Helius ships "Privacy Rings" on Solana, encrypting balances but not addresses — and the institutional version isn't live yet

Helius, the Solana infrastructure company run by CEO Mert Mumtaz, said on November 10 that it had launched Solana Privacy Rings on mainnet — a permissionless protocol that lets Solana applications encrypt token balances and send confidential transfers while keeping settlement on the public chain. The launch was announced through Solana's own news channel, which is the project's promotional material and reads like it; the mechanics below come from that announcement, with one launch partner's claim corroborated by Decrypt.

What actually shipped

The piece that is live today is the "Permissionless Ring." Per Helius, it works as a programmable shielded pool: a user deposits an asset into a private balance, can send that balance to any Solana wallet address as a confidential transfer, and can withdraw back to a public balance. Supported assets are SOL, SPL tokens, and Token-2022 tokens. Every transaction requires the owner's signature — the design is self-custodial — and the encrypted state lives on Solana's own ledger rather than on a separate network.

The most important detail is the limit of what gets hidden. By Helius's own description, "assets and amounts are encrypted while wallet addresses remain visible, and only the user can decrypt their balances with a viewing key." This is confidentiality of amounts and holdings, not anonymity: who is transacting stays public, how much stays private. That is a narrower claim than the word "privacy" tends to imply, and the announcement does not foreground it.

On performance, Helius says private transactions are validated with succinct zero-knowledge proofs in "a few hundred milliseconds," which it argues leaves Solana's sub-second finality intact. Proofs can be generated locally or through a Helius remote prover reached via a single RPC URL; the company is also shipping TypeScript and Rust SDKs and the XARK toolchain from Blueshift for writing custom ZK circuits.

The programmable angle — the reason Helius calls this a "setting on the asset" rather than a separate chain — is that Solana programs can hold encrypted balances in private escrows and release them on defined conditions, and that private transactions can compose with other Solana programs in one transaction. Helius lists intended use cases: private swaps against public liquidity, collateral posted into private escrows for lending, staking and yield on private balances, and conditional payments for payroll, vesting, or multisig treasuries.

What's audited, and what's still promissory

Helius says the core programs and ZK circuits were audited by Certora, OtterSec, and ZK Security, and that engineers from the Solana Foundation, Blueshift, and Zcash took part in the trusted setup. It adds that formal verification is "underway and expected to complete by the end of 2026" — i.e., not finished at launch. A trusted setup is itself a cryptographic trust assumption: the security of the system depends on at least one participant in that ceremony having discarded their secret material.

The institutional product is not live. "Custom Rings" — permissioned, private environments that an institution would run on Solana mainnet with auditor visibility, selective disclosure, KYC-gated allowlists, sanctions screening, and the ability to "freeze and recover funds" — are described as "currently in audit" and "expected to be on mainnet in the coming weeks." The compliance story, in other words, is a roadmap item, not a shipped feature.

Key facts

• Launch date and venue: Solana Privacy Rings went live on Solana mainnet November 10, 2026, per Helius via Solana's news channel.
• What's encrypted: Token amounts and balances; wallet addresses remain publicly visible. Only the user can decrypt balances, using a viewing key. (Helius)
• Supported assets: SOL, SPL tokens, Token-2022 tokens. (Helius)
• Proof speed: ZK proofs verified in "a few hundred milliseconds," per Helius; no independent benchmark provided.
• Audits: Certora, OtterSec, ZK Security; trusted setup included engineers from the Solana Foundation, Blueshift, and Zcash. Formal verification not yet complete — targeted for end of 2026. (Helius)
• Custom Rings (institutional): In audit, expected on mainnet "in the coming weeks" — not live. (Helius)
• Launch partners named: Decrypt, Ore, Aurora Intents (products shipping); Range, Chainalysis, Elliptic (wallet screening); Crossmint, MoonPay, Paybis (onramps); Backpack, DFlow, Jupiter, Squads, Titan (integrating). (Helius)
• Decrypt corroboration: Decrypt confirmed its Money Accounts are live on Solana with confidential transfers, part of its Information Exchange product. (Decrypt, Nov 10)

The real-world read

Start with the sourcing. The anchor document is published on solana.com and reads as a product launch, not reporting — the opening quote from Helius CEO Mert Mumtaz calls privacy "the final scaling frontier in crypto" and asserts "no serious institution or individual will feel comfortable" without it. That is a vendor making the case for its own product; it is not a neutral finding. Every performance and security claim here traces back to Helius, including the "few hundred milliseconds" proof time, for which no third-party benchmark is offered.

The one secondary source, Decrypt, is not a disinterested observer either: Decrypt is itself a named launch partner, shipping confidential transfers in its own Money Account. Its co-founder Ilan Hazan is quoted selling Decrypt's "one account, one balance" product, The Information Exchange. So the secondary "coverage" corroborates only that a partner is using the thing — which the partner has a commercial reason to say. Treat it as an integration announcement, not independent verification.

On substance, note the gap between branding and behavior. This is marketed as privacy, but addresses stay public; it hides balances, not identities. Helius is candid about that in one line and then talks past it. And for a privacy product, the institutional tier leads with surveillance features — auditor visibility into every transaction and balance, sanctions screening, and the ability to freeze and recover funds. That is a reasonable answer to the regulatory pressure that has dogged on-chain privacy tools, but it means the "compliant privacy" being pitched to businesses is privacy from the market and the counterparty, not from a regulator or from Helius-appointed controls. The protocol is permissionless today; the compliant version that institutions are being sold is still in audit.

Finally, the timing of claims. Formal verification isn't done. Custom Rings aren't live. The partner roster is long, but "integrating" and "building" are present-continuous verbs — several of those names are not shipping yet. The permissionless transfer protocol is real and on mainnet; much of the rest is a launch-day roadmap.

Opinion, and whose

• Mert Mumtaz (CEO, Helius): that privacy is "the final scaling frontier" and a prerequisite for institutional comfort on-chain. A forecast from the vendor, not an established fact.
• Cat McGee (Technical Privacy Lead, Solana Foundation): that privacy "needs to become part of this infrastructure" as more money moves through Solana. The Foundation is an interested party in Solana adoption.
• Ilan Hazan (co-founder, Decrypt): that the goal is "one account, one balance, and access to every financial instrument." A product pitch for Decrypt's own offering.

Sources

• Solana News / Helius, "Solana Privacy Rings Bring Programmable Privacy Onchain" (Nov 10, 2026) — primary source for all mechanics, audits, partners, and quotes. This is the project's own launch announcement and is promotional; all unverified claims (proof speed, security posture) originate here.
• Decrypt, "Decrypt Money Account Gets Confidential Transfers With Solana Privacy Firm Helius" (Nov 10, 2026) — corroborates that Decrypt's Money Accounts are live on Solana with confidential transfers. Note: Decrypt is a named launch partner and quotes its own co-founder promoting its product; treat as an interested-party integration announcement, not independent reporting.

This is news coverage, not financial or investment advice.