Non-Custodial Privacy Tools and Custody Risk: Who Controls Your Funds?
Non-custodial privacy tools can reduce reliance on a custodian by requiring user authorisation to move funds. They do not eliminate smart-contract risk, infrastructure dependencies or withdrawal delays. To assess custody risk, check who can authorise spending, who controls the keys and what must happen before a withdrawal completes.
For traders using privacy tools, there is another question: who can see the activity? Keeping trades private and keeping control of funds are separate protections. A product should explain both.
What is a non-custodial privacy tool?
A non-custodial privacy tool limits public visibility into financial activity while using keys, signatures and protocol rules to enforce user control over spending.
Funds do not necessarily remain in the user's original wallet. They may be held in a smart contract or committed as collateral on a trading venue. What matters is whether the service can move those funds without the authorisation required by the protocol.
A private balance alone does not establish non-custodial control. It describes visibility, not spending authority.
Does non-custodial mean there is no custody risk?
No. Non-custodial systems can reduce the risk of a provider spending funds at its discretion, but users still depend on the security of the system and its withdrawal process.
Several risks need separate consideration:
| Risk | What to check |
|---|---|
| Unauthorised spending | Can anyone move funds without the required user signature? |
| Key compromise | Who can access, recover or use the keys? |
| Smart-contract failure | Could a bug allow funds to be stolen or locked? |
| Administrative control | Can an administrator change contracts, permissions or withdrawal rules? |
| Withdrawal delays | Does access depend on an operator processing transactions? |
| External dependencies | Which bridges, attestations or other services must work correctly? |
The important distinction is between preventing someone from taking your funds and ensuring you can access them when needed.
How does ShieldTX handle funds for shielded Hyperliquid trades?
ShieldTX holds deposited USDC in an onchain vault on Arbitrum and records a corresponding shielded balance. A fresh Hyperliquid trading account is funded for each trade, and orders execute on Hyperliquid's order book.
The fund flow has four stages:
- Deposit: USDC enters the vault, and the user receives a corresponding shielded balance.
- Trade: A fresh trading account is funded for a shielded Hyperliquid trade.
- Close: The position closes on Hyperliquid, and proceeds return through the ShieldTX flow to the shielded balance.
- Withdraw: The user signs a withdrawal request specifying the recipient. Funds are released after the required onchain confirmation.
ShieldTX's trust model states that Privy handles trading-wallet keys client-side. Users should review the signing and recovery arrangements alongside the fund flow.
What prevents an operator from spending a user's funds?
In ShieldTX's architecture, spending user-owned notes requires the owner's signature. A withdrawal authorises a specific recipient, preventing a third party relaying the withdrawal from redirecting it to its own address.
Nightshade, Avail's privacy infrastructure, uses proofs to enforce transaction rules, including ownership and protection against double spending.
Does non-custodial mean nobody can see your balance?
No. Custody describes control over funds. Privacy describes access to information.
ShieldTX's architecture states that its sequencer currently sees note state. The note state is not visible on-chain and can only be seen by account owners. Visibility is preserved for audits and compliance.
Likewise, shielded trades do not make Hyperliquid positions disappear. Positions remain observable at their trading accounts. Shielding reduces the public connection between those accounts and the wallet supplying the funds.
To review what your wallet currently reveals to public observers, use the ShieldTX wallet scanner as a starting point for assessing your public trading exposure.
Do shielded trades reduce market or liquidation risk?
No. Shielded Hyperliquid trades remain subject to price movements, funding costs, margin requirements and liquidation. Shielding changes public wallet association; it does not change the underlying position's risk.
A privacy tool should be evaluated alongside the trading venue and the infrastructure used to move funds. Strong privacy protections do not replace position monitoring or sound key management.
Frequently asked questions
Are funds in a smart contract automatically non-custodial?
No. Contract permissions matter. Review who can withdraw, upgrade the contract or change its rules before relying on the non-custodial label.
Does an audit eliminate custody risk?
No. An audit reviews a defined scope and version. It does not guarantee that every vulnerability has been found or that the deployed system has remained unchanged.
Can a tool protect privacy while retaining user control?
Yes. Privacy and user-authorised spending can coexist. Each needs its own explanation: who can see the activity, who can move the funds and which services are required for withdrawals.
Review the controls behind shielded trades
The value of a non-custodial privacy tool depends on both its spending controls and its practical withdrawal process.
For ShieldTX, review the trust model and technical architecture to understand the fund flow and current dependencies. To discuss shielded Hyperliquid trades for your team, get in touch.