Permissionless · Private · Post-Quantum

Confidential settlements for USD stablecoins from Binance Smart ChainSolanaTronEthereumBinance Smart ChainSolana, Tron, Ethereum, Binance Smart Chain

Move USDT or USDC from Solana, Tron, Ethereum or Binance Smart Chain to Rand, where it becomes zUSD: digital dollars only the sender and the recipient can see. Cash out to any of the four chains, dollar for dollar less 0.1% in and 0.1% out, both taken in zUSD on Rand, so even the fee stays private. Built to stay private against quantum computers.

Read the whitepaper Run a node GitHub

Private to the market, open to your auditor

From	To	USDT	Fee
Acme Treasury	Shenzhen Parts Co. Supplier invoice	184,200.00	0.001
Acme Treasury	M. Okafor Salary, September	9,450.00	0.001
Acme Treasury	L. Tanaka Salary, September	12,800.00	0.001
Acme Treasury	Northgate OTC desk Block trade	2,500,000.00	0.001

Anyone with a block explorer reads this: your suppliers, your salaries, the size of your trades.

Rand is private like a bank account, built for a modern economy that runs on stablecoins. The network records only a proof that each payment balances, and its fee. You keep the viewing key, so your auditor or regulator can still see your records. Names and amounts are illustrative.

Use cases

Where confidentiality is a business requirement

Public blockchains publish everything: every order is a signal and every position a disclosure, and the institutions with the most capital have declined that trade-off.

All 53 use cases, by industry

Capital markets

Tokenized stocks and onchain equity trading

Equities are the largest asset class that has not moved on chain, and the reason is not technology. Hedge funds will not trade a strategy where it can be front-run. Inside a market on Rand, they can.

Who buys it. Hedge funds, asset managers, broker-dealers, tokenized-equity issuers

Payments and treasury

Confidential payroll and corporate treasury

Businesses moved about $226 billion of supplier payments in stablecoins in 2025, every one of them public. Payroll at scale, treasury and trading are the flows still missing, and they need amounts kept private.

Who buys it. Companies paying in stablecoins, DAOs, finance teams

Regulation, identity and compliance

Private to the market, transparent to the regulator

The compliance objection to confidential finance is real, and the answer is not to argue with it. It is to design disclosure in from the start.

Who buys it. Broker-dealers, funds with AML obligations, chief compliance officers

Performance

Measured on the live network

Every figure below was taken from the running node, not from a projection: the full node on testnet chains 13 to 15, proving on an ordinary laptop at the production profile. How they were measured →

Proof system: STARK; FRI over Goldilocks · no trusted setup · constraint set 8 since chain 18
Verify: ~32 ms; transfer proof, warm key, one laptop core · not yet measured on validator hosts
Prove: ~40 s; a transfer of any asset on a laptop, on all its cores · a 2–6 s authorisation proof and a bundle proof of 32–45 s, measured on chain 20
Chains: 4; ETH · BSC · TRON · SOL

Block time: 1.2 s; measured on chain 15, and about 1.2 s again on chain 20 (the explorer, 2026-10-01) · chained HotStuff BFT
Validators: 26; on testnet chain 21, team-operated · a quorum is 18
Private call: 6–31 s; to prove a program on a laptop · 6–9 s at tier 12, 24–31 s at tier 14, measured on chain 20
Programs: RISC-V; guests up to tier 14 · EVM/SVM translated, shown on retired chain 13, not callable now

How long a zUSD or RPL transfer takes

About 45 seconds from rand send to finality, and almost all of it is the proof, made on the sender's own machine. The proof is the same for RAND, zUSD and every RPL token, so no asset is faster or slower than another and none can be told apart by its timing. A zUSD withdrawal, registering an RPL token and minting one each carry one proof too, and take the same time. A zUSD deposit also waits for the source chain's confirmations and the guardians' signatures, which depend on that chain.

1. Prove

~40 s

on the sender's laptop, all cores · 32–45 s bundle and 2–6 s authorisation measured on chain 20, or on a prover the sender pairs
2. Verify

~32 ms

at admission, off the consensus loop · warm key, one laptop core
3. Include

~1.2 s

the next block, at the measured average interval
4. Final

~3.6 s

three more blocks under the three-chain commit; no reorganisation after

Proving is local by design: the spend key never leaves the wallet. Proving costs · how the proof works

Reserves and zUSD in circulation

Stablecoins locked: —; every accepted coin, all four chains
USDT locked: —; Tether USD
USDC locked: —; USD Coin
zUSD supply: —; the token registry's total, one-to-one against what is locked

Reading the bridge from the explorer… How the reserve works →

Overview

What is Rand?

Rand is a private payments network for dollar stablecoins. Deposit USDT or USDC from Solana, Tron, Ethereum or Binance Smart Chain and receive the same amount, less a 0.1% bridge fee, as zUSD, a digital dollar only you and your counterparty can see. Withdraw at any time, to any of the four chains, less the same fee.

Public blockchains publish every balance and every payment, which is why businesses keep payroll, supplier terms and trading off them. Rand's ledger holds no accounts and no balances, so there is nothing for a competitor to read. The same privacy extends to whole programs, not just payments, so business logic stays confidential too.

