---
title: Untraceable mode: the Monero hop and the encrypted swap ID
description: Untraceable mode settles the transfer between two providers on Monero. What a chain observer sees, its limits, and what is inside the encrypted swap ID.
url: https://sablebolt.io/blog/untraceable-mode-monero-hop-and-encrypted-swap-id
---

# Untraceable mode: a Monero hop and an encrypted swap ID

Sablebolt Team 8 November 2026 9 min read

Contents

1. What changes against Private mode
2. How the Monero step is put together
3. What a chain observer sees
4. The claim and its limits
5. The encrypted swap ID in detail
6. The time budget
7. The status page in this mode
8. Checklist before you send
9. FAQ

[Private mode](https://sablebolt.io/blog/private-mode-two-providers-one-swap) divides a swap between two liquidity providers: one of them receives the address you pay from, the other the address you are paid at. It leaves one transaction on a transparent chain. The coin that travels from the first provider to the second shows its sender, its receiver and its amount there, as every transaction on such a chain does. Untraceable mode keeps the two providers and moves that transaction to a private chain. What follows is what that removes from the public record, what it leaves there, how the swap ID is built, and what the arrival line shows.

## What changes against Private mode

|  | Private mode | Untraceable mode |
|---|---|---|
| Orders | Two, at two different liquidity providers | Same |
| Coin carried between the providers | Chosen by our server for the route, on a transparent chain | Monero |
| That transfer on chain | Sending wallet, receiving address, amount and time all public | A transaction in a Monero block: no sender, receiver or amount |
| Your deposit and your payout | Public on their own chains | Same |
| Rate | Floating, set separately for each step | Same |
| Network fees | Two; the form shows the one in the asset you receive | Same |
| Arrival line | Your sending chain plus the hop coin's confirmations, "two steps" | Your sending chain plus Monero's confirmations, "two steps" |
| Swap ID | Encrypted, starts with pm1 | Same |

The real difference is one row: which coin carries the middle transfer. The rows about the chain and the arrival line follow from it.

## How the Monero step is put together

The order of creation is the one Private mode uses, with Monero fixed in the middle. The first call goes to provider 2: an order from XMR to the asset you want, paying your receiving address; provider 2 returns a one-time Monero deposit address. Then it opens an order at provider 1, from your asset to XMR, with the address you send from and with that Monero address as the payout. You pay provider 1 once, from your own wallet. Provider 1 sends XMR from its wallet to provider 2; provider 2 waits for Monero to confirm the transfer, converts, and pays you.

Monero does not pass through your hands. You do not need a Monero wallet, and the form asks you for no Monero address. Sablebolt holds no XMR either: provider 1 pays provider 2 directly.

A route that starts or ends in Monero does not offer this mode, because the coin in the middle has to differ from both ends. The switch says so in one line, "Untraceable mode is not available for this route. A standard swap is.", and a standard swap such as [BTC → XMR](https://sablebolt.io/swap/btc/xmr) remains available.

≈ 2–5 min 1 confirmation on TRON

[Swap USDT TRC-20 to BTC](https://sablebolt.io/swap/usdt-trc20/btc)

## What a chain observer sees

Take [ETH → BTC](https://sablebolt.io/swap/eth/btc) as the route. Three transactions make up the swap on chain:

| Transaction | Chain | Sender shown | Receiver shown | Amount shown | Time shown |
|---|---|---|---|---|---|
| Your deposit | Ethereum | Your 0x… address | Provider 1's deposit address | Yes | Yes |
| Transfer between the providers | Monero | No | No | No | Yes (the block's time) |
| Your payout | Bitcoin | Provider 2's payout wallet | Your bc1q… address | Yes | Yes |

On a Monero explorer, the middle transaction looks like every other Monero transaction: it exists, it sits in a block, its confirmations climb, and the page shows its size and fee — no sender, receiver or amount. [What a block explorer shows about a swap](https://sablebolt.io/blog/what-a-block-explorer-shows-about-a-swap) has the full list of what a Monero explorer page carries. In Private mode the same row would show provider 1's payout wallet, provider 2's deposit address and the amount, as any transparent-chain transaction does; here it shows none of the three.

