# Monero via Cake Wallet Markdown version of https://ethbeat.org/privacy/projects/monero-cake-wallet ## Summary **Warning:** This route has no Ethereum contracts. Real-time monitoring is not supported. - Metrics: Not tracked. Data tracking is not available for this project. - Tracked on: Ethereum - Attributes: Bridged, Transfers, Any amount - Reference app: Cake Wallet v6.4.6 (most private of 6 checked) ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link private (sentiment: good); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad). - Trusted setup: No setup (sentiment: neutral). No setup: This project does not have a ZK system and thus no setup-related trust assumptions. - Exit window: None (sentiment: bad). Funds in transit sit with the swap service, which can steal them. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Deposit and payout both depend on the swap service. If it stops, funds in transit are lost or refunded at its discretion. - Reproducibility: Partially reproducible (sentiment: warning). Cake Wallet and Monero are open source, but Cake states that its release builds do not reproduce from that source. The swap services run closed systems. ### About A shielded ledger round trip: Cake Wallet's swap screen moves Ethereum funds into Monero and back, handing each leg to a centralized instant exchange. ### Links - Website: https://cakewallet.com, https://www.getmonero.org - Docs: https://docs.cakewallet.com/features/basic/swap, https://docs.cakewallet.com/support/swap, https://docs.cakewallet.com/features/privacy-and-security/privacy-settings, https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf - Repository: https://github.com/cake-tech/cake_wallet, https://github.com/monero-project/monero - Social: https://x.com/cakewallet, https://x.com/monero - Other: https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/PRIVACY.md, https://changenow.io/faq/kyc-aml, https://kycnot.me/service/trocador ## Protocol description Cake Wallet lets users move funds out of one Ethereum address and into a new one through Monero, which hides the path between them. Its swap screen sends the funds to an exchange service that pays out XMR. A second swap later turns the XMR back into an Ethereum asset. Both Ethereum transfers are public. Users trust the swap services, which hold the funds during each swap, and Cake Labs, which ships the wallet and picks the services. A service can hold a deposit until the user passes identity checks, and a party holding the records of both legs can link them. Funds in transit sit with the service, so leaving depends on its payout or refund. ### Architecture Monero hides which output a transaction spends with ring signatures. Each input names 16 outputs, the real one and 15 decoys the wallet picks, and proves that one of them is spent. The rings stay public forever. This protects against observers who see only the chain. Shielded pools such as Tornado Cash, Privacy Pools or Zcash's shielded pool prove membership in the whole pool. A withdrawal there hides among all deposits, even from a party that knows one of them. ### Flow 1. **Quote.** EVM asset to XMR: the app polls every enabled service and takes the best rate unless the user picks one. 2. **Ethereum to the service.** The app sends the amount, the Monero payout address and Cake's API key, for some providers with a markup. The Ethereum wallet address goes along as refund address. The service returns a deposit address it controls. The deposit is a plain, public transfer from the user's wallet. It goes to the Blink Labs private mempool, on by default, and to the RPC only if Blink fails. 3. **Into Monero.** The service sends XMR to the payout address. The transaction hides sender, recipient and amount. 4. **Inside Monero.** The user can self-transfer the XMR any number of times. Outputs unlock after ten blocks. 5. **Back to Ethereum.** From the Monero wallet the user picks XMR to the Ethereum asset. The app sends the Ethereum exit address and, as refund address, a subaddress not yet used for a swap. The service returns a Monero deposit address, the wallet pays it, and the service pays the exit address from its hot wallet. ### App An EVM wallet in Cake has one address. It is sent as refund address on entry, and an exit to the same wallet pays the very address that deposited. On entry, picking an in-app Monero wallet pays to its primary address every time, so a service can tie a user's entries together. ### Network [Built-in Tor](https://docs.cakewallet.com/features/privacy-and-security/built-in-tor) is off by default. Without it, the swap services, Blink, Etherscan, the nodes, Cake's price API and Moralis see the user's IP. A custom node replaces the defaults, PublicNode for Ethereum and Cake's own for Monero, but Moralis, Etherscan and the price API stay. With Tor on, every call shares one circuit for up to ten minutes, so each leg needs its own app session. Two requests skip it: the WalletConnect relay and token logos. An IP-hiding route that carries