet you use for everything else. I reverse-resolved every registrant in the registry's history: 4,286 of 11,578 mainnet registrants (37.0%) registered from addresses with public ENS names. Before receiving a single private payment, more than a third of Umbra's user base had given their identity to their stealth keys.

The registration is also effectively forever. Across the registry's whole history there were 111 re-registrations, of which 103 were UI double-submits. Only eight users have ever rotated their keys. One registration is a lifetime identity anchor, and the protocol gives you no reason and no easy way to change it.

The most striking pattern in the registry is who shows up when it hurts. During the May to July 2022 contagion, when the UST collapse cascaded into Celsius and 3AC, registrations spiked to 617 in a single week, and that crisis cohort was 51.3% ENS-named, against a 37% baseline. Panic drives people to privacy tools, wanting to move money without being seen, but it drives them there with their most doxxed wallet in hand. There are also 192 blocks containing three or more registrations (one block holds 33): the fingerprints of bulk operators mass-registering hundreds of named identities, roughly a tenth of all users.

Registration doxxes the keys, and withdrawal doxxes the payments. Umbra users withdraw from their stealth addresses themselves, and where those withdrawals land is the single most destructive fact in this study: 8,932 stealth addresses, 35.7% of all, swept their funds to an address that is itself a registered Umbra key-holder. The user receives privately, then sends the money to a wallet the whole world can see registered. In one transaction, they totally deanonymize that payment.

The sender side completes the circle, and it is darkly funny: 391 users paid a stealth address and then withdrew the funds back to the exact same wallet that sent them. A full self-payment loop, performing the entire stealth ceremony (key registration, ECDH derivation, one-time address, scan, withdraw) to move money from their left pocket to their right, publicly, with zero privacy function. 174 of them did the above from an ENS-named wallet; sorry to shame yicheng.eth, rockypanda.eth, tipscoin.eth attempting to pay themselves in stealth. More broadly, 41.5% of all withdrawals land in wallets that are themselves active, visible Umbra senders. The private recipient, more often than not, turns out to be a public one.

The strongest heuristic in the entire study works on all three protocols, and it is older than blockchains: pay out to the same place, and every "unlinkable" account welds together. You can receive through a hundred one-time addresses, but the moment the money converges to one destination wallet, one funder, or one transaction, the hundred addresses become one person, provably, forever.

Umbra's welds are behavioral. Shared withdrawal destinations plus same-block sweeps (1,102 stealth pairs withdrew in the very same block, against roughly twenty expected by chance, a 55× lift) put 48.3% of active stealth addresses into clusters, the largest spanning 131 addresses.

Cloaked's welds are a feature and arguably good UX. The app invites you to combine stealth accounts in one spend, and every such merge is an onchain proof of common ownership, executed through a public orchestrator and recorded forever. Of the 573 multi-EOA spend transactions, I fully decoded 550: 100% are coherent single-user consolidations. One user merged 51 stealth EOAs in a single transaction, 51 cryptographically pristine one-time addresses, welded into one identity with one click. You can explore the linkage between these stealth addresses here.

Fluidkey's welds are the subtlest, and the most instructive, because they happen at three different moments in a Safe's life:

5,026 Safes share a funder, the same personal wallet sent them their first funds, and one wallet seeding many accounts probably means one owner.

The trick is telling users from infrastructure, which I can derive from the number of transactions an address has ever sent. For example, a CEX hot wallet with 478,873 transactions funds thousands of strangers and proves nothing, while a normal wallet with 74 transactions that seeded 836 Safes could only be one operator.

1,224 transactions initialized multiple Safes atomically, 3,335 Safes, 10.7% of the census, born pre-linked, sharing their configuration choices 93% of the time.

I decoded over 100,000 fund movements out of 27,013 active Safes and found that a naive analysis fake-links 91% of users, because everyone shares the same protocol-internal counterparties (earn vaults, share burns). Excluding those, 6,293 Safes (23.3% of active) consolidate to shared real-wallet destinations.

Combined, conception, birth, and death overlap; deduplicated, they link 12,697 unique Safes of the 28,681 observable.

One of the main use cases for stealth addresses is receiving funds for business without doxxing your entire balance. But, receiving the same amount over and over again can be a fingerprint to cluster addresses.

In Umbra's mainnet history, 455 distinct high-precision wei values repeat exactly across 1,617 payments, 6.9% of the ETH total. The chance of two independent payments colliding on the same 18-digit wei amount is about 2⁻⁶⁰. Every repeat is a proven relationship between payments that share no address.

Then there are the fiat price-point families: a merchant charging a fixed dollar price emits non-round ETH amounts that drift in a tight band with the exchange rate. I found 108 such clusters, with one having 64 payments of 0.0045 spread over 13 months.

There is a poetry to Fluidkey's version. Its users fund their Safes from a personal account, and the remainder after funding, the accounting dust, carries sub-cent suffixes that repeat across Safes. There is a family of 12 Safes, each depositing a specific decimal .552850, rotating weekly, their balances decrementing in exact 9-USDC steps, one entity's whole operation, fingerprinted by its own bookkeeping.

Cloaked's usernames are its leak, and they leak through three separate offchain channels.

First, the CCIP gateway is an existence oracle: registered names return a stealth address, unregistered names return zero. Second, the username.clkd.id web app is a second, faster oracle which returns a 200 or 404. Thirdly, Google indexes the receive pages, a single site:clkd.id search surfaces usernames with no probing at all.