## The claim and its limits

Our claim for this mode is: no public link between your deposit and your payout. It rests on the middle row above. With that row on Monero, nothing on the public record says that an Ethereum deposit into one provider and a Bitcoin payout from another belong to the same swap.

The claim covers the public record and nothing beyond it. Three things sit outside it.

**Amounts and timing of the public legs.** Your deposit and your payout stay on transparent chains, each with its amount and its time. Anyone can set them side by side: 0.5 ETH into one provider at 15:00, bitcoin worth roughly the same out of another provider less than an hour later. On a route where few swaps of that size pass in the same window, that comparison alone can suggest a match. Sablebolt does not hold the transfer back or split the amount: provider 1 pays provider 2 as soon as its own step is done, and provider 2 starts once the Monero transfer has confirmed.

**The providers' own records.** Provider 1 keeps its order: your sending address, the deposit it received and the Monero address it paid. Provider 2 keeps its order: the Monero deposit it received and your receiving address. Each record remains with its provider under that provider's policy. The Monero transfer shows the public no sender, receiver or amount; the two companies on either side of it each know their own half.

**Our server while the swap runs.** Your receiving address and the amounts are in our memory while the status page needs them; the address you send from is passed to provider 1 at creation and not kept. We hold the key that opens the swap ID, and that key is the subject of the next section.

## The encrypted swap ID in detail

An Untraceable mode swap is two orders at two companies, and the status page has to find both to show you one swap. The usual way to remember which orders belong together is a database. We keep no database of swaps, so the pair travels inside the ID you hold, encrypted.

**What is inside.** The order number at provider 1, the order number at provider 2, the coin that carried the middle transfer, and, when the asset you send needs a memo or tag on the deposit, that value for provider 1's deposit address. A version number and a few internal bookkeeping fields complete it. Your addresses and the amounts are not in it.

**How it is built.**

| Part | What it is |
|---|---|
| pm1 | A prefix telling our server this is a two-step swap |
| Nonce | 12 random bytes, new for every ID |
| Ciphertext | The fields above, encrypted with AES-256-GCM under a 256-bit key |
| Tag | 16 bytes the server checks before it trusts anything inside |

The bytes are written in URL-safe base64 after the prefix, about 75 characters in all.

**Who can read it.** We can. Only we hold the key, and we say so plainly because it matters: every time the status page asks, our server decrypts the ID, finds both orders, and asks the provider whose step is running. Support reads it the same way when you write about a stuck swap. Without the key, the ID is a run of random-looking characters that names neither provider nor order.

**A changed ID.** GCM verifies the tag before it releases a single field. Alter, add or drop one character and the check fails: the API answers 404 and the page reads "No swap with this ID." An edited ID does not land on someone else's swap; it opens nothing.

**How long anything is held.** Status comes from the providers and is kept in memory, 30 seconds at a time while the swap runs and 5 minutes once it is final, then dropped; after that nothing about the swap stays in our memory. Our server writes none of this to disk; what the hosting platforms keep in their connection logs is described on the [Privacy page](https://sablebolt.io/privacy) . If our server restarts in the middle of a swap, the swap is not lost, because the ID carries everything the server needs to ask again.

Of the things we do not keep, one depends directly on this design: no link between the two steps anywhere but in the encrypted ID you hold. That also makes the status link worth saving the moment it opens.

## The time budget

Monero needs 5 confirmations in our model, about 11–24 minutes, and the arrival line allows for them before step 2 begins. How many confirmations provider 2 actually requires is its own setting. The arrival line on the form adds Monero's time to your sending chain's own confirmations. For three routes, if they are offered in this mode on the day:

| Route | Arrival line in Untraceable mode |
|---|---|
| [USDT TRC-20 → BTC](https://sablebolt.io/swap/usdt-trc20/btc) | ≈ 13–29 min · two steps |
| ETH → BTC | ≈ 15–34 min · two steps |
| [BTC → USDT TRC-20](https://sablebolt.io/swap/btc/usdt-trc20) | ≈ 32–68 min · two steps |

The first part of each range is the sending chain's own time (TRON about 2–5 minutes, Ethereum 4–10, Bitcoin 21–44); Monero's 11–24 minutes make up the rest. These figures come from our confirmation model, not from measured swaps, and the payout's own confirmations on the receiving chain come on top, in your wallet.

