VAULT INFRASTRUCTURE

Confidential Vaults in DeFi: What They Hide, and What They Don't

Sixteen vaults on one venue, a new cryptographic stack underneath them, and a yield that is still the public vault's yield. This guide covers who offers confidential vaults, how much money sits inside, how the privacy actually works, what stays visible, and what a third party like pigi can still assess.

The Short Version

• Confidential yield vaults exist today in one place: Zama's 16 vaults on Morpho (Ethereum), curated by Steakhouse, Armitage by Wintermute, Flowdesk, RockawayX and Bitwise, open for deposits since 15 September 2026.
• Four of them are confidential-only and hold $82.9M on the Morpho side. The other twelve are confidential entries into existing public vaults and carry under $15M between them.
• Zama's whole confidential footprint is about $117M, up 108% in 30 days. Confidential DeFi as a category, mixers excluded, is roughly a quarter of a billion dollars.
• Privacy comes from fully homomorphic encryption. Balances live on Ethereum as ciphertext, and a daily batch sends one aggregate amount to the Morpho vault.
• Your amount is hidden. Your address, the moment you joined a batch, and the batch total are public.
• The yield is the public vault's yield. The confidential layer adds a trust surface and a daily settlement cycle on top of it; it does not pay for itself.

Figures in this article were checked on 13 October 2026 against DefiLlama, Morpho's API, Zama's documentation and dashboard, and pigi's own data. TVL moves daily; treat every number as a snapshot.

Who Offers Confidential Vaults Today

"Private DeFi" is a wide label, and most of it is not vaults. Shielded pools and private transfers (Railgun, Privacy Pools, Aztec's zk.money) hide where money moves. Confidential tokens (Inco on Base, COTI, Umbra on Arcium on Solana, NEAR Confidential Intents) hide balances and swap sizes. A confidential yield vault is the narrower thing: you deposit, you earn, and your position stays private while the capital is working.

As of October 2026 one product does that with public deposits: Zama's confidential vaults on Morpho. The first one, Steakhouse Confidential Prime USDC, launched with Morpho and Steakhouse in June 2026 and reached about $40M within seven weeks. On 15 September 2026 the line widened to 16 vaults across five assets (USDC, USDT, WBTC, AUSD and tGBP) and five curators, alongside a confidential swap protocol for moving between positions.

The 16 vaults come in two structures:

• Hybrid (12 vaults): a confidential entry into an existing public curated vault. Same strategy, same markets, same liquidity, same risk parameters. The only difference is that your deposit and your position are encrypted.
• Confidential-only (4 vaults): vaults with no public counterpart. All deposits arrive through the confidential layer.

Elsewhere the category is still arriving. Fhenix is on testnet. Privana, a vault built on Oasis's hardware-enclave chain, is on a waitlist with "idle yield to Aave" on its roadmap. Kintsu, lending and vaults on the Canton Network, is in private beta. Secret Network's Shade is deprecated. No confidential vault exists on Aave, Euler, Spark or any venue other than Morpho. DefiLlama's research desk names exactly that, a confidential vault on a second lending venue, as the first sign the category has outgrown a single integration.

How Much Money Sits in Confidential Vaults

There are three honest answers, because there are three definitions.

• $82.9M is the Morpho-side TVL of the four confidential-only vaults, read from Morpho's API. These are ordinary Morpho V2 vaults whose depositors all arrive through the confidential layer.
• About $95M is what Zama's own dashboard attributes to vault-share wrappers: the four confidential-only vaults (about $81M) plus the confidential slices of the hybrids, which are small. Steakhouse Prime USDT holds about $8.5M of confidential capital and the tGBP vault about $5M; the other ten hybrids hold almost none. This is Zama-reported.
• $117.2M is Zama's TVL on DefiLlama: the public reserves backing every confidential wrapper, vault shares and plain confidential tokens alike.