You can also brute force the name search. I probed 9,000 dictionary words through both oracles (and promptly gave up), recovering 69 registered usernames like real first names (olivia, candy, alyssa…) and crypto canon (satoshi, nakamoto, wagmi, whale, stealth, private, cloak). Interestingly, one user links their Cloaked username to their personal website next to his full legal name.

You can also build a forward-looking version of this attack. On page visit, a fresh stealth address is created and shown. I visited and harvested 1,475 disposable addresses across 59 known usernames, that can then be put on a watchlist and rechecked for transactions. To be fair to Cloaked, this is a good UX for the biggest use case of stealth addresses, receiving payments to disposable addresses.

Even where user-to-user privacy holds perfectly, there is always someone watching. Umbra has no operator, just contracts; outsiders are the watchers here. Fluidkey's backend holds viewing-key nodes, and its operational reality is singular, with one submitter EOA, one batcher, and one signing relayer running every auto-earn operation.

Cloaked is custodial-grade, the server holds the child viewing keys, they can see everything, and the Cloaked Safe is visible in both chains' spend graphs. The user-to-user privacy in these systems can be perfect while the user-to-operator privacy is zero. This is a trade users should know they are making for a specific user experience.

Underneath the three products sits a fork in the road, building using the onchain standards:

• ERC-5564 - stealth address generation, announcement events, view tags for efficient scanning
• ERC-6538 - the stealth meta-address registry: your spending and viewing public keys, published once, bound to your wallet by signature

Or creating a bespoke stack, borrowing the elliptic-curve handshake but serving fresh stealth addresses from an offchain gateway instead.

The trade is brutally symmetric. The ERC-6538 standard's strength, that anyone can find your keys and pay you without asking a server, is precisely its leak. Anyone can enumerate the registrants, forever, and it is even easier when 37% of them registered under their own name.

The bespoke stacks fixed enumeration by moving key-serving offchain, and the price is the panopticon. The gateway that serves your fresh addresses is the same server that watches you spend them.

The standard also shows its age in the spend path: 5564 assumes an EOA receiver who withdraws themselves, which is exactly where the self-payment loops come from. The smart-account era fixed that UX, and every convenience layer it added became an operational fingerprint.

The number that should sober both camps: the standardized trustless design and the custodial bespoke stacks end up with their users linked at roughly the same rates (56–61% for Umbra, 40–61% for Fluidkey and Cloaked) for completely different reasons. The architecture chooses where you leak, and the user decides whether.

You get excellent stealth for incoming payments, and almost none for living your life.

The receive side works. Across 25,000 Umbra payments, 31,000 Fluidkey Safes, and 4,000 Cloaked spenders, I found no protocol leaks. If all you do is receive and hold, you are genuinely unlinkable; about the 8.1% of Umbra users who never withdrew, cannot be identified. The moment money moves, the stealth collapses. 61% of Umbra users who ever withdrew are linked. 61% of Cloaked's Ethereum spenders linked themselves in the very act of spending. 44% of Fluidkey's observable Safes are linked, a tenth of the census before moving a cent.

Umbra is trustless, operator-free, non-custodial, and the only design here with no one to subpoena. Unfortunately, its registry is a permanent identity anchor that 37% of users ENS-doxxed at creation, and self-withdrawal puts the linking transaction in the user's own hands, and usage is declining.

Fluidkey has the strongest receive-side design ever shipped: no onchain registry, sealed usernames, and smart-account UX with real yield. But its proprietary relayer-and-module footprint made its entire user base enumerable in an afternoon, its users weld themselves at destinations and funders, and the backend sees everything.

Cloaked has a pristine receive layer and the smoothest UX of the three, but it is custodial-grade at the server, its usernames leak through oracles, search engines and its own users' websites. Its flagship convenience feature, merging accounts at spend time, is a permanent onchain link. They are also the closest to giving their users more privacy, nudging them to deposit in Privacy Pools, allowing users to withdraw to a new address post stealth address merge.

Stealth addresses are cool, and an effective primitive for solving onchain receiving privacy, but every generation has moved the leaks around as opposed to eliminating them. The core structural challenge across all three protocols remains the spend phase. Once funds arrive at a stealth address, moving or using them without linking them back to a main or common destination remains difficult. We've seen the rise of confidential tokens, FHE, MPC, privacy pools, all of which can be utilised to decouple the stealth address from the ultimate withdrawal or spend address.

An example of this is to combine stealth addresses, Privacy Pools, and a relayer over Tor to create a way to spend the funds privately. To explore this idea, I built a prototype called GhostPay:

1. Connect your wallet
2. Generate stealth address
3. Announce ERC-5564 stealth address via Relayer
4. Scan blocks for payment received
5. Sweep to Privacy Pools via Relayer
6. Withdraw to fresh address using saved note

You can test out the prototype here: ghostpay.ethprivacy.tools or 3cp7ozttq4dygx4xts37rxia7okn634ggw6fzxxtf2dxtx2ixe3fatyd.onion, and review the implementation here https://github.com/unhappyben/ghostpay.

¹ ERC-5564: how a payer turns your two public keys into a fresh one-time address, and how your viewing key finds it in the announcements.

² ERC-6538: where those two public keys live onchain, signed to your wallet, so anyone can pay you without asking.

³ https://arxiv.org/abs/2308.01703