Is It Architecture or Competition That Sets Private Swap Fees?

A regular DEX or bridge swap costs a few basis points. A private swap, one that reduces the public link between your sending address and your receiving address, costs anywhere from 0.02% to almost 1%, and takes anywhere from a few seconds to an hour. That is a wide spread in fees and latency, inside a single product category, for what users perceive as the same job.

A spread that wide usually means one of two things. Either the products are not actually the same product, or the market has not settled on a price. This benchmark tests the first explanation against the second.

Across 10+ live systems, the data does not describe a single fee market. The systems cluster by privacy mechanism, and the clusters barely overlap. That is consistent with architecture setting the cost, latency, and trust envelope each operator works inside. It is not the same as architecture setting the price, and the differences within clusters are where that distinction starts to matter.

This matters because the category is growing while remaining poorly understood. Users compare private swap tools the way they compare DEXs, by fee number alone. Across mechanisms, that comparison is close to meaningless: the fee is largely a readout of how the privacy is produced, and the mechanisms are not interchangeable.

What We Measured

The dataset covers live, publicly usable systems whose primary function is a private swap or a private transfer with a swap leg. That includes application-layer tools and protocol-layer systems that ship first-party or canonical consumer interfaces, such as Railgun via Railway. Fee and execution figures come from project documentation and product interfaces as of July 2026, and are subject to change. Systems whose fees are not published in official documentation were excluded. Privacy chains and wallets are out of scope.

Values marked tbd were unavailable in official documentation at the time of review. They are missing observations, not zeros.

Tool	Chains	Mechanism	Fee	Execution time
Houdini	130	CEX liquidity pools + unrelated intermediary asset	Up to 0.8% private swaps (0.2% DEX route)	5–50 min
RocketX	200+	Split-route execution via CEXs; randomized CEX selection; randomized network hops	0.4–0.6%	5–10 min
ClearSwap	Tron	Dual exchange system + randomized intermediary asset	Around 0.4%	3 min
Encrypt.trade	7 chains	Threshold ElGamal + TEE + ZKPs + MPC	0.35–0.5%	Up to 1 min
Zama	Ethereum (fhEVM confidential tokens)	FHE encrypted tokens	Flat ~$0.008–$0.8 per transaction, charged in $ZAMA	Up to 1 min
SilentSwap	38	Shielded transfers, TEE, private pools	1% flat	1–5 min
Privacy Cash	10+	ZK proofs, Merkle tree, relayer	0.35% + network fees	Up to 1 min
Peer.xyz	EVM chains + Solana	ZK proofs, social login	0.5% on-chain; 0.01%–2.3% cross-chain, amount-tiered	Near-instant
Renegade	Arbitrum, Base	ZK proofs, MPC, dark pool	0.02%	TBD
Railgun (via Railway)	Ethereum, BSC, Polygon, Arbitrum	ZK shielded pool	0.25% shield/unshield only + gas; relayer ~10% of gas cost	Shielding up to 1 hour

Three Architectures, Three Envelopes

Exchange-routed designs: coverage, paid for in time and trust

Houdini, RocketX, and ClearSwap produce privacy without any on-chain cryptography. The swap routes through off-chain exchange liquidity, typically passing through an unrelated intermediary asset, so the publicly visible trail from the deposit does not continue to the withdrawal. The link is broken at the routing layer, not hidden by proofs.

This design explains every number in those rows.

Chain coverage is enormous, 130 and 200-plus chains, because adding a chain means adding an exchange listing, not deploying contracts. No shielded pool has to exist on the destination network.

Latency is the longest in the category, on average, up to 10 minutes, because the swap involves real exchange legs: deposit confirmation, an off-chain trade or two, a withdrawal. Each leg has its own finality requirements.

Fees are mid-tier and tightly clustered, from 0.4% to 0.8%, because the operator carries real costs: exchange spreads, intermediary asset volatility during the routing window, and operational overhead. The fee is not margin on a proof verification; it is margin on a logistics operation, and the narrow band suggests all three operators face roughly the same cost structure.

Shielded-pool designs: fast and cheap, but chain-bound

Privacy Cash, Peer.xyz, Renegade, and Railgun take the opposite trade. Funds enter a shielded pool on one chain; zero-knowledge proofs let users withdraw or swap without publicly revealing which deposit the withdrawal corresponds to. The privacy is cryptographic, and the anonymity set is the pool itself.