A worked timeline for ETH → BTC, sending an illustrative 0.5 ETH at 15:00:

1. **15:00.** The swap exists; the page shows provider 1's Ethereum deposit address. You send 0.5 ETH from your 0x… address.
2. **About 15:04 to 15:10.** Fifteen Ethereum confirmations. The page moves through "Confirming" to "Swapping"; provider 1 converts and pays XMR to provider 2's Monero address.
3. **About 15:15 to 15:34.** The Monero transfer confirms — five confirmations in our model. The page has stayed on "Swapping" the whole time.
4. **Then.** Provider 2 converts and broadcasts the bitcoin to your bc1q… address. The page shows "Sending" with the payout hash, and "Done" once Bitcoin confirms it.

So it takes a bit longer, depending on confirmations, and the arrival line says how much.

## The status page in this mode

The page carries the mode's badge beside the title and a route line in tickers, such as ETH → XMR → BTC. It lists three transactions: your deposit, the Monero transfer between the providers, and your payout. The Monero link opens an explorer that shows no amount or addresses, as expected.The fees appear as "Fee, step 1" in XMR and "Fee, step 2" in the asset you receive, each marked "already deducted". If a step halts, the page names it: "Step 1 could not be completed. Write to support@sablebolt.io with the swap ID." [Reading a swap status page](https://sablebolt.io/blog/reading-a-swap-status-page) covers the five stages themselves.

## Checklist before you send

- The switch shows Untraceable mode as available for your route.
- The minimum has been read again in this mode.
- The sender field holds the wallet you will really pay from.
- The status link is saved before you close the tab.

## FAQ

Do I need a Monero wallet?

No. Provider 1 pays XMR to provider 2; you send your own asset and receive the one you chose.

Can I use Untraceable mode to buy or sell Monero?

No. The coin in the middle cannot be one of the two ends, so routes to or from XMR show the mode as unavailable and offer a standard swap.

Can Sablebolt open my swap ID?

Yes. The key is on our server; that is how the status page works and how support finds a stuck swap. A changed ID opens nothing.

Why does the form show one network fee and the status page two?

The form shows the fee in the asset you receive and folds step 1's fee into the estimate, since the second quote starts from the first step's net payout. The status page breaks both out.

What if the swap cannot be completed?

Write to support with the swap ID from the status page. The form has no refund address: the deposit is returned to the address you sent from, less the network fee, after support confirms the address.

## Sources

1. [Moneropedia: Ring CT (hidden amounts)](https://www.getmonero.org/resources/moneropedia/ringCT.html) · read 2026-11-09
2. [Moneropedia: Stealth Address](https://www.getmonero.org/resources/moneropedia/stealthaddress.html) · read 2026-11-09
3. [NIST SP 800-38D: Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC](https://csrc.nist.gov/pubs/sp/800/38/d/final) · read 2026-11-09

## Related posts

- [How swaps work Private mode: one swap, two providers, and what we keep One provider gets the address you send from, the other the address that receives, and the transfer between them stays on a public chain: the steps, a worked USDT to BTC example, and the list of what we do not keep. 8 November 2026 9 min](https://sablebolt.io/blog/private-mode-two-providers-one-swap)
- [How swaps work What a block explorer shows about a swap, and what it doesn't Two hashes, two chains, one status page: chain by chain, what each explorer displays about a swap's deposit and payout, and the facts that live nowhere on-chain. 28 October 2026 9 min](https://sablebolt.io/blog/what-a-block-explorer-shows-about-a-swap)
- [How swaps work Reading a swap status page: every state from waiting to finished Waiting, Confirming, Swapping, Sending, Done — what each stage means, which hash to look up where, and when a wait is normal. 19 October 2026 9 min](https://sablebolt.io/blog/reading-a-swap-status-page)