Hidden amounts, public supply

Most of the XRP Ledger is an open book. Anyone can look up any account and see what it holds and what it sent.

That is a problem for some uses. A company paying salaries in a token does not want every salary on public display. A fund does not want rivals reading its positions.

Confidential Transfers put a cover over the numbers. Picture a sealed envelope going from one mailbox to another. Everyone can see which mailbox sent it and which one received it. Nobody outside can see how much is inside.

What is hidden:

• The amount of each confidential transfer.
• Each holder's confidential balance.
• How the confidential supply is spread across holders.

What stays public:

• The sender's and receiver's addresses.
• The type of transaction.
• The token's total supply, and how much of it is held confidentially.
• The amount whenever someone moves tokens between public and confidential form.

Three limits matter.

Tokens only. It works for Multi-Purpose Tokens (MPTs), and only when the token's issuer has switched it on. XRP and trust-line tokens stay public.

Direct transfers only. A confidential balance cannot be traded on the DEX or placed in an escrow or a check.

Private from the public, not from the issuer. The issuer can read every confidential balance of its own token. It can also name an auditor who can do the same. This is privacy with a compliance window, not anonymity.

The feature is not live on mainnet. Validators are voting on it.

XLS-96 extends XLS-33 (MPTs). One token can have public and confidential balances side by side. A holder converts between the two forms as needed.

Supply stays auditable through two plaintext fields on MPTokenIssuance:

Validators enforce the supply cap, OutstandingAmount ≤ MaximumAmount, on these numbers. They never decrypt a balance.

Encryption is EC-ElGamal over secp256k1. Zero-knowledge proofs let validators check that a transaction is valid without learning the amounts.

Leaks to keep in mind, from xrpl.org:

• Conversion amounts are public. If an account converts 1,000,000 tokens in and later 800,000 out, observers know 200,000 stayed confidential. They cannot tell who holds them now.
• An empty confidential balance is recognizable. The ledger writes a known "canonical encrypted zero" when a balance starts, after an inbox merge and after a clawback.
• Privacy is stronger when more participants use confidential transfers.

The scheme is not considered quantum-safe. The docs call a move to post-quantum cryptography an open area of research.

Amendment: ConfidentialTransfer. Live count: Amendments page.

Related: Multi-Purpose Tokens.