For scale, DefiLlama's privacy category holds about $978M across 48 protocols, but $731M of that is Tornado Cash. Without mixers the category is roughly $240M, and two protocols are almost all of it: Zama at $117M and Railgun at $114M. Railgun is private transfers and private access to public DeFi, not a vault product. Privacy Pools holds about $9M; everything else is under $2M each.

Momentum

Zama's TVL on DefiLlama was $27.7M in early May 2026, $42.6M in mid-July, $56.3M on 13 September and $117.2M on 13 October. That is +108% in 30 days, most of it after the 15 September launch. Over the same 30 days Railgun grew about 16% and Privacy Pools barely moved.

The longer series tells the same story. DefiLlama Research puts confidential DeFi without mixers at $73.3M in March 2025 and $197.6M in September 2026, a 170% rise in 18 months, with the protocol count going from 18 to 39. Inside that growth the share held by FHE rose from 23.1% in May 2026 to 41.7% in September, up every single month, and all of it taken from zero-knowledge systems. Zama itself reports crossing $100M of shielded value within 25 days of mainnet, against 860 days for Monero, 1,185 for Railgun and 1,580 for Zcash; that comparison is Zama's own.

Two caveats belong next to those numbers. Early vault growth came with a twelve-week rewards programme, and the APYs shown for the confidential-only vaults in Zama's app include rewards. The three signals that would show the category maturing are a second venue beyond Morpho, a project outside Zama adopting the ERC-7984 confidential token standard, and a first full quarter of data from the confidential swap protocol.

How Confidentiality Is Achieved

Fully homomorphic encryption (FHE) lets a program add and compare numbers it cannot read. The ciphertext goes in, the ciphertext of the result comes out, and nobody along the way sees a plaintext. Zama's protocol puts that primitive under ordinary Ethereum contracts:

• Host contracts on Ethereum store encrypted balances as handles to ciphertext.
• Coprocessors, off-chain services run by multiple operators, perform the FHE arithmetic and commit the results.
• A gateway coordinates access control: which contract may use which ciphertext, and which values may ever be decrypted.
• A threshold key-management network, a multi-party quorum, holds the decryption keys and decrypts only values the contract has marked decryptable. Every decryption the contracts consume carries a proof verified on-chain.
• ERC-7984, co-authored by Zama and OpenZeppelin, is the confidential token interface. cUSDC, cUSDT and the vault-share token cShare are ERC-7984 tokens.

A confidential vault deposit then runs like this. You wrap USDC into cUSDC; the wrap amount is a plain ERC-20 transfer and is public. You join the day's deposit batch with an encrypted amount. At the cutoff the batcher sums every encrypted amount homomorphically and asks the key network to decrypt one number: the batch total. The wrapper contract deposits that total into the Morpho vault, and the vault shares come back to depositors as encrypted cShare balances. Withdrawals mirror the process in the other direction.

The schedule is fixed: withdrawals cut off at 11:00 UTC and deposits at 15:00 UTC, one batch of each per vault per day. After the cutoff a queued action cannot be cancelled. The batcher contracts ship without a proxy or an upgrade path and cannot move or freeze user funds. The confidential token wrappers are shared registry contracts governed by the Zama protocol, and that governance can pause a wrapper.

On the Morpho side all of this collapses into a single address. For Steakhouse Confidential Prime USDC, pigi's holder scan shows 20 addresses holding the Morpho vault, and the ConfidentialWrapper proxy holds 96% of it.

What Stays Visible

Zama's own documentation is direct about the boundary: your deposit amount is hidden among the other deposits in your batch, while who you are, when you took part, and the batch total are public.

Three limits follow from the design, and Zama lists them itself. A batch with a single depositor reveals that depositor's amount, because the total is the amount. Wrapping USDC right before joining publishes an upper bound on what you deposited. And comparing batch totals across days can leak information about who moved. Blockscout indexes confidential transfers as a distinct token type: sender, recipient, transaction hash and block are shown, and the amount is marked confidential.

