Privacy and asset conversion are usually treated as two separate steps — and stitching them together is exactly where most people leak. The naive flow is: move funds privately, then swap them on a DEX. But the swap is a public transaction from the destination wallet, and if you swap the whole withdrawn amount in one go right after receiving it, you've handed an observer a bright correlation signal. The cleaner approach is to do the conversion inside the private withdrawal, so the recipient simply receives the asset they wanted and there's no separate swap to correlate.
This post covers cross-asset withdrawals: deposit SOL, recipient gets USDC, link still broken.
Why "withdraw then swap" leaks
Suppose you withdraw 50 SOL privately to a fresh wallet, then immediately swap all 50 SOL to USDC on a DEX. On-chain there's now a fresh wallet that received exactly 50 SOL and, seconds later, swapped exactly 50 SOL. The amounts match, the timing is tight, and the swap is fully public. An observer watching pool withdraws of ~50 SOL and DEX swaps of ~50 SOL can line them up. You didn't break privacy at the pool — you re-introduced a correlatable event right after it.
Two things make this worse: the swap exposes a precise amount (defeating the "blend into round amounts" hygiene from /blog/anonymity-sets-on-solana), and the fresh wallet now has a transaction history, so it's no longer fresh for any future use.
How a cross-asset withdrawal works instead
SolMask can route a swap as part of the withdraw transaction itself. You deposit SOL into the SOL pool. When you withdraw, the proof releases your SOL inside the same transaction that swaps it through Jupiter and delivers USDC to the recipient. From the chain's perspective there is one private withdraw that results in the recipient holding USDC — not a withdraw followed by a separate, linkable swap.
The privacy property is unchanged by the conversion. The zero-knowledge proof still only asserts "I own one of the deposits in this pool"; it reveals nothing about which deposit, and the swap leg rides along inside the same atomic transaction. The deposit (SOL from your wallet) and the outcome (USDC to a fresh wallet) remain two unrelated-looking events. /learn/what-is-a-shielded-pool covers the base mechanism; the swap is an add-on to the withdraw, not a separate hop.
When cross-asset withdrawals are the right tool
- The recipient wants a stablecoin. Paying a contractor or vendor who invoices in USDC, but you hold SOL. Deposit SOL, deliver USDC, no public conversion in between. This pairs naturally with /blog/dao-treasury-privacy-on-solana and /blog/private-payroll-on-solana.
- You want the destination asset to differ from the source for its own sake. Changing the asset across the private boundary removes the "same amount of the same token went in and came out" pattern entirely.
- Settlement in a specific currency. OTC and treasury flows that have to settle in USDC rather than SOL — see /blog/private-otc-trades-on-solana.
What to keep in mind
Slippage and routing are public on the output, not the input. The swap executes at market through Jupiter, so the recipient receives whatever the route returns at execution time. The conversion rate is a normal market rate; what's hidden is the connection to your deposit, not the existence of a swap leg. Choose amounts and timing sensibly so the delivered figure still resembles ordinary activity.
Amount hygiene still applies. A cross-asset withdrawal changes the asset but doesn't excuse an outlier amount. If you deposit a very distinctive quantity of SOL, the conversion doesn't erase that distinctiveness. Match the crowd on the deposit side and keep delivered amounts unremarkable.
The delay still matters. Converting on exit doesn't replace the privacy delay — let your deposit mature in the pool before withdrawing, exactly as with a same-asset withdraw. /blog/the-privacy-delay-explained explains why.
The recipient address still has to be fresh. Delivering USDC to a wallet with prior history linked to you reconnects both ends regardless of the asset switch. /learn/choosing-a-recipient-address is unchanged advice here.
The short version
A cross-asset withdrawal folds the conversion into the private step so there's no separate, correlatable swap afterward. Deposit SOL, recipient receives USDC, the link stays broken. Everything else — delay, amount hygiene, fresh recipient — is the same discipline as a same-asset withdraw, summarized in /blog/solana-wallet-privacy-checklist. Try it from /swap.
FAQ
Q. Does the swap reveal which deposit was mine? A. No. The proof asserts ownership of one unspecified deposit in the pool; the swap leg executes inside the same transaction without referencing your specific note. The conversion doesn't weaken the unlinkability.
Q. Can I deposit USDC and have the recipient get SOL? A. Cross-asset withdrawals work across supported assets, so the direction can be reversed depending on pool support. The principle is identical: convert inside the withdraw, not in a separate transaction after it.
Q. Is it cheaper to withdraw same-asset and swap myself? A. It might look marginally cheaper in raw fees, but doing the swap yourself afterward creates a public, correlatable transaction from the fresh wallet — which is the privacy cost you were trying to avoid. The in-withdraw swap exists precisely to avoid that.
Q. What rate do I get on the conversion? A. A normal market rate through Jupiter's routing at execution time, including ordinary slippage. Privacy hides the link, not the fact that a market swap occurred.
Q. Does converting on exit replace the privacy delay? A. No. Use a real delay and let the deposit mature in the pool before withdrawing — the conversion is independent of the timing protections.