How SPECTER Works
Think of SPECTER as a private mailbox system. You put up a public sign that says "send mail here," but every letter gets routed to a different, secret mailbox that only you can open.
SPECTER is not a chain, a token, or a new wallet
It's a private receiving layer. You publish one public profile, and each sender turns it into a different one-time address. To everyone else, the payment lands at an address that looks unrelated to you.
The 3 phases
Step through the same three phases here, then read the detail below.
You generate two ML-KEM-768 keypairs and publish one meta-address. That is the only address you ever share.
- Spending key controls funds
- Viewing key detects payments
- Meta-address is public and reusable
1. Meta-address (your public profile)
Your meta-address is what you share with the world. It contains two public keys:
- Spending public key decides where the money goes. A sender uses it to derive your one-time address.
- Viewing public key lets a sender create a shared secret with you, which is what later proves a payment is yours.
The split is the whole point. You can hand the viewing secret to software that watches for payments without giving that software any power to spend. The spending secret stays locked away and only signs when you move funds. More on that in security boundaries.
You can attach the meta-address to your ENS name (alice.eth) or SuiNS name (alice.sui), so senders only need to know your name.
2. Stealth address (the one-time destination)
When someone wants to pay you, they take your meta-address and derive a brand-new address from it. This address has never appeared on-chain before, and without your private keys there is no value anyone can compute to link it back to your meta-address.
Pay Alice ten times and ten different addresses receive funds. None of them visibly belong to the same person. The sender transfers ETH or tokens to the address and is done.
3. Announcement (the coded breadcrumb)
A new address is private, but it leaves you with a problem: how do you find out a payment arrived, if even you can't recognize the address by looking? That is what the announcement solves. After sending, the sender posts a small piece of data that contains an encrypted hint plus a one-byte view tag. You scan announcements with your viewing key, the view tag throws out about 255 of every 256 that are not yours, and what remains are your payments.
The full flow in one picture
Step by step
Set up your profile
Generate your ML-KEM key pairs (spending + viewing). Bundle the public keys into a meta-address. Optionally link it to your ENS or SuiNS name.
Sender creates a payment
The sender fetches your meta-address, runs ML-KEM encapsulation to create a shared secret, and derives a fresh stealth address from it. They also compute a 1-byte view tag for fast filtering.
Sender posts an announcement
The sender publishes the encrypted ciphertext and view tag to the announcement registry. This is the breadcrumb you'll use to find the payment.
You scan and recover
You scan the registry with your viewing key. The view tag filters out ~99.6% of irrelevant announcements instantly. For the matches, you decapsulate the shared secret and derive the private key for your stealth address.
What makes this post-quantum?
The shared secret between sender and recipient is created with ML-KEM-768, not the classical ECDH that older stealth address schemes use. This matters because of one specific threat. The announcement sits on-chain forever, and anyone can copy it today. With ECDH, an attacker could store that data now and decrypt it years later, once a quantum computer can break elliptic-curve cryptography. That is the harvest-now-decrypt-later problem.
ML-KEM-768 is built on lattice math with no known efficient quantum attack, so the ciphertext in a SPECTER announcement is designed to stay private even against an adversary who saved it today and runs a quantum computer tomorrow.
The honest picture
SPECTER today provides post-quantum recipient privacy with classical spend security. The receiving/discovery layer uses ML-KEM-768. The wallet-compatible spending key is still secp256k1 for Ethereum compatibility. Read more in Security Boundaries.
