Live Mainnet Monitoring

MagicBlock "Private" Payment Explorer

MagicBlock claims "institutional-grade privacy" for their Private Payments API. This dashboard decodes every "private" transfer in real-time from the Solana mainnet blockchain, showing sender, receiver, and exact amount -- using only standard, publicly available RPC data. No exploits, no hacking -- just reading the public blockchain.

Exposed Volume
L1 + PER combined
L1 Decoded
base-to-base on mainnet
PER Decoded
0 failed | from ER validators
Unique Wallets
senders + receivers exposed
TEE Total Txs
… tx/sec (no auth needed)
Privacy Score
L1 + PER all exposed

Live "Private" Transfers

Loading…| Click row to expand
TimeSourceSenderReceiverAmountTokenStatusVerify
Scanning Solana mainnet + ephemeral rollup validators…

Try It Yourself -- Wallet Lookup

Paste any Solana wallet address to check if it has been involved in MagicBlock "private" transactions. If found, we show every decoded detail.

Try these real addresses:

What They Claim vs What We See

Direct quotes from MagicBlock's website and documentation, compared with our findings.

MagicBlock Claims
"Institutional-grade privacy"
Source: magicblock.xyz/blog/institutional-grade-privacy
Reality
CRITICAL
Auth API is in mock mode -- returns static 'mock-auth-token' for any credentials. Anyone can query any user's private balance.
MagicBlock Claims
"Nobody can see your data"
Source: magicblock.xyz/solana-privacy
Reality
CRITICAL
Every 'private' transfer settles as a standard SPL token transfer on Solana mainnet. Sender, receiver, and exact amount are visible on any block explorer.
MagicBlock Claims
"Private transfers"
Source: docs.magicblock.gg (Transfer API)
Reality
HIGH
The instruction is literally named 'DepositAndDelegateShuttleEphemeralAtaWithMergeAndPrivateTransfer' -- even the NAME reveals it's a private transfer.
MagicBlock Claims
"TEE-secured black box"
Source: magicblock.xyz/blog/institutional-grade-privacy
Reality
HIGH
Intel TDX hardware is real, but settlements bypass the TEE entirely. Privacy only exists during the ~50ms computation window, not for the actual money movement.
MagicBlock Claims
"Even the operator can't see it"
Source: docs.magicblock.gg (On-chain Privacy)
Reality
MEDIUM
An nginx proxy sits OUTSIDE the TEE, seeing all auth tokens and request metadata. Auth tokens are passed in URL query params, leaking to server logs.
MagicBlock Claims
"Fine-grained access control"
Source: docs.magicblock.gg (Authorization)
Reality
HIGH
1,188 permission accounts are fully readable on Solana mainnet, exposing the entire access control graph -- who has permission to what private data.
Methodology

All findings were obtained using standard Solana RPC calls to public mainnet nodes. No special access, exploits, or MagicBlock-specific APIs were required to decode "private" transactions. Anyone with a Solana RPC endpoint can independently verify every claim by querying the transfer queue account xkHohgjxvBtvr9x6NJwXNNGJYYiDdLJbCTaNvxCRm2S on Solana mainnet.