The Other Ways to Hide a Balance

FHE is the newest approach and, by TVL, the fastest growing. It is not the only one.

None of these systems can read the others. A confidential balance in one of them cannot move to another without first being unshielded back into a public asset. That is the fragmentation the category has not solved, and ERC-7984 so far standardises tokens inside the FHE camp rather than across camps.

What a Depositor Gains

• Position size and timing stay off the market. Nobody can read your balance, front-run your entry, copy your allocation or size you up as a counterparty.
• The strategy is unchanged. A hybrid vault routes into the same public vault with the same curator, markets, caps and liquidity. You are not paying for privacy with a worse strategy.
• Compliance is built in rather than bolted on. Elliptic screens addresses before funds enter, without seeing amounts. Hypernative monitors the contracts. ERC-7984 observer roles let a depositor grant an auditor or regulator sight of a specific balance, and nobody else.
• The exits are permissionless. The batcher contracts cannot freeze funds or decrypt balances, have no upgrade path, and leave collection, take-back and recovery available even when paused.
• Institutional use cases are already running on the same rails: confidential payroll, OTC settlement and a tokenised sterling stablecoin.

What a Depositor Gives Up

• A new trust layer. Coprocessors, a key-management quorum that today runs inside cloud enclaves, and a registry governance that can pause the wrappers all sit between you and the Morpho vault. None of that exists for a public deposit.
• One settlement a day. Deposits and withdrawals queue until the cutoff, cannot be cancelled after it, and an instant exit is public.
• Small batches hide little. A batch of one hides nothing. Thin vaults and quiet days weaken the privacy of everyone in them.
• One chain, one venue, five curators. Every live confidential vault is on Ethereum and on Morpho. Zama's roadmap adds chains through 2027; the venue concentration is not addressed by a roadmap.
• No bridge between privacy systems. Moving a balance from FHE to a zero-knowledge pool or an enclave chain means unshielding first.
• Undefined regulation. No jurisdiction has set a regime for confidential on-chain assets. Selective disclosure anticipates what regulators will want; it does not settle what they will decide. The Tornado Cash developer prosecution is still in court.
• Cost. FHE operations are metered separately from gas and cost more than plain transfers.
• No premium. The yield is the public vault's yield, and the APYs displayed for the confidential-only vaults include rewards.

What a Risk Rater Can and Cannot See

pigi tracks the Morpho side of two of the four confidential-only vaults. Neither is rated yet. The question of what a rating can even cover is worth spelling out, because it is the same question every allocator faces with these products.

What can be assessed is the venue: the Morpho vault, the markets it allocates to, the curator, caps, fees, timelocks and the share-price history. That is most of what a structural rating is built on, and a hybrid vault inherits all of it from its public twin. These two vaults share a curator but not a strategy; the 271 basis-point gap between them is a strategy difference to examine, not a privacy premium.

What cannot be assessed is the depositor side. Holder concentration, which we track for every other vault and wrote about in How Concentrated Are DeFi Vaults?, stops at the wrapper. Behind that one address the balances are encrypted, so a rater cannot see whether the vault is one institution or two hundred, or whether a large position is on its way out.

Takeaways

• Confidential yield vaults are a single-venue product today: Zama on Morpho, Ethereum, five curators, 16 vaults.
• The money is concentrated in the four confidential-only vaults; the hybrids have attracted little confidential capital so far.
• Growth is real and fast, and it is one protocol's growth. The category is still well under one percent of DeFi.
• FHE hides amounts and balances. It does not hide addresses, timing or batch totals, and a batch of one hides nothing.
• The confidential layer is a dependency: coprocessors, a key quorum, registry governance and a daily cycle, none of which a public deposit carries.
• The yield is the public vault's yield. Judge the vault underneath first, then decide what the privacy layer is worth to you.

Information, not advice. pigi tracks the Morpho side of these vaults and will publish ratings when the methodology covers the confidential layer. Explore DeFi vault analytics on pigi.finance.