> ## Documentation Index > Fetch the complete documentation index at: https://docs.inkwell.finance/llms.txt > Use this file to discover all available pages before exploring further. # Is this a mixer? > No. Dagon preserves the deposit↔withdrawal link by design — money in equals money out, the flow is legible. What's hidden is the order content during matching, not the flow of funds. > **CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved.** > > This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change. **Pre-alpha vs production.** Pages that describe "the operator holds the session-to-ephemeral-key mapping" describe today's single-operator implementation. Production Dagon will distribute this custody across an [Ika 2PC-MPC dWallet network](https://ika.xyz) — no single "operator" entity will hold the mapping, and no unilateral disclosure (lawful or otherwise) will be possible without the network agreeing. The two-party composition described here is strengthened, not weakened, by the migration. See [Design Philosophy](/inkwell/design-philosophy) for the full decentralization roadmap. No. And the distinction is load-bearing for every other claim on this site. ## What a mixer is A mixer (Tornado Cash, Samourai Whirlpool, Wasabi-style CoinJoin) creates anonymity by pooling many users into a single state and **severing the link between deposit and withdrawal**. The privacy property is set-based: users hide among N others whose coins look identical after mixing. Consequences: * The deposit-to-withdrawal link is cryptographically severed. * There is no concept of a "rightful owner" of any particular output after mixing. * Under compelled process, the operator can produce the pool state but cannot identify a specific user's outputs. * Flow-level obfuscation is the product. ## What Dagon is Dagon **does not pool and does not sever the deposit↔withdrawal link**. Within a session, money in equals money out. The flow of funds is structurally legible on-chain. What's hidden is the *order content during matching* — size, side, curves, and crossings — not the movement of capital. Session-level flow transparency is a **feature**, not an apology. Concrete tests: | Question | Mixer | Dagon | | --------------------------------------------------------------------------------------------- | -------------------------- | ------------------------------------------------------------- | | Can you deposit and withdraw to a different address? | Yes | No — withdrawals return to the depositor's controlled address | | Is there a pooled anonymity set? | Yes | No | | Can an observer link a user's deposit to their withdrawal? | No (severed) | Yes (preserved by design) | | Under compelled process to both operator + issuer, can one named user's activity be resolved? | No — no compliance surface | Yes — this is the compliance path | | What's hidden? | Flow of funds | Order content during matching | A mixer answers **yes / yes / no / no / flow**. Dagon answers **no / no / yes / yes / matching**. ## Why this matters legally The positive-claim rebuttal: **regulatory liability comes from flow obfuscation**. Mixers got designated because their architecture had no natural compliance surface — the operator structurally could not identify any specific user's activity, so there was no party for a court to turn to. Regulators read that as evasion-by-design. Dagon has a compliance surface: the [two-party composition](/dagon/concepts/two-party-composition). A court can compel both the operator and the credential issuer, and the response is a specific user's activity. Every counterparty holds a [KYC-backed BBS+ or Coconut credential](/dagon/concepts/two-party-composition#issuer-held-credential--pii); Sybil resistance is structural, not reputation-based. That's the ProtonMail posture, not the Tornado posture: encrypted by default, responsive to lawful process. The specific rules the posture is designed against include Reg ATS, FINRA 4552/5270, MiCA Arts. 76/78, MiFID II, GDPR Art. 22, and FATF Rec 16. ## What about user privacy, then? The user is not anonymous in the Tornado sense. The user is *identity- protected from the public, from counterparties, and from the operator in normal operation*, with recovery gated on the specific two-party composition. In practice: * An on-chain observer watching Solana sees the user's deposit and (eventually) withdrawal. They cannot see any order, fill, curve, or clearing price. * A counterparty in the same batch sees neither who the user is nor what was submitted. * The operator sees an encrypted ciphertext at ingress and a settlement delta at egress. It cannot tell which curve was which. * The issuer sees KYC data only, never any venue activity. That's a different privacy property than a mixer offers. Narrower in one direction (flow is legible); stronger in another (the operator cannot front-run anyone, period). ## Further reading * [Two-party composition](/dagon/concepts/two-party-composition) * [Selective disclosure by design](/dagon/concepts/selective-disclosure) * [What happens under subpoena?](/dagon/faq/what-happens-under-subpoena)