How fast can private money settle?
A live, scientifically-provable demonstration of MoneroUSD's L2 settling fully-private transactions on a real testnet. Press launch — every spend you see counted is a real, on-chain, independently re-verifiable STARK settlement.
Why throughput has no ceiling
Private and post-quantum — every layer
The N spends inside each proof aren't just fast. Each one is a complete MoneroUSD spend that hides sender, receiver and amount, and is built to survive a quantum computer. No trusted setup, anywhere.
FCMP++ membership
Full-Chain Membership Proofs. Your input is proven to come from every output ever created — the anonymity set is the whole chain, not a ring of 16. Nobody can tell which output you spent.
Confidential amounts
Values live inside Pedersen commitments. The proof shows the books balance — inputs = outputs + fee — without revealing a single number. Amounts stay hidden on-chain forever.
One-time nullifiers
Each spend emits a unique nullifier that makes double-spending impossible — yet it links to neither the output nor the spender. Double-spend protection with zero deanonymization.
Post-quantum STARK
A transparent FRI-STARK over a prime field — no elliptic curves, no trusted setup. Its security rests only on hash functions, so it stands against Shor's and Grover's algorithms. Measured at ≥100-bit proven post-quantum soundness.
ML-DSA + ML-KEM
NIST's standardized post-quantum signatures and key exchange secure authentication and stealth-address derivation. The keys that move your money don't break when large quantum computers arrive.
Recursive IVC fold
The batch proof is folded recursively (WHIR-MLE IVC) into a ~128 KB proof that verifies in ~3 ms — no matter how much history it represents. Constant on-chain footprint, forever.
Why this number is undeniable
No simulation, no trusted setup, no faith required. Every claim below is something you can recompute yourself.
Real private spends
Each transaction is a genuine MoneroUSD spend — a real cryptographic commitment and a real nullifier that prevents double-spends. Nothing is mocked; amounts, senders and recipients stay fully hidden.
One STARK settles thousands
The sequencer batches N spends and proves a single post-quantum STARK that binds every output commitment and nullifier into two new state roots — the whole batch, one proof.
O(1) consensus verify
The daemon verifies that one proof and threads the new roots — in constant time, independent of batch size. Settling 4 spends or 40,000 costs the L1 the same. That is the entire trick.
Anyone re-verifies
Each settlement proof lives on-chain in the block. Point any MoneroUSD node at the testnet, replay the block, and recompute the exact TPS below. The proof either verifies or it doesn't.