XYZVault Launches a Privacy-Focused Multisig Vault
A few days after its much-discussed “can’t see vs won’t look” post, XYZVault announced its launch on Stacker News in June 2026: a privacy-focused multisig vault platform with a 30-day free trial. The announcement repeats the architecture from the discussion post and adds one useful conceptual frame: wallet-metadata privacy is a separate problem from private-key custody.
As with the earlier post, everything about the product below comes from the vendor’s own announcements. I could not independently verify the claims. A direct check of their referenced site failed. Read this as “what the vendor says it built,” not as a review.
What the vendor says it built
Per the launch announcement, XYZVault is a 2-of-3 multisig vault where the company holds one key and the user holds two on hardware wallets. The pitch centers on the metadata layer:
- Sensitive vault data is encrypted locally in the browser before it ever reaches their servers. The encryption key never leaves the user’s device.
- The server stores ciphertext instead of plaintext xpubs, addresses, labels, balances, or configuration.
- Even if their database were compromised, the vendor claims an attacker would get only encrypted blobs, not the data needed to identify wallets, balances, or addresses.
- The launch offered a 30-day free trial: register, create a vault, select Free Trial, and test the platform.
The vendor’s example makes the mechanism concrete: a plaintext record with a label, an xpub, and an address becomes an opaque ciphertext string before upload. Since the key never leaves the browser, the company claims it cannot decrypt the data, inspect the vault configuration, or determine holdings.
The useful idea: metadata privacy vs key custody
The launch post frames wallet-metadata privacy as distinct from private-key custody, and that distinction is genuinely useful. The industry spent a decade solving “who holds the keys.” Far less attention went to “who sees the xpubs.”
An xpub cannot spend your coins, but it reveals every address and the full balance. A custody provider that holds your xpubs in plaintext knows your financial life in detail, even if it can never move a sat. Most assisted-multisig providers sit in exactly this position: non-custodial on keys, fully sighted on data. The August 2026 Nunchuk privacy discussion showed users waking up to this, with the co-signer seeing full balances and email signup tying identity to the wallet.
Whether XYZVault actually delivers on its architecture is unverified. But the problem it names is real, and it gives you a new question to ask every custody provider: not just “can you move my coins,” but “what can you see?”
What to verify before trusting any such claim
Vendor architecture claims deserve the same skepticism as vendor security claims. Before putting meaningful funds in any new vault platform:
- Is the client code auditable? Browser-side encryption is only as good as the code running in your browser. Open source that you or others can inspect beats a blog post.
- Is the cryptography standard? Bespoke crypto is a red flag. Standard, reviewed primitives are the baseline.
- Can you recover without them? The vendor claims you can sweep to Sparrow with your two keys if they disappear. Test that claim on testnet before trusting it on mainnet. And remember that recovery needs the descriptor too: seed words are not enough for a multisig.
- What does the blind proxy actually hide? A proxy that relays data “without linking addresses to users” is a precise technical claim. Ask for the precise technical explanation.
- Who are the people? Anonymous teams building custody products deserve extra scrutiny, not less.
New custody products earn trust slowly or not at all. A 30-day trial is a fine way to kick the tires. It is not due diligence.
If you are evaluating the established options instead, compare multisig-ready hardware wallets, check coordinator support in the compatibility checker, and get a personalized recommendation from the multisig wizard.
Discussed on Stacker News: XYZVault: The First Privacy-Focused Multisig Vault Platform
