Security

• The private link portion never reaches a server. The bearer portion of a claim link lives in the URL fragment, which browsers do not transmit. Claims are authorized locally in the recipient's browser.
• Claims are bound to their destination. The private portion signs an Ed25519 authorization over the chosen recipient. The signature — not the key — goes on-chain, so an observer or a malicious RPC cannot redirect an in-flight claim.
• You don't need the recipient's address. Funds are escrowed on-chain, so the sender can pay someone whose wallet address they do not know yet.
• One-time use. Each link can be claimed exactly once. A claimed, refunded, or expired-and-refunded link is permanently spent.
• Private notes stay in the link. The optional note travels with the private portion, not through any server.
• Time-bounded exposure. Every link has a hard expiry, after which it can no longer be claimed and the funds return to the sender's control.

• It does not hide the sender. The funding transaction is signed by and publicly attributable to the sender's wallet.
• It does not hide the recipient. The claim transaction publicly shows which address received the funds.
• It does not hide amounts. Escrowed and claimed amounts are visible on-chain like any other Solana transfer.
• It cannot recover a leaked link. If someone else obtains the full link before the intended recipient claims it, they can take the funds. Before expiry, there is no way to cancel a link.
• It cannot protect a compromised device. Malware that can read your clipboard, messages, or browser storage can read your links.

A funded Looter Link is a bearer instrument — like cash or a signed check made out to "bearer." Possession of the full link is the only thing required to claim. That has practical consequences:

• Whoever sees the complete link first can claim it. Share it with one person, privately.
• Messaging apps that sync to the cloud, generate link previews, or back up chat history create extra copies of your link.
• Screenshots, screen shares, and shoulder surfing expose the QR code and link just as effectively as pasting it publicly.
• Choose the shortest expiry that works for your recipient — a shorter window means a smaller theft opportunity if the link leaks.

Everything except the private link portion is public. Anyone inspecting the chain can see:

• the sender's wallet funding the claim account, with amount and asset,
• the claim account's address, balance, and expiry parameters,
• the claim or refund transaction, including the destination address and timing.

Observers can therefore connect the sender and the eventual recipient by following the escrow account. If that connection is something you need to avoid, Looter Links is the wrong tool.

Looter Links protects the recipient-selection process and allows bearer-style claims, but the basic escrow does not provide cryptographic unlinkability between deposits and withdrawals. Amounts, timing, the sender, and the eventual recipient are all visible on-chain and can be correlated. Do not describe or use Looter Links as an anonymity, mixing, or untraceability tool.

Expiry is enforced by the on-chain program, not by this website. After the expiry timestamp passes, claim instructions fail and only the creating wallet can move the funds, by executing a refund.

• Refunds return the full escrowed amount plus the claim account's rent deposit.
• Refunds require a transaction signed by the original creating wallet — keep access to it.
• Unclaimed funds simply wait in escrow. There is no deadline after which they are forfeited, but they remain exposed to anyone holding the link until expiry.

An audit is required before any mainnet deployment. This page will link to the published report when it is available.

Looter is not on mainnet. It runs on a local validator and on Solana devnet, where tokens have no monetary value and the ledger can be reset at any time, which would erase all claim accounts. Use it to evaluate the flow, not to store value.

Networklocalnet

Program address3tcaWbzR56FekYwHmFhezxmBdtHNV8sBezcTZz95VjHy

Upgrade authoritydevelopment key (multisig required for mainnet)