Murmur - Concept (Privacy/UX exploration)

Private swaps for tBTC

Murmur landing screen

Murmur is a concept for moving tBTC privately: deposit into a shared pool, wait, then withdraw to a fresh address so there is no public line between the two. I designed it on my own, and it was never built. I am showing it because the design problem is a good one. On a public chain the cryptography is the easy part. The hard part is making an invisible guarantee feel real, and keeping the steps you cannot undo from ever feeling casual.

  • RoleProduct and UI/UX Designer (self-directed concept)
  • TypeConcept (privacy/UX exploration, not implemented)
  • PlatformWeb
  • FocusPrivacy UX, trust, safety around irreversible actions

Overview

Murmur has two sides, and they depend on each other. There is you, trying to disappear, and there is the crowd you disappear into. Your privacy is only as strong as the set of identical deposits around you, so the whole design is built to make that crowd legible and to keep you from a mistake you cannot take back.

The flow is simple on the surface. You deposit a fixed amount of tBTC into a shared pool and get a secret note. You wait while more identical deposits join behind yours. Later you paste the note, pick a fresh address, and withdraw. On the chain, no one can tell which deposit became which withdrawal. The interface stays quiet until you connect, then opens up to show your history and the live set.

This is concept work, not a shipped product. There were no users, no client, and no measured outcomes. The value is in the UX problem: making an invisible guarantee understandable while making irreversible actions feel deliberate.

Murmur connected deposit screen Murmur withdraw screen

Problem

On a public blockchain, every transfer is visible and traceable, by amount and by address. A privacy tool has to break that link. But the real design problem is not the math. It is trust and safety. The guarantee is invisible, so a person has to be shown, clearly, how hidden they actually are. And the steps are irreversible: lose your note and the funds are gone, paste a bad address and they are gone. The interface has to make the invisible legible and the irreversible deliberate, at the same time.

Goals

01

Make the privacy guarantee visible.

Show privacy as something a person can judge, not just a claim the interface asks them to trust.

02

Make the safe, uniform choice obvious.

Guide people toward identical amounts because uniformity is what makes the crowd protect them.

03

Protect irreversible moments.

Slow down the note and withdrawal steps so losing access or sending funds badly never feels casual.

04

Teach the idea without lecturing.

Explain the privacy model through context, labels, and timing instead of heavy documentation.

Key Flows

The concept has two sides: depositing into the crowd, then withdrawing from it without revealing which deposit was yours.

Deposit

Connect your wallet, pick one of four fixed amounts, and see how big your crowd is. Get your note and back it up. Confirm in your wallet, and your deposit joins the pool.

Withdraw

Paste your note, choose any fresh address, and let Murmur build a proof that you own a deposit without saying which one. Confirm in your wallet, and the tBTC arrives with no visible trail back.

Murmur landing01 - DepositChoose amount
Murmur wallet connected02 - DepositCheck crowd
Murmur note backup03 - DepositBack up note
Murmur deposit confirmation04 - DepositConfirm
Murmur deposit history05 - DepositTrack history
Murmur withdraw form01 - WithdrawPaste note
Murmur valid withdraw entries02 - WithdrawAdd address
Murmur proof generation03 - WithdrawBuild proof
Murmur confirm withdraw04 - WithdrawConfirm

Design Decisions

Fixed amounts, not arbitrary ones

A custom amount is a fingerprint. I chose four fixed denominations: 0.001, 0.01, 0.1, and 1 tBTC. When everyone deposits in identical amounts, no single deposit stands out. The uniformity is the privacy, so the interface had to make the uniform choice the only choice.

Murmur fixed amount tiles

Make the crowd legible, and reveal when it matters

"You are private" is a claim a person cannot weigh. I showed the anonymity set as a plain count with a liveness cue, sized to the exact denomination, then revealed history and latest deposits once connected. The depth appears when you are transacting, not before.

Murmur anonymity set and deposit history

Treat the note as the one thing you cannot lose

The note is the only proof of a deposit. Lose it and the funds are unrecoverable. I gave that moment its own screen with the key, a copy action, a blunt warning, and an "I understand" check before the deposit can send.

Murmur note safeguard screen

Catch irreversible mistakes before they happen

On withdraw, a malformed note or wrong recipient address means funds lost for good. Inline validation and an inactive withdraw button make the interface refuse bad input before the wallet is involved, not explain it afterward.

Murmur withdraw validation errors

Exploration

I tried two real directions for the amount step. One was a slider with snap points, the pattern most tools in this space use. The other was four discrete tiles. Both present the same fixed set, so the choice was about the mental model.

A slider implies a range you dial in, which fights the one idea the product depends on: amounts are fixed and identical. Tiles say it plainly, pick one of four equal buckets, and they give each amount room to show its own crowd size. I chose tiles. The slider is not wrong, it is a fine pattern. Tiles just make the interaction match the idea the privacy rests on.

Murmur slider explorationDirection A

Slider with snap points

A familiar control, but it suggests a continuous range and makes fixed denominations feel like a constraint instead of the core privacy mechanism.

Murmur amount tilesDirection B

Discrete amount tiles

Four clear buckets make the rule visible: choose an identical amount, join an identical crowd, and avoid becoming the unique transaction.

Before / After

Because nothing shipped, this is not a product before and after. It is the privacy state of a transaction. Before: a normal tBTC transfer is fully public, one traceable line from sender to recipient. After: many identical deposits go into a pool and identical amounts come out to fresh addresses, and the one true path is hidden inside the crowd. The crowd is the privacy.

Before After

Reflection

Murmur was never built, and I would want a real usability pass before trusting the note-loss flow with anyone's money. But it is where the core idea of privacy UX clicked for me: the interface's job is to make an invisible guarantee feel legible, without ever letting the irreversible parts feel easy.

Fixed amounts, a visible crowd, a note you are made to respect, a withdraw that refuses bad input. None of it is flashy. For a privacy tool, that is the point.

Murmur How it Works

I'm available for new opportunities

Building something that needs a clear, trustworthy product experience? I'd love to hear about it.