Everything we can and cannot hide.

Someone who wants to put a coin on pump.fun without their main wallet, their browser, or their picture file saying who they are. The adversary is a chain analyst or a curious trader with an explorer, not a state. If your adversary is a state, nothing on this page is enough.

1. You → drop address. A fresh keypair is generated for each request. You send the quoted SOL from anywhere. This hop is a normal transfer and is visible.
2. Drop address → treasury. Once the balance clears, the engine sweeps the whole balance into one shared treasury and deletes the drop key. Every launch flows through the same account, which is what gives the pool its mixing value.
3. Treasury → burner. After your chosen delay (random, between zero and the maximum you picked) the treasury funds a second fresh keypair with the creation budget plus your dev buy.
4. Burner → pump.fun. The burner is the payer and the on-chain creator. It signs create_v2 (Token-2022) and, if you asked for one, the first buy. The tokens land in the burner.

A watcher sees: an unknown address paid the treasury; some minutes later the treasury paid an unknown burner which created a coin. With several drops in flight the two edges do not pair up. With one drop a day they do, which is why the delay exists and why volume matters.

Three keypairs exist per drop: the deposit address, the burner creator, and the mint. All three are generated server-side and stored only as AES-256-GCM ciphertext under a key that is not in the database. The deposit key is deleted the moment it is swept (or kept while a drop is unfunded so a partial payment can be recovered). The mint key is deleted the moment the coin is live. The burner key is deleted when you export it, or kept so you can collect fees through us. Either way there is a window where we are the custodian of the burner; if that is unacceptable, export immediately after launch.

• Token name, ticker, description, links, image URI and metadata URI — all already public on IPFS.
• The three addresses above, encrypted secrets while they are needed, and the transaction signatures.
• A SHA-256 hash of your claim key. Not the key.
• Timestamps for creation, funding and launch, so expiry and scheduling work.

We do not store IP addresses, user agents, emails, or cookies. Rate limiting hashes the connecting address with a salt that lives in process memory and is lost on restart. There is no analytics script on the launch path.

Uploads are decoded to pixels and re-encoded as PNG (or animated WebP) at a maximum of 1000 pixels per side. EXIF, IPTC, XMP and ICC blocks are not copied, so GPS coordinates, camera serials, editing software and embedded thumbnails do not survive. Orientation is applied first so the picture still looks right. The upload to pump.fun's IPFS endpoint is made by our server, so the pin request carries our address, not yours.

Before upload, a leak scan runs in your browser: it reports which metadata blocks the file carries (EXIF, a GPS IFD, XMP, IPTC, ICC, PNG text chunks), whether the filename looks device-generated, and whether the name or description contains an @handle, email, phone number or URL. Nothing from the scan is sent to us; it exists so you see what is about to be stripped and what we cannot strip because you typed it.

Fingerprint break (on by default) adds a random 1–2 % crop, a ±1.5 % brightness shift and ±1 noise on a sparse set of pixels. The result is that neither the file hash nor a hash of the decoded pixels matches the original you have on disk or posted elsewhere. It does not defeat perceptual or visual-similarity search; Google Lens will still find a near copy. Steganographic watermarks from generator tools are not removed either.

• Funding the drop from your main wallet puts your main wallet one hop from the treasury.
• Exporting the burner and sweeping it to your main wallet puts your main wallet one hop from the coin.
• A unique writing style in the description, or reusing an image from your socials, identifies you better than any transfer graph.
• Low volume on the launchpad weakens the pool. We do not pad it with fake launches.
• We can see the full picture while the keys are in custody. Export to end that.

Each drop quotes 0.050 SOL before any dev buy: 0.030 SOL creation budget forwarded to the burner, 0.00002 SOL for the two network hops, and a flat 0.020 SOL service fee kept by the treasury. Whatever the burner does not spend on rent and fees stays in the burner and is yours. Overpayment is forwarded to the burner too. Unfunded drops expire after 24 hours.

The claim key is shown once on your receipt. On the claim page it unlocks: collect, which has the burner call pump.fun's creator-fee instruction so fees land in the burner; forward, which moves the dev bag (Token-2022 transfer, destination ATA created if needed) and every lamport to an address you name while we still hold the key; and export, which reveals the burner's secret key as base58 and as a Solana CLI keypair file and deletes our ciphertext in the same database write. After export you collect fees directly on pump.fun with that wallet. Lose the key before exporting and the burner is unrecoverable; there is no account to reset.

Cashback coins. The drop form lets creator fees go to holders instead of to you. That is pump.fun's native holder-reward coin type: create_v2 is sent with is_holder_reward set, and the program ignores the burner as creator and installs the coin's holder-rewards PDA in its place, so every creator fee accrues to that vault and pump.fun distributes it to holders. It is a property of the mint and cannot be switched later. The burner still owns the dev bag and the leftover SOL, so forward and export work unchanged; collect is simply not offered because there is nothing in the burner's creator vault.

