00 · overview

Money that
doesn't echo.

hUSD is a dollar on Robinhood Chain that you can cloak. Mint it against USDG, cloak it, and the amount and both parties never reach the ledger. Observers see that something moved. They never see who, to whom, or how much. Visible when you choose. Silent when you don't.

hUSD price

$—

collateral ratio

—

reserve

—

hUSD supply

—

cloaked

—

$HUSH CA

01 · signal

What the ledger can see.

Every entry below is public. Cloaked transfers appear as one nullifier and one commitment, with the amount and both parties absent. This is the entire footprint.

02 · blind desk

Stocks, unobserved.1X

positions open

—

notional inside

000000

volume

—

fees → erase

—

Commit cloaked hUSD to tokenized stocks. Long or short, 1x, priced off the live exchange tape. Ticker, size, side and P&L all stay cloaked; the ledger records one nullifier and one commitment, identical to any cloaked send. 30 bps each way goes to Erase. Orders fill only while the tape is live.

03 · bonds · cryo

$HUSH below market. Reserve above.−20% / −30%

bond price · $HUSH

—

market price

—

capacity today

—

bonded so far

—

cryo price · $HUSH

—

in cryo

—

Bonds. Deposit USDG and take $HUSH at 20% below market, vesting linearly over 5 days. The USDG goes straight into the reserve and mints nothing, so every bond makes hUSD more collateralized. Daily capacity is capped, first come first served. Minimum 50 USDG.

Cryo. Lock the bond instead: $HUSH at 30% below market, held 48 hours, and the locked HUSH earns 80% APY in $HUSH the whole time, paid from the Window's fixed pool. Nothing is printed. Bond, lock, earn, release.

04 · the window

Yield with an end date.LIMITED

APY · paid in $HUSH

—

hUSD staked

—

reward pool left

—

closes in

—

stakers

—

Temporary by design. Stake hUSD and earn a fixed APY paid in $HUSH from a pool the treasury funded in advance. Nothing is printed and no hUSD is created. When the pool or the clock runs out, the Window closes. A yield with an end date can never become the thing holding up the peg.

05 · erase

Every fee buys $HUSH and deletes it.

$HUSH erased

—

bought back

—

queued · next cycle

—

cycles

—

30 bps on cloak, send and uncloak, 50 bps on redeem. Fees collect in USDG, and each cycle the protocol buys $HUSH at market and erases it from supply. The erase receipt is public. The payer never is.

06 · relays

Bring someone in. 20%, forever.

Anyone who claims your Drop, or arrives through your relay link, is bound to you. From then on 20% of every fee they pay (cloak, send, uncloak, redeem) is credited to your hUSD. Not once. Every time. Erase takes the other 80%.

wallets you relayed

—

earned from their fees

—

Top relays. Addresses are masked. Relays are counted, never named.

07 · drops · mirror

DropPAY LINK

Send cloaked dollars as a link. Lock cloaked hUSD behind a secret; whoever opens the link claims it into their own cloaked balance. No recipient is ever named. On the ledger it is one nullifier and one commitment, the same as any cloaked send. Text it. DM it. Print it as a QR. Create one from the Send tab in the vault.

MirrorVIEW KEY

Show one person. Nobody else. Generate a view key and whoever holds it can read your cloaked balance and history on a mirror page. It can never spend. Hand it to an accountant, a partner, an auditor, and to nobody else. Generate one with mirror next to your cloaked balance.

08 · protocol

Three moves. No names.

Mint hUSD

Deposit USDG. Most of it becomes hard collateral; the small algorithmic share buys $HUSH at market and erases it. You receive $1-pegged hUSD. Redeem any time to reverse it.

Cloak it

Cloaked hUSD becomes a note encrypted only to you. Your balance is unreadable to everyone else.

Send without a trace

A cloaked send keeps the amount and both parties hidden. The ledger holds one nullifier and one new commitment. That is digital cash.

Phases

The ledger & $HUSH

Real privacy primitives (commitments, nullifiers, encrypted notes), USDG deposits verified on Robinhood Chain, open mint and redeem.

Live

Drops, Mirror, Blind Desk

Pay-by-link cloaked transfers, read-only view keys, cloaked stock positions, bonds, Cryo and the Window.

Live

hUSD contracts on Robinhood Chain

Solidity mint and redeem against deposited collateral, a signed 24/7 oracle, and an hUSD pool.

Peg automation

Algorithmic collateral-ratio control and keeper bots holding $1 through arbitrage.

Planned

Zero-knowledge settlement

Cloaked transfers verified by on-chain ZK proofs, then professional audits.

Planned

09 · answers

Asked plainly.

What is hUSD?

A dollar you can make silent. hUSD is a fractional-algorithmic stablecoin on Robinhood Chain: each unit is minted from USDG, most of which is held as collateral while the remaining share buys and erases $HUSH. The protocol moves that ratio to hold the price at $1.

