Bybit lost $1.5 billion in February 2025 when the people approving a routine transfer signed a transaction whose real destination was not the one on their screens, according to Chainalysis. In December a single trader lost $50 million by copying an address from his own transaction history that an attacker had planted there. Another lost $12.25 million the same way in January, ScamSniffer reported. None of these thefts broke a private key.

Each of them worked because a blockchain will send money to any valid address and has no way of knowing whether that address belongs to the person the sender meant to pay. AmericanFortress is publishing research that gives a bridge, an exchange or a recipient a way to check exactly that, using a zero-knowledge proof that two wallets on two different chains share one hidden secret, without revealing the secret or the link.

The problem a bridge cannot see

A cross-chain bridge does a simple thing. A user sends Bitcoin to an address the bridge controls, tells the bridge a Solana address. The bridge then releases the equivalent value on Solana to that address. The bridge checks that the Bitcoin arrived. It does not check, because it cannot, that the Solana address belongs to the person who sent the Bitcoin. Sometimes that is by design: a user may want to pay someone else. But it also means that anything which swaps the destination address after the deposit is fixed, whether a compromised front end, a poisoned clipboard or a malicious insider, gets paid. The user has no recourse once the Bitcoin has left.

The obvious fix, asking the user to prove they own the destination wallet, runs into two walls. Proving ownership of a Solana wallet does not prove it belongs to the same person who owns the Bitcoin wallet, because the two chains use different cryptography: Bitcoin keys live on the secp256k1 curve, Solana keys on Ed25519. Nothing in either public key says anything about the other. And the crude way to link them, publishing something that ties both wallets to one identity, is exactly the kind of permanent public connection that privacy-conscious users and institutions refuse to make.

What the paper proves

Most crypto wallets today are hierarchical deterministic wallets: one secret seed generates every key the wallet will ever use, on every chain, through a fixed set of derivation rules. AmericanFortress's earlier paper, ZKPoSP, posted to the IACR ePrint archive in July, showed how to prove in zero knowledge that one public key was correctly derived from a hidden seed, which matters for quantum resistance because the proof relies on hash functions rather than the elliptic curve maths a quantum computer could break. That paper handled one key at a time.

The new work, titled Provenance Proofs, asks the question a bridge actually needs answered: do these two keys, on two chains, come from the same hidden seed? The paper calls the answer a provenance proof. It comes in three forms depending on how much a user wants to reveal. A joint proof shows that a chosen set of addresses shares one hidden origin, revealing the relationship only to whoever checks that proof and leaving no trace that can be used to connect the addresses later. A deferred proof attaches a randomised commitment to each address, which looks unrelated to every other commitment until the owner chooses to prove, at a time of their choosing, that some of them point to the same secret.

A persistent tag is a hash of the hidden anchor that is the same every time, so anyone can recognise that two proofs came from the same wallet without an extra step, which is what a compliance desk wants and an anonymous user does not. The user picks the form that matches the relationship they are willing to disclose. The seed itself, the derivation paths and every other key in the wallet stay hidden in all three.

Bitcoin to Solana, step by step

The paper walks through the case it calls its primary deployment target. A user holds one secret from which both a Bitcoin wallet and a Solana wallet are derived. The bridge gives the user a Bitcoin deposit address and the user sends the coins. The user's wallet then builds two proofs, one showing the Bitcoin address was derived from the hidden secret under Bitcoin's rules and one showing the Solana address was derived from the same secret under Solana's rules, then links them, either by attaching the same deterministic tag to both or by adding a third small proof that the two randomised commitments open to the same secret. The user sends the bridge the Solana address, the proof bundle and a reference to the deposit transaction.

The bridge checks that the deposit spent the Bitcoin controlled by the source address, verifies both derivation proofs and confirms they are linked to the same secret. Only then does it release funds on Solana. An attacker who has substituted a different Solana address cannot produce a valid proof for it, because that address was not derived from the victim's secret and the proof system will not accept a derivation that did not happen. The paper extends the same check to a refund address, so that if the swap fails the money can only go back to a wallet the same secret controls.