all of the app's traffic covers them too. ### Swap services Each service sees its whole leg. The entry service always knows the output it paid, because it created it. The exit service receives the Monero transaction and sees its rings. A party holding both legs therefore finds its payout output in the rings behind the exit. If all of the XMR is paid back, the received amount also matches the payout minus the public fee. Self-transfers in between only widen the search, by about 30 times per transaction. The swap screen lets the user pick a different exchange for each leg. Cake Labs holds no user funds, and the app talks to each service directly. ### Compliance Services can freeze a deposit automatically and hold it for identity and compliance checks, as [ChangeNOW documents](https://changenow.io/faq/kyc-aml). ### Fees Cake ships its API keys, and for some providers a markup, as build secrets, so its share of the fee is set outside the source. ## Privacy **What the protocol promises:** Hides which funds leaving Ethereum come back as which, by passing them through Monero between two custodial swaps. Both Ethereum legs are public. **Apps** - **[Cake Wallet](https://cakewallet.com)** v6.4.6 (Reference): The ratings assume this app, since 2026-09-29 · Source [7ce3cd7](https://github.com/cake-tech/cake_wallet/tree/7ce3cd75c3fd0c0add1cead41038ab8806ffebde) - **Unstoppable Wallet** (Leaks more): Routes every swap through Unstoppable's own server, which records each leg's payout and refund addresses and deposit transaction hash. Fix: Request quotes and create orders with each swap service directly. · [Source](https://github.com/horizontalsystems/unstoppable-wallet-android/blob/d6661c8d0dc02d259767f58b7cd73cabb877da18/walletkit/src/main/java/io/horizontalsystems/walletkit/modules/multiswap/providers/USwapProvider.kt#L1375-L1399) - **Coin Wallet** (Leaks more): Creates every swap on Coin Wallet's server, signed by the wallet's device key, so Coin Wallet can link the deposit and exit addresses. Fix: Create swap orders with each service directly, without the device key. · [Source](https://github.com/CoinSpace/CoinSpace/blob/d2dff4227d37e33d22856b57e9e50bf8689d8f34/web/src/lib/exchanges/BaseExchange.js#L167-L181) - **Stack Wallet** (Leaks more): Its built-in Tor skips Ethereum, so Stack's Ethereum node gets every balance lookup with the user's IP. Fix: Route the Ethereum client through the built-in Tor, like its other coins. · [Source](https://github.com/cypherstack/stack_wallet/blob/f920c360f999a183e8faf01a3188f1199f316df5/lib/wallets/wallet/impl/ethereum_wallet.dart#L53-L60) - **Edge** (Leaks more): Its Nym mixnet setting covers wallet sync only, so swap services get the payout and refund addresses with the user's IP. Fix: Send swap quotes and orders through the mixnet when it is on. · [Source](https://github.com/EdgeApp/edge-exchange-plugins/blob/95cc660b865e36528083959816856f790471a86b/src/swap/central/changenow.ts#L196-L215) - **Atomic Wallet** (Leaks more): Has no Tor or proxy option, so Atomic's servers get the user's IP with every wallet address they sync. Fix: Add built-in Tor that carries every request, swaps included. · [Source (checked 2026-10-27)](https://atomicwallet.io/downloads) [How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app) Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. The Monero transactions between the deposit into a swap service and the payout from its hot wallet hide sender, recipient and amount. Both Ethereum transfers show address, token and amount. **Advice:** Exit to a new in-app Ethereum wallet made with Create New Recovery Phrase. **Inside** - Sender: private - Recipient: private - Amount: private - Asset: exposed. Only XMR exists inside. The source asset is public on Ethereum. - Link: at risk. An EVM wallet in Cake has one address, so exiting to the wallet that deposited pays the address that deposited. **Sources** - [The deposit is a plain transfer from the wallet to the address the service returned](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/view_model/exchange/exchange_trade_view_model.dart#L200-L206) - [An EVM wallet has a single address](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_evm/lib/evm_chain_wallet_addresses.dart#L11-L38) - [Every input names 16 ring members](https://github.com/monero-project/monero/blob/v0.18.5.1/src/cryptonote_core/blockchain.cpp#L3268) - [Amounts are encrypted to the recipient](https://github.com/monero-project/monero/blob/v0.18.5.1/src/ringct/rctOps.cpp#L672-L720) ### Chain analyst Link private (sentiment: good) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. Only amount and timing can pair a deposit into a swap service with a payout from a hot wallet serving every asset the service trades. **Advice:** Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. A round trip of similar amount and timing pairs the two Ethereum legs. ### Network observer Link private (sentiment: good) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. Over an IP-hiding route, Moralis, Etherscan and PublicNode get each Ethereum wallet in its own session, so none of them sees both legs. Built-in Tor alone lets token logos out directly, and Cake shows priced tokens anyone sends, so Moralis can see the user's IP beside the wallet. **Advice:** Run Cake with all traffic through an IP-hiding route. Delete the deposit wallet from Cake before the exit. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. Private only over an IP-hiding route, with the deposit wallet deleted before the exit. **Sources** - [IP-hiding routes we checked](https://ethbeat.org/publications/privacy-methodology#ip-hiding-routes) - [Built-in Tor is off unless the user enables it](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/store/settings_store.dart#L1590) - [Opening a wallet connects its node and adds the tokens Moralis reports for its address](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/reactions/on_current_wallet_change.dart#L94-L113) - [Embedded Tor config: one SocksPort, no isolation flags](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_core/lib/utils/tor/torch.dart#L65-L70) - [The Ethereum client binds its proxy setting once](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_evm/lib/clients/evm_chain_client.dart#L24) ### Privileged insider Link exposed (sentiment: bad) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. Each swap service custodies its leg and can hold the funds until the user passes identity checks, and identities on both legs link them. The entry service knows the XMR output it paid the user, and the exit service sees the rings of the transaction that pays it. Together they find that output in the rings behind the exit, and self-transfers only widen the search. **Inside, compared with a public observer** - Sender: at risk. Rings that reference the service's payout output point to the spend of the user's XMR. - Asset: exposed - Link: at risk. A service can hold either leg until the user provides identification. **Sources** - [Breaking Monero: poisoned outputs, the attack by a counterparty on both sides](https://www.monerooutreach.org/breaking-monero/poisoned-outputs.html) - [ChangeNOW: automated AML holds, KYC through SumSub, refund minus fees](https://changenow.io/faq/kyc-aml) ### Future adversary Link exposed (sentiment: bad) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. Whoever breaks elliptic-curve cryptography recovers every Monero output key from public chain data, so every ring shows its real spend. A known address also yields its view key, and anyone learns a service's address by starting a trade. The user's XMR can then be followed from the entry service to the exit service, where amounts and timing pair it with both Ethereum legs. **Inside, compared with a public observer** - Sender: exposed - Recipient: at risk. Readable for outputs to known addresses, and the services know the user's address. - Amount: at risk. Readable for outputs to known addresses. - Asset: exposed - Link: exposed **Sources** - [A key image is the output key hashed to a point times its private key](https://github.com/monero-project/monero/blob/v0.18.5.1/src/crypto/crypto.cpp#L621-L628) - [Zero to Monero: one-time addresses, amount encryption and key images (chapters 4 to 6)](https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf) ## Risk summary ### Funds can be stolen if 1. a swap service does not pay out. 2. a service's hot wallet is compromised during the trade. ### Funds can be frozen if 1. a service holds the deposit pending identity verification. 2. a service refunds minus fees and blacklists the deposit address. ### Privacy can be lost if 1. a service holds a leg until the user identifies, since identities on both legs link them (see privileged insider). 2. one party sees both legs, like one service used twice, and finds its payout in the rings behind the exit (see privileged insider). 3. swap services, Blink, Etherscan, Moralis, PublicNode and the Monero node see the user's IP, since Tor is off by default (see network observer). 4. the deposit and exit wallets open in one app session, so Moralis, Etherscan and PublicNode pair them (see network observer). 5. an opened wallet holds a token with a remote logo, which loads outside Tor and shows Moralis the user's IP (see network observer). 6. elliptic-curve cryptography is broken, which reveals the real spend in every ring (see future adversary). ## Upgrades & Governance Three parties change this swap route, each instantly and offchain since there are no onchain contracts. ### Cake Labs LLC (the wallet) Cake picks the swap services, their defaults and its API keys with each app release. Cake Wallet is MIT-licensed and self-custodial. ### The swap services (the custodians) Each service sets its own terms, limits and compliance rules and can change them at any time. ### Monero (the chain) Rules change through scheduled hard forks. The mainnet table ends at version 16, active since block 2,689,608 (August 2022), with a ring size of 16.