Again, the numbers follow the mechanism.

Headline fees are the lowest in the category, 0.02% to 0.5%, because the marginal cost of privacy is proof generation and a relayer transaction. There is no exchange spread to cover and no intermediary asset to hold.

Two pricing structures inside this cluster deserve their own line. Railgun, the longest-running system here, prices the boundary instead of the flow: 0.25% applies only at shield and unshield, the entry and exit of the private pool, while activity inside the shielded state costs gas plus a relayer premium of roughly 10% of the gas cost, not of the amount. A user who shields once and transacts repeatedly watches the effective per-operation fee fall with every additional action. No other model in the table rewards staying private longer.

Peer.xyz publishes the category’s only amount-tiered schedule: 0.5% flat on-chain, while cross-chain fees slide from roughly 0.01% on a $10,000 transfer down the size curve to 2.3% on a $10 one. That curve is fixed costs made visible, and it produces the table’s highest percentage on its smallest trade.

Latency is the shortest, near-instant to about five minutes, because everything settles on a single chain. Where delays exist, they come from relayer batching or deliberate timing randomization, not from waiting on external systems. However, using Railgun may take up to 1 hour for shielding.

Chain coverage is the constraint. The cluster leans heavily toward Solana and cheap-blockspace chains. Extending a shielded pool to a new chain means a full redeployment and, more importantly, growing a new anonymity set from zero.

Which points to this cluster’s honest limitation: the privacy is only as strong as pool usage. A shielded pool with thin volume offers weak linkage reduction regardless of the cryptography, because a small anonymity set narrows the candidates. Fees here buy correctness; crowd size determines protection, and the protocol cannot sell you that.

Encrypted-asset designs: the middle path

Encrypt.trade converts tokens into encrypted representations and swaps those, using threshold encryption rather than shielded pools or exchange routing. It lands in the middle of most columns except speed: seven chains, 0.35% to 0.5%, up to a minute. The design avoids the operator-visibility problem of exchange routing and the single-chain lock-in of shielded pools, and pays for that with the complexity of maintaining encrypted token versions per network.

Zama pushes the idea further with fully homomorphic encryption, and breaks the category’s pricing convention entirely: a flat fee of roughly $0.008 to $0.8 per transaction, denominated in dollars and charged in $ZAMA, regardless of amount. The percentage math inverts. On a $10,000 transfer the fee rounds to a fraction of a basis point, cheaper than anything else in the table. On a $10 transfer it can reach 8%, the most expensive. Flat per-computation pricing is what confidential computation costs, surfaced without a margin formula.

Where the Three-Bucket Model Stops Working

Two systems resist the taxonomy, and they resist it in ways that should qualify the thesis rather than decorate it.

SilentSwap combines shielded transfers with trusted execution environments and reaches 38 chains, well beyond what pure cryptography sustains. It is not a hybrid in a trivial sense. It demonstrates that these architectures are modular rather than mutually exclusive, and that coverage can be bought with a different trust assumption instead of a different mechanism. If trust is a purchasable input, then mechanism does not map one-to-one onto either price or privacy quality, and a system’s cluster label stops predicting its properties. Hybrids need to be compared by the trust they add, not sorted into whichever bucket they most resemble.

Railgun breaks the latency rule from inside the fast cluster. Shielding can take up to an hour, which is longer than any exchange-routed swap in the table, on a design whose category is supposed to be the quick one. The delay comes from a boundary operation rather than from the mechanism’s steady state, which is precisely the point: the architecture label describes the flow, and users experience the boundary.

Neither case sinks the envelope model. Both narrow it. The mechanism predicts the shape of the cost structure and the location of the trust assumption. It does not reliably predict the number a user pays or the time a user waits.

Two Observable Tests, and Where They Fail

If a private swap tool published nothing but its execution time, you could infer a lot of its architecture. Near-instant suggests single-chain proofs with no external dependencies. One to five minutes suggests relayer batching or shielding epochs. Over five minutes suggests value physically traversing exchange infrastructure and at least one intermediary asset.

Latency is harder to disguise than a fee, because users experience it directly. Harder is not impossible. Operators control batching windows, can add deliberate delay for timing privacy, and publish ranges rather than observed distributions. Railgun’s hour-long shielding is the clearest case of the test misfiring: the number points at exchange routing and the mechanism is a shielded pool.

The second test is fee shape, and it is more informative than fee size. In shielded-pool designs the fee pays relayers and protocol maintenance. In exchange-routed designs it pays for liquidity logistics and counterparty risk absorption. In encrypted-asset designs it pays for cryptographic infrastructure per supported network.

Percentage-of-amount pricing usually means some party bears amount-linked risk or captures amount-linked margin. Boundary pricing, Railgun’s model, means the cost sits at pool entry and exit and rewards duration. Flat per-transaction pricing, Zama’s model, means the cost driver is computation and the value being moved is economically irrelevant to the operator. A user can read the operator’s cost structure off the shape of the schedule before knowing anything about the technology.

None of these is inherently better value. A user moving value from an obscure chain has one cluster available, and 0.8% with a wait measured in tens of minutes is the market-clearing price of 130-chain coverage. A Solana-native user swapping mid-size amounts is overpaying at anything above 0.35%, because the cryptographic cluster delivers that job faster and cheaper.

What is not defensible is comparing across clusters on fee alone. A 0.1% shielded-pool swap and a 0.8% exchange-routed swap are different products with different trust models and different failure modes. The cheap one can leak through a thin anonymity set. The expensive one is visible to the operator and its exchange partners, who apply their own AML screening and may request identity information above certain thresholds. Neither fee number tells you that.

The Empty Quadrant

Plot the category on two axes, chain coverage against cost-plus-latency, and the tools fill two corners. Broad coverage, slow and mid-priced. Narrow coverage, fast and cheap.

The corner combining broad coverage, low fees, and fast finality is empty. No system in this sample offers 100-plus chains, sub-minute execution, and sub-0.3% fees.

The absence is real. Its cause is not settled, and there are at least three candidate explanations that this dataset cannot distinguish between.

The first is architectural foreclosure: each property is produced by a mechanism that structurally rules out one of the others, so the corner cannot be occupied. The second is economic: the corner is reachable but the engineering cost is not currently justified by demand, so nobody has built it. The third is immaturity: cross-mechanism routing is early, and the corner will be occupied by an aggregation layer rather than by any single mechanism, in the same consolidation pattern DEXs went through between 2019 and 2021.

These have different implications. Under the first, the category’s structure is stable and users should keep comparing inside clusters. Under the second and third, current pricing is a snapshot of an immature market and the clusters will blur.

A single piece of evidence separates them. A product that sustains 100-plus-chain coverage, sub-minute settlement, and sub-0.3% pricing, without subsidy and without hidden custody or trust assumptions, would rule out foreclosure. One that does it with undisclosed trust assumptions would confirm the SilentSwap lesson instead: the corner is reachable, and the price is paid in trust rather than in basis points.

How to Choose Inside This Structure

For users, the practical procedure is short and does not require the analysis above.

1. Fix your chain and asset first. That usually eliminates entire clusters, and the eliminated clusters are not options at any price.
2. Decide who must not see the link: the public, an operator, or statistically nobody within a sufficiently large pool. This is a trust decision, not a price decision, and it determines the mechanism.
3. Only then compare fees, and only against systems in the same cluster. Cross-cluster fee comparison tells you which mechanism you are buying, not which product is cheaper.
4. Check that stated execution time is consistent with the claimed mechanism, and treat a mismatch as a question rather than a verdict. Railgun shows the mismatch can be legitimate.
5. For shielded pools, ask about pool usage. The cryptography is not the binding constraint on privacy quality. The crowd is.

For builders, the finding is less comfortable. If the cost clusters are structural, undercutting on fees without changing the mechanism means competing away margin inside a fixed envelope. If they are not structural, the current spreads are an artifact of an early market and will compress on their own. The benchmark cannot tell you which, and the answer determines whether the open ground is a cheaper pool, a faster route, or the layer that selects between mechanisms.

The next market cycle will settle it. If an exchange-routed product sustains broad coverage at sub-0.3% without subsidies or undisclosed trust, architecture is not destiny and this analysis needs revising. Until something crosses those thresholds, compare private swaps inside mechanism classes rather than across them.

On-chain data outside shielded state remains public, all figures are as of July 2026 and subject to change, and none of the above is financial advice.

Comparing mechanisms manually is the whole point of this piece. Rubic’s Private Mode does it in one interface.