There is a version of this we could have built. Non-custodial, all on-chain, privacy-coin liquidity only, no centralised exchange anywhere near it. A trust model clean enough to frame and hang in the office. We did not build that one. Here is why, including the parts that make us look less heroic.

**The liquidity problem is not a talking point**

XMR pools outside the major venues are thin. A $30,000 swap through on-chain XMR liquidity today shoves the price against you and leaves a market-impact signal anyone can read. That footprint is not quieter than a CEX-routed trade. In some conditions it is a flare. Shielded ZEC depth is improving, same constraint. Fragmented pools do not hand you better rates, they hand you worse ones with a fingerprint attached. Purity that prices badly and leaks is not purity. It is a worse product wearing a better T-shirt.

Deep centralised order books eat size for breakfast. Routing live across Binance, Bybit and OKX at once (the model since v1.1) finds the best available composite rate, not one venue's top-of-book. The gap compounds above $10,000. For Private Mode specifically, a better rate through a CEX-routed XMR leg beats a worse rate with more market impact through thin on-chain pools. We are not indifferent to the trade. We ran the numbers, and the CEX option was simply better for the people actually using the thing.

**The ESP is an intermediary, and you deserve to know it**

The Exchange Service Provider is an independent third party. It controls the one-time deposit address, holds your funds for the seconds to minutes the swap takes, fills against CEX liquidity, and routes the output to your destination. During that window it applies its own AML, which Husher does not control and cannot override. We put that in the product docs, not the footnotes in grey 8-point, because hiding it would be the exact move we keep slagging off custodial platforms for.

Husher never holds your funds. No Husher account, no internal balance, no row mapping your identity to a trade. Nothing to freeze, nothing to drain. But the ESP exists, and pretending it does not would make us liars with good branding.

**Private Mode adds a layer**

Your input converts to Monero or Zcash shielded at the ESP, transits the privacy leg, then converts to your output. Ring signatures and RingCT on the XMR leg. Zero-knowledge proofs on the shielded ZEC leg. The link between source and destination is reduced, not erased. Send the output to a wallet already named on a public explorer and you have personally reconnected the graph at the far end. Private Mode costs 1% plus fees and takes around 5 minutes. It reduces linkability. It does not produce anonymity. If anonymity is the hard requirement, we are not your answer, and we would rather tell you now than take the fee.

**Where this doesn't protect you**

Funds sent to the wrong network or address are gone. Nobody recovers them, not Husher, not the ESP. The architecture that means nobody can freeze your funds is the one that means nobody can rescue your typo. The ESP logs your swap under its own compliance, and Private Mode does not overwrite its internal records, it reduces what a passive on-chain observer can infer. Private Mode does not route around sanctions; if the destination is sanctioned, we will not process the swap. And if your output lands at a custodial wallet that runs KYC, the graph reconnects right there. Linkability reduction needs hygiene on both ends, not just ours.

**Our take**

We shipped the version that gives real rates on real trades, with a structural privacy option that holds up at the volumes people actually move. Not ideology versus pragmatism, just one question: which architecture serves the person moving $50,000 cross-chain without a KYC profile? Today that runs through CEX liquidity via an ESP, disclosed in full. That changes when FCMP++ ships and shielded ZEC deepens, and if on-chain routing ever gets genuinely competitive on rate and impact, we will say so and switch. We published the trade-offs, this one included. That is what building in public looks like when it is not just a tagline.

husher.io