A router, not a venue.

Every swap starts as a quote request fanned out to seven independent providers — THORChain, NEAR Intents, ETZ Swap, Chainflip, Symbiosis, Mayan, and CCE.CASH — each with different settlement machinery, quoted in parallel so they compete for the route. The lineup grows as more venues prove out — reachable entirely over Tor is the bar for joining, winning the route is the bar for staying.

dexr ranks the answers on net received after fees and slippage, and shows the losing quotes next to the winner so you can see why it won. The rate you see is the rate the provider returned — no spread markup — and every quote carries a short expiry, so stale routes are re-quoted, never executed. Meet the five providers →

There is no dexr wallet, no dexr smart contract, no pooled liquidity with our name on it. When you accept a quote, you receive the provider's network vault address — or, on EVM routes, the exact contract call to sign — and pay it directly from your own wallet.

The consequence is structural, not promised: dexr cannot freeze, redirect, or lose your funds, because at no point does the money pass through anything we control. Settlement is performed by the provider's own validators or solvers, on public chains.

All server traffic exits via Tor. Quote requests, status checks, and RPC calls leave through onion circuits, so providers see a Tor exit — never your IP, and never a pattern of IPs belonging to one user. There is no clearnet fallback.

On our side: no accounts, no cookies, no IP logs — the rate limiter keys on nothing but one global counter per endpoint. Each swap does get a recoverable receipt — provider ids, deposit tx, destination, amounts — kept encrypted at rest for 30 days so you (or support) can recover it from any device after a wiped browser or dead PC, then auto-deleted. You can permanently delete it anytime in one click and get a signed proof; all that's left is the anonymized amount/outcome the volume counter already holds. The at-rest key is env-only, never on disk, so a stolen disk reveals nothing — we can read a receipt while running, which is exactly what lets us help you, and we'd rather say that plainly than pretend otherwise. No IP, no account, ever: it's "what swap", never "who".

The app also keeps its own order book in your browser's local storage, so clear it and the visit never happened. Fonts, scripts, and images are self-hosted — nothing here phones home either.

From the moment you pick a route, the swap gets a live tracker in your browser — a four-step rail (selected → deposit → swapping → settled) that refreshes itself over Tor and reads in plain language, never a raw status code. Chainflip and NEAR track themselves the instant instructions are issued; THORChain and Mayan start once you paste the deposit transaction hash; and Symbiosis, which publishes no status API, is followed by watching your receive address on the destination chain until the payout lands. The tracking data lives in your tab, keyed by the provider's own identifier — not in a database keyed by you.

Close the tab and you lose nothing: paste the identifier back in — the deposit transaction hash for THORChain and Mayan, the deposit address for NEAR, the swap id for Chainflip — and the tracker picks up from the chain, not from our memory.

The homepage shows two live numbers — swaps and volume — and there is no database of swaps behind them. A swap is counted only when the server itself re-reads the outcome on-chain, across every provider and even after you close the tab: while a swap is in flight the server watches its deposit reference — held in memory, never stored — until it settles. A payout to the receive address counts as swapped, a return to the sender as refunded; the dollar figure is priced at settlement and summed once, never re-valued at today's market.

The counters themselves keep only aggregates plus an anonymized recent-swaps list — amount, pair, exact value, outcome, and a minute-rounded time. No addresses, no txids, no IPs, nothing per-user; the list is capped at the latest 50 and wiped after 24 hours. It answers "what flowed through", and is structurally incapable of answering "who". (The one thing tied to a single swap is the 30-day recoverable receipt described under Privacy above — which you can delete at any time.)