Vanishing deletes the dossier: the launch row, the claim-key hash and every claim event, in one transaction. It is a real delete, not a hidden flag, so afterwards the drop id and the claim key both resolve to the same "never existed" page a random string would. The coin, its create transaction and every transfer remain on Solana; nobody can delete those.

• Manual. The row stays until you press Vanish now on the claim console.
• On export. The moment you take the burner key, the dossier goes with it. The export response is the last thing the server ever says about the drop.
• 24 h / 7 d / 30 d. A dead-man timer counted from the create transaction. When it fires the row is shredded whether or not you exported the burner, and an un-exported burner is lost for everyone. The countdown shows on the status page, the board and the claim console, and you can retime or disarm it any time with the claim key.

Vanish now refuses while we still hold a burner or deposit key for the drop unless you type VANISH to force it. It also refuses while a launch is in flight, so funds are never orphaned mid-hop.

• Partial or late deposits. The status page shows what has arrived. Pay the rest from any wallet, or use the claim key to recover the balance to an address of your choice, which cancels the drop. The deposit key is kept for this purpose until the drop is swept or purged.
• Expired drops keep their deposit key for 7 days so a late payment can still be recovered, then the dossier is purged.
• Failed launches. If the create transaction never lands after five attempts, the treasury refunds everything it received minus the 0.00002 SOL of network hops — the service fee included — to an address you name. The refund is claimed in the database before the transfer so it cannot be paid twice.

The board lists drops that chose to be listed and are live, newest first, and refreshes every 30 seconds. Market cap and curve progress are read straight from the bonding-curve account on chain and priced with a cached SOL/USD spot; no pump.fun API is involved, so there is nothing to rate-limit or correlate. Stealth drops never appear. Vanished drops disappear from it the moment the row is gone.

The launchpad hides who made the coin. Supply exists because everything around the coin still points at you: the X account that shills it, the phone that passed the SMS check, the inbox that registered both, the connection that logged in, the domain that hosts the site and the card that paid for the promotion. We sell each of those in 6 categories and 19 items, and we sell them with exactly the mechanics of a drop.

1. We buy first. Every item on the shelf was purchased by us from a vendor or created by us before you ever saw it. The vendor was paid in crypto where the vendor allows it. They know an item was sold to Blackout; they do not know it was resold, or to whom.
2. It goes on the shelf encrypted. The credential line is AES-256-GCM ciphertext under the same off-database key as burner wallets. The admin table shows a masked first field and nothing else. Stock counts on the catalog are live reads of that shelf.
3. You pay a one-time address. Each order generates a fresh deposit keypair and a claim key, shown once. The quoted price is the item plus two network hops. Pay it from any wallet, exchange or bridge. There is no login, no email, no cookie.
4. Sweep, attach, reveal. When the deposit clears it is swept into the same treasury every drop flows through, and one item is attached to your order in a single database write so the same line can never be sold twice. If the shelf is empty you are not told "sold out": the order enters sourcing, we buy the item and attach it, delivered in 5 minutes to 1 hour. The order page is the delivery channel; it polls and flips to Ready the moment the item lands. Your claim key decrypts the line in the browser session that asked for it.
5. Shred. Once you have secured what you bought, delete the order. The row, the claim hash and the ciphertext go in one transaction, and the stock entry it pointed at is reduced to a masked label with no secret behind it.

What we can see. While an item is on the shelf and until you shred, we hold a decryptable copy. The vendor saw the line before we did. So: change every password you are handed, move 2FA to your own device, set your own recovery options and terminate other sessions. Items whose secret cannot be changed (a Mullvad number, a card) should simply be used and spent down. The after-reveal note on each item says what to do first.

What we store. Per order: product key, deposit address, the amounts required and received, timestamps, status, a SHA-256 of the claim key and the id of the attached stock row. No IP, no device, no name, no shipping address, because nothing is shipped. Refunds for expired or unfillable orders go to any address you name, minus the two network hops.

The cards are non-reloadable Visa gift cards in fixed denominations, bought by us at face value plus the issuer's activation fee, activated, and balance-checked on the day they are listed. The line you reveal is the card number, expiry, CVV, balance, a billing ZIP for address checks and the date the balance was verified. They are the ordinary kind you can buy in a supermarket; there is no cardholder name, no statement and no bank account behind them.

• Works anywhere Visa is accepted online, including ad platforms and SaaS tools that refuse crypto.
• Not reloadable, not withdrawable at an ATM, not usable where a name must match an ID.
• The issuer can see which merchants the card was used at, as with any card. It cannot see who holds it.
• Check the balance yourself on the issuer's site before the first spend; disputes on a gift card are the holder's to make and we have no copy once you shred.
• Pricing carries a markup over face value: it covers the activation fee, sourcing in crypto and our fee. The SOL price on the catalog is the whole quote.