The privacy you get from SolMask is bounded by the worst-linked address in the transaction. The cryptography can break the on-chain link between your deposit and your withdraw, but it cannot un-leak an address that's already publicly tied to you.
The withdraw destination is the easiest place to make this mistake, and it's the one we see most often from new users. Picking the right recipient address is the single most important step in actually getting the privacy you came for.
The whole point is a fresh address
A fresh address is one that has no on-chain history at all before your withdraw lands. No incoming deposits from your CEX. No outgoing votes in any DAO. No interactions with your main wallet. Nothing.
If you withdraw to a wallet that the chain already associates with you, an observer doesn't even need to attack the SolMask pool. They can just look at the destination of your withdraw, see that it's "your" wallet by some prior off-chain knowledge or on-chain heuristic, and conclude that whoever deposited into SolMask with a matching amount and timing was probably also you. The shielded pool's math is undamaged; your operational security is what failed.
Concretely, here are the addresses you should not withdraw to:
Your CEX deposit address. Exchanges KYC their users and will happily tell anyone with a subpoena who that address belongs to. Withdrawing from SolMask to a CEX deposit is a textbook deanonymisation.
Your existing main wallet. If you've ever named it on Twitter, used it for an NFT mint, voted in a DAO, or received airdrops, it's effectively a public identifier. Withdrawing the same amount you recently deposited from a different wallet ties the two together.
Any wallet that has interacted with the wallet you deposited from. Same-cluster heuristics in chain-analytics tools will flag the two as related, regardless of what passed between them.
Generating a fresh wallet
The simplest path is to create a new wallet in your existing wallet software (Phantom, Backpack, Solflare) and use it exclusively for the SolMask withdraw. Most wallets let you derive multiple accounts from the same seed phrase; the on-chain addresses are independent, so an observer cannot tell they share a seed.
If you want stronger separation, generate the keypair in a fully separate wallet application, or with solana-keygen new on a clean machine. Save the seed phrase somewhere safe before you do anything else. If you lose it, the funds you withdraw to that address are gone.
The new wallet has no SOL, no tokens, no history. That's exactly what you want.
You'll need a little SOL for fees
SolMask's relayer handles the gas for the withdraw transaction itself, so the fresh wallet does not need to be pre-funded to receive a withdraw. The 0.003 SOL withdraw fee is paid by the relayer up front and recouped from the withdraw amount, not from your wallet's balance.
What the fresh wallet does need SOL for is whatever you plan to do next. If you want to swap the withdrawn USDC for something else, you'll need a tiny amount of SOL for transaction fees. If you want to forward the funds elsewhere, same story. The amount is small — a hundredth of a SOL is plenty for ordinary use — but it has to come from somewhere.
This is the moment most people accidentally compromise themselves. The natural instinct is to send 0.01 SOL from your main wallet to the fresh wallet "just to cover gas." Doing that re-links the two addresses on-chain in the most obvious way possible. You just spent the privacy you were buying.
The clean solution is to fund the fresh wallet's gas with a second SolMask withdraw, from a separate deposit, ideally of SOL. Two small SOL deposits feed two unrelated fresh wallets: one to receive your main funds, one to provide gas. Both are unlinkable to your origin.
A cheaper-and-easier alternative: use the relayer's built-in SOL-gas tip. The SolMask UI offers a checkbox at withdraw time that requests the relayer leave a small amount of SOL in the destination ATA on top of the token withdraw. This works when the asset you're withdrawing has Jupiter liquidity, because the relayer can route a portion through a SOL conversion in the same transaction.
Don't reuse the fresh wallet
Once you've received a withdraw to a fresh wallet, the wallet has on-chain history. It is no longer fresh. Treat it as single-use for the purpose of unlinking from your origin: use it for the immediate next transaction (a swap, a forward, a payment), and don't bring it back later for a second SolMask withdraw. A fresh wallet is fresh exactly once.
If you do this consistently — fresh wallet, used once, funded cleanly — the on-chain picture an observer sees is two unrelated wallets making two unrelated transactions, with no provable bridge between them. That's the goal.