Every zUSD is backed by real USDT or USDC held on the chain it came from, in reserves anyone can check at any time. There is no new issuer to trust. There is one dependency, and we state it plainly: an independent guardian group confirms deposits and withdrawals on each chain, and the papers set out what that group can and cannot do.

Reserve

A reserve sourced from every chain the dollar already lives on

USDT and USDC circulate natively on many chains, and requiring them to be issued anew wherever Rand needs them would make reserve capacity dependent on a deployment decision that is not ours to make. Instead, each coin is locked in a custody contract on its home chain and attested by a t-of-n threshold guardian set, with more than two thirds of it signing; Rand mints zUSD against the aggregate, as a note the chain computes from the attested amount. Exit runs the same path backwards, and the entry leg does not bind the exit leg: USDT locked on Tron can leave as USDT on Ethereum, provided that leg holds reserves to cover it.

1
Lock

USDT or USDC is deposited into the custody contract on Solana, Tron, Ethereum or Binance Smart Chain and immobilized there.
2
Mint

Guardians attest the lock at threshold t; anyone submits the attestation, and Rand appends one deposit note for the recipient.
3
Transfer

zUSD moves inside the shielded pool as notes, concealing sender, recipient and amount.
4
Redeem

A burn spends the notes and emits a message; guardians attest it and custody releases USDT or USDC on whichever leg the holder names, the amount less a 0.1% fee.

Chain	Accepted	Standard	Custody	Trust assumption
Ethereum	USDT · USDC	ERC-20	Lock contract	Program correctness ∧ guardian threshold
Binance Smart Chain	USDT · USDC	BEP-20	Lock contract	Program correctness ∧ guardian threshold
Tron	USDT	TRC-20	Lock contract	Program correctness ∧ guardian threshold
Solana	USDT · USDC	SPL	Custody program	Program correctness ∧ guardian threshold

Reserve invariant

Total zUSD supply never exceeds the sum of reserves held across all legs.

S \leq Σ c \in C R c

The stablecoin paper proves the invariant is preserved across every state transition, with each R_c a publicly readable balance on its own chain. The guarantee is conditional: it holds provided fewer than t guardians are compromised, because the attestation is the evidence that a lock took place on that leg. Shielding hides the distribution of supply, not its quantity, so the total stays auditable — but on those legs it delivers detection rather than prevention, and the balances are not jointly observable across chains at an instant.

What this costs

If reserve and token reside on different chains, the effective guarantee is min(reserve solvency, bridge integrity) rather than reserve solvency alone.

This was originally the argument against a bridge, and it is not withdrawn. Locking reserves on other chains admits the bridge-integrity term deliberately, in exchange for reserve capacity that no single issuance decision can constrain. The guardian threshold is consequently load-bearing: a compromise of t guardians permits minting without a corresponding lock, and the resulting exposure is bounded by per-chain custody.

Because Rand settles on its own chain, no leg is co-located with the mint and every leg carries the term. zUSD is fungible across legs, so a holder cannot elect to hold only one leg's portion — one unit is a claim on the aggregate. It also pools two issuers: whichever coin a holder deposited, a zUSD carries both Tether's and Circle's risk. Avoiding all of this means holding the coin where it already lives and forgoing shielding, which is a real cost we cannot design away.

Post-quantum

Standardized lattice cryptography

ML-DSA (Dilithium) for validator signatures and ML-KEM (Kyber) for note encryption, both NIST-standardized. Poseidon2 commitments, chosen over Pedersen because Pedersen hiding is computational and reduces to a discrete-logarithm assumption that Shor's algorithm solves in polynomial time. A transparent STARK for verification, whose soundness rests on a collision-resistant hash and needs no trusted setup and no pairing curve.

The classification below is the operative one: irrevocable properties are violated retroactively by an adversary who acquires capability at any later time, while renewable properties are re-established at each use and can be migrated before that time arrives.

Read the post-quantum reconciliation in the paper →

Consensus signatures: ML-DSA · Dilithium2; Renewable · post-quantum
Note confidentiality: ML-KEM · Kyber768; Irrevocable · post-quantum
Commitment hiding: Poseidon2; Irrevocable · post-quantum
Proof soundness: STARK · FRI; Renewable · post-quantum
Hash: BLAKE3 · Poseidon2; Blocks and state · notes, tree and proofs
Settlement: Rand · chained HotStuff BFT; Stake-weighted quorums, three-chain commit

The paper states quantum security per primitive and per role — a 384-bit transcript hash, 256-bit preimage-only hashes, Dilithium2 signatures, ML-KEM-768 note encryption, FRI soundness over an extension field — under Module-LWE, Module-SIS and SHA-3 / BLAKE3 modelled as quantum random oracles. The node's transcript hash is Poseidon2 today, a configuration gap the developer docs list. The per-role statement replaces the protocol-wide 128-bit claim of earlier drafts, which contradicted the 85-bit quantum collision bound of a 256-bit hash and was withdrawn rather than qualified.

Start building on Rand

Read the papers, run a node, fork the source. The protocol is open, the cryptography is in print, and its limitations are stated openly.

Browse papers Run a node Developer docs