How does the peg hold?

Below $1 the collateral ratio rises, so more USDG backs each new hUSD and redeeming pays more hard collateral. Above $1 the ratio falls and more of each mint is the algorithmic share. Redemption is always open, so arbitrage pulls the price back to $1. The mechanism is public and the ratio is on the Overview at all times.

What does “cloak” actually do?

It moves hUSD from your visible balance into the shielded pool and writes a note encrypted only to you (x25519) plus a commitment in the Merkle tree. Nothing else is recorded. Your balance is unreadable to everyone but you.

What can an observer see when I send cloaked?

One nullifier spent and one new commitment added. No amount, no sender, no recipient. The recipient decrypts their note with their own key; nobody else can.

Can I become visible again?

Yes. Uncloak returns a private note to your visible balance at any time, and Redeem burns visible hUSD for your USDG collateral plus the $HUSH share. Silent when you choose, visible when you choose.

What is $HUSH for?

$HUSH is the share token. A slice of every mint buys $HUSH and erases it, every fee buys more and erases that too, and bonds and the Window pay out in it. Demand for private dollars flows into $HUSH. It is also the governance token for the phases ahead.

Is my USDG actually deposited?

Yes. A deposit is a real USDG transfer on Robinhood Chain to the treasury. The server reads the transaction receipt, checks that the Transfer log runs from your wallet to the treasury, and only then credits your vault. Every deposited dollar sits in a treasury address you can open on the explorer.

How do I get USDG back out?

Redeem hUSD for USDG in your vault, then Withdraw. Withdrawals enter a queue the treasury pays from a cold wallet, usually within 24 hours, and the payout transaction hash is written next to your request. There is deliberately no hot key on the server.

What is a Drop?

A pay link. You lock cloaked hUSD behind a random secret and share the link. Whoever opens it connects a wallet and the hUSD lands in their cloaked balance. The secret lives only in the link fragment; the server stores a hash of it, and the ledger shows one nullifier and one commitment, indistinguishable from any cloaked send. One claim per drop.

What is a Mirror?

A view key: an HMAC over your address with a server salt, encoded together with your address so the mirror page can verify it. It reads your cloaked balance and history and has no spending power. This is the selective-disclosure model privacy coins use for audits: you choose who sees, and only they see.

How do Relays work?

When someone claims your Drop or connects through your link (hushmoneyrh.xyz/?ref=your-address) for the first time, they are bound to you. 20% of every fee they pay from then on is credited to your visible hUSD, forever. The other 80% still goes to Erase. One relay per wallet, set once, never changed.

What is the Blind Desk?

Private exposure to tokenized stocks. You commit cloaked hUSD to a long or short in HOOD, TSLA, NVDA, SPY and others at 1x, priced off the live exchange tape. When you close, P&L settles back into your cloaked balance. Nobody can see what you hold, how much, or which way. Positions are capped per wallet and protocol-wide, shorts stop out at a 95% loss, and orders fill only while the tape is fresh. The protocol is the counterparty; fees go to Erase.

What are Bonds?

The fastest way to grow the reserve. Deposit USDG and receive $HUSH at 20% below market, vesting linearly over 5 days, claimable as it vests and withdrawable to your wallet from the treasury. Your USDG goes into the hUSD reserve and mints nothing, so bonds push the collateral ratio up. Capacity is capped per day and the program closes with the Window.

What is Cryo?

A locked bond. Take $HUSH at 30% below market, held for 48 hours instead of vesting over 5 days. While locked it earns 80% APY, paid in $HUSH from the same fixed pool that funds the Window. At release you claim principal plus yield in one click. The USDG goes to the reserve and mints nothing.

What is the Window, and why does it close?

A limited staking period: stake hUSD and earn a fixed APY paid in $HUSH from a pool set aside in advance. It has a hard end date and a hard pool size. Permanent subsidised yield is what turned Anchor into the only reason to hold UST. A yield that ends cannot become load-bearing.

What is Erase?

The buyback. Every cloak, cloaked send and uncloak pays 30 bps, every redeem pays 50 bps. Fees collect in USDG and each cycle the protocol buys $HUSH at market and removes it from supply, publishing a receipt. Use of private money becomes permanent scarcity in the share token.

Which chain and which wallet?

Robinhood Chain (chainId 4663). Connect any EVM wallet such as MetaMask or Rabby; the site switches the network for you. USDG is the collateral asset.

How is risk handled?

The collateral ratio is published live, redemption is always open, yield programs have fixed pools and end dates, and Blind Desk exposure is capped per wallet and protocol-wide. Withdrawals are paid from a cold wallet, so no key on the server can move funds. A peg is a mechanism, and cloaked notes are encrypted to your keys alone, so keep your keys and size your position sensibly.