The paper also sketches how this would bolt onto a typical instant-exchange API, which it calls Swapper X and is careful to say is a design exercise rather than a live integration. The exchange's existing calls stay the same. The only addition is a pause before payout while an outside verification service checks the proof bundle against the deposit and the payout address, plus a refund path if the check fails.

What it costs

The benchmarks measure a single derivation proof on a 16-core machine using the Plonky3 proving system. A pruned proof, which starts from an already-trusted point in the wallet's key tree, takes about 3.1 seconds to build and 253 milliseconds to check. A full-path proof from the seed itself, which the cross-chain case requires because two chains share no intermediate point, takes about 6.7 seconds to build and 475 milliseconds to check. The Bitcoin-to-Solana bundle is two full-path proofs, so roughly 13.3 seconds of proving on the user's side and under a second of verification on the bridge's, before the linkage step, which the authors say they have not yet benchmarked separately.

The proofs are large. A full-path proof is about 9.7 megabytes and the two-chain bundle about 19 megabytes, which is why the integration design sends the bridge only a hash of the bundle and routes the bundle itself to a separate verifier. For a user, thirteen seconds of proving on a desktop happens once per swap and in the background. For a bridge, half a second of verification is a rounding error against the block confirmations it already waits for.

Beyond bridges

The same three proof forms cover four other jobs the paper works through. An address book can check that a fresh payment address belongs to the same wallet as a name the sender already trusts, which is a direct answer to address poisoning. It can do so without creating any permanent identifier that links that address to the sender's other payments. An exchange can onboard a wallet once against a compliance credential, store a persistent tag and recognise every later deposit from that wallet without re-running the check, while learning nothing about the customer's other addresses or balances. A custodian with hot, warm and cold keys can prove to an auditor that a chosen set of withdrawal addresses all sit under one custody root without revealing the rest of its key tree. And a wallet that has to retire a compromised or scheduled-out key can prove that the new key is the authorised successor of the old one, from a protected recovery root, so that every counterparty who trusted the old key can move to the new one without repeating onboarding.

The last two applications are AmericanFortress's own. In its system, a sender pays to a fresh stealth address computed from the recipient's published keys, so nothing on chain links the payment to the recipient. The paper shows how the sender can attach a proof that whoever authorised the payment is the same person a registry knows by name, plus an encrypted note only the recipient can open that reveals that name. The recipient learns who paid them at the moment of payment. An outside observer learns nothing. The recipient can later prove to an auditor that a specific batch of payments all landed in their wallet and who sent each one, without handing over the viewing key that would expose every payment they have ever received.

Who is behind it

AmericanFortress is based in Sheridan, Wyoming. It describes its product as a universal privacy layer: a human-readable @name that works across chains, with SafeSend generating a fresh stealth address for every payment so that funds are never mixed, pooled or handed to a custodian. It launched the SafeSend beta on Arbitrum in May, Chainwire reported, posted the ZKPoSP paper to IACR ePrint in July and lists one granted US patent with sixteen applications pending across thirty inventions. The company says its wallet supports Bitcoin, Ethereum, Base, Arbitrum, BNB Chain, Tron, Litecoin, Dash and 0G alongside USDC and Tether. Michal Pospieszalski is co-founder, CEO and CTO; Emanuele Ragnoli is chief cryptographer; the paper's other authors are Vincenzo Botta and Justus Ranvier. The provenance work is the subject of a pending patent application. The authors note that the paper's prose was drafted with AI assistance and checked by hand, while the cryptography was not.

Every privacy technology in crypto has so far forced the same trade: hide the link between your wallets and lose the ability to prove anything about them, or prove things and give up the privacy. What this paper adds is a dial. A user can show a bridge that two addresses are theirs for the length of one swap, show an exchange that repeat deposits come from a vetted wallet for as long as the account is open, or show an auditor a year of receipts, revealing in each case nothing beyond the relationship being asked about. The proofs are slow to build and heavy to carry. The combined circuits are not yet benchmarked, which the authors say plainly. But a bridge that can refuse to pay a substituted address, at a cost of half a second, is the kind of control that would have made the largest theft in the industry's history impossible to execute the way it was.

Don’t forget to like and share the story!

Vested Interest Disclosure: HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYOR.