The Personal Privacy Stack (2026): What the Wallet, Network and Swap Layers Actually Fix

Three layers, one connection. A swap looks like a single action: type an amount, send a coin, receive another. In practice five parties learn something about it — your device, the route your traffic takes, the site you used, the liquidity provider behind that site, and the chain itself. A privacy stack is not a shopping list of tools; it is an ordering of adversaries, and each layer cuts one specific link between you and the money. This page is the map for the three layers: what the wallet, the network and the swap each fix, what each of them cannot fix no matter how you configure it, and where the seams between them leak. Every layer has a deep dive linked from here, but read this first, then go pick the one that matches the threat you actually have.

Start with the adversary, not the tool. Five are worth naming. A network observer sees your IP, your DNS queries and your TLS handshake. The swap front-end sees a request, a user agent and an order. The liquidity provider behind it sees an amount, a deposit address and a payout address. A chain analyst sees everything that settles on-chain, forever. Whoever can open your device sees the keys. Today's measurements show how lopsided the layers are: Tor added 1.0 to 5.0 seconds to a page load and removed exactly one link — the IP. Our quote at 10:02 UTC charged 10.98 USDT of flat cost on a 100 USDT order, 11.0% of the amount, against 0.33 USDT at 500 and above. Buying the wrong layer means paying the most for the least. (Is Tor safe for swaps?)

Layer one, the wallet: who can spend, and how wide your footprint is. A wallet you hold the keys to fixes custody — nobody can freeze or misplace your balance — and it fixes address hygiene, which is the half most people skip. Every payout address you reuse is a free label for anyone reading the chain: our production table holds 125 orders since 24 September and they resolve to only 47 distinct payout addresses, with the most frequent single address appearing in 22 of them. Most of those repeats are our own test traffic, but the structure is the point — a reused address welds unrelated orders into one person's history. Monero makes this free of charge: a wallet mints subaddresses without limit and without extra fee, and a payment to a subaddress is indistinguishable on-chain from one to the main address. The wallet layer does not hide your IP, your amounts or your timing. It decides who holds the keys and how many threads a reader has to tie together. (how Monero fees work)

Layer two, the network: the link between your IP and the request. This is the only thing Tor is good at, and it is worth being precise about what you buy. Measured at 10:02 UTC, /exchange took 0.27, 0.85 and 0.59 seconds directly and 5.28, 1.86 and 1.88 seconds over Tor through exit 185.220.101.145; the quote endpoint answered in 2.68 seconds over Tor against 0.21 to 1.09 seconds directly. That is the whole cost: a few seconds, and a site that sees a Tor exit instead of your home connection. The layer does not remove the exit's reputation — data-centre and Tor addresses are scored, and some venues refuse them outright — it does not change your browser fingerprint, and it does not stop WebRTC from handing a page your real address over UDP. One misconfiguration undoes all of it: if the hostname is resolved locally instead of at the exit, the DNS query leaves from your own resolver, and the swap site never needed to see your IP in the first place. (Is Tor safe for swaps?)

Layer three, the swap: an identity gate removed, not a record. No-KYC means no account, no documents, no email — the order form takes seven fields, and the two that matter are the payout address and a refund address you control. It does not mean nothing is recorded. Every order gets a deposit address, a locked amount, a timestamp and a 30-minute window; after that the local record expires (EXPIRE_MS is 1,800,000 ms), late deposits are looked back for six hours, and anything the provider no longer recognises is force-closed at 24 hours. The price of this layer is visible in the quote itself: at 10:02 UTC, 100 USDT bought 0.14552604 XMR while 500, 1,000 and 5,000 bought 0.81679, 1.634125 and 8.172799. Solving that curve gives a marginal 611.74 USDT per XMR and a flat 10.98 USDT deduction on the first order — 11.0% of the amount — against 0.33 USDT once it crosses the routing threshold. (recovering misdirected funds)

What each layer costs, in one place. Every figure below was measured on 1 November 2026; live quotes move, so read them as orders of magnitude, not as prices. Network: 1.0 to 5.0 seconds of latency, plus the share of sites and services that block exits. Wallet: nothing for a phone wallet; 275 GiB of disk (295,279,001,600 bytes) and a multi-day first sync if you run your own Monero node instead of trusting someone else's. Swap: 10.98 USDT flat below roughly 120 USDT and 0.33 USDT above it, plus the corridor spread, which today sat near 1% — 1 XMR quoted 598.622 USDT against a 604.77 market price, and 0.05 BTC quoted 127.6248 XMR per BTC against an implied 129.02. Then the chain fees to get money in: 141 vB at 2 sat/vB is 0.22 USD on Bitcoin (mempool 54,532 transactions, 22.02 MvB), 64,285 energy is 2.10 USD on TRON, and a 1,534-byte Monero transaction is 0.019 USD. The most expensive layer is never the one people expect. (XMR to USDT exit)

Where the layers leak into each other. Six seams do most of the damage. First, the clipboard: a checksum catches a typo, not a substitution, and both ends of a swap address have the same shape. Second, the refund address — fill in an exchange deposit address and the whole swap becomes a leg of a KYC account, tag rules included. Third, ordering over Tor and paying from a phone on home wifi, which welds two paths onto one deposit address; from the provider's side those are the same customer. Fourth, the amount: 500.00 is a label, 497.31 is not. Fifth, reusing one payout address for every order, which is the clustering key described above. Sixth, writing to support from the mailbox you use everywhere — one email links an order, a device and a person. None of these is a chain-analysis problem; every one of them is a habit. (Is Tor safe for swaps?)

Three stacks, in the order that pays off. Tier zero costs nothing: a wallet you hold the keys to, a fresh payout address per order, Tor Browser with its defaults, and a swap that quotes all-in before you send. It defeats the ISP, the routine chain reader and address reuse, which is where most real-world exposure lives. Tier one adds your own Monero node, so balance queries stop being a log line on a stranger's server; the price is 275 GiB and a long first sync. Tier two adds a hardware wallet and a cold-to-cold flow, at the cost of one extra on-chain fee and a narrower asset list — Ledger and Trezor both reach Monero only through third-party software, so in practice that tier is clean for BTC, LTC, ETH/USDT and transparent ZEC. What no tier does is survive a global adversary or repair a funding leg that arrived from a verified exchange account. Pick the layer that matches the threat you actually have, then stop paying for the rest. (Is Tor safe for swaps?)