The private order book on Solana, running on PER.

A public order book is a public target

On a normal on-chain exchange anyone can read the full book: where every order rests, how big it is, which account placed it, and which positions sit close to liquidation. Bots read it too. They step in front of large orders, push the price toward visible stops, and copy any strategy that works.

In March 2025 traders on Hyperliquid watched a single account's liquidation price and openly coordinated to push the market into it. Public reporting called it whale hunting. Traditional markets solved this long ago: dark pools carried 17.74% of all US stock volume in 2025, by Rosenblatt Securities' count. Large traders want to trade without announcing it first.

We built that for Solana: a private order book where your orders, balances and positions cannot be read by other traders, bots or anyone watching the chain.

What a Private Ephemeral Rollup is

MagicBlock's ephemeral rollups are fast execution layers on top of Solana. A program hands its accounts to the rollup, runs there at high speed with no fee per transaction, and can write results back to Solana when it needs to.

The private version, PER, runs its validator inside an Intel TDX enclave: sealed hardware whose memory the machine's own operator cannot read. On top of that, every account can carry a list of who may read it. An account whose list is empty can be read by no one over the network, while the program can still use it. That one property is what makes a private order book possible.

What happens to one order

1. 1

   You open an account without SOL

   Your trading account is created inside the rollup and paid for by a sponsor. There is no Solana transaction to sign and no SOL to find before your first trade.

2. 2

   Every order is signed by a new key

   Your account holds four one-time order keys. Each order uses one and names the key that replaces it, so no two orders share a signer. Someone listing transactions sees that something happened, but cannot link two orders to each other or to your wallet.

3. 3

   The order matches in its own transaction

   There is no matching loop and no operator queue. The program reads the book, matches against resting orders, checks margin across your positions, settles the fills and rests whatever is left, all inside the transaction you sent.

4. 4

   The book stays sealed

   Each market's book is an account with an empty reader list, and so is the ledger of balances. The program uses them; nobody reads them.

5. 5

   Your result lands in your private view

   A transaction that touches the book is an empty shell to everyone, so the program writes the outcome to an account only you can read. Even a refusal that depends on the book, such as a post-only order that would have crossed, is recorded there instead of being raised as a public error.

6. 6

   Trades print to a public tape

   Each fill is published with its price, size and time, plus two receipts. Your client recognises your own fills from secrets only it holds; to everyone else they are just trades.

What the market sees, and what it never sees

Prices still form in the open, so the market stays fair and checkable. What disappears is the information that lets someone trade against you before you have traded.

Exchange speed, inside the rollup

Median order, send to result, from a server in the rollup's region

4 ms

Needed to open an account and trade

0 SOL

Transaction per order, matched and settled in it

1

Measured on MagicBlock's devnet rollup with our own market makers trading: a median of 4.3 ms from send to result for a server in the same region, and under 30 ms at the 99th percentile. From a laptop in Europe an order completes in about a third of a second, most of it the distance to the server.

Spot and perpetuals, built like a real exchange

The order book runs spot and perpetual futures markets with cross margin, up to 10x leverage, limit and market orders, post-only and immediate-or-cancel. Funding is paid on the rollup's own scheduler. Liquidations are sized to bring an account back to health instead of closing everything, an insurance seat funds itself from fees, and open interest caps and price bands keep a market inside safe limits.

Every money rule lives in one matching and risk engine written in pure Rust, with no I/O, no heap and no clock, so the same rules run the same way everywhere. The program around it is an Anchor program, and the TypeScript client places an order and confirms it from your private view in one call.

Built for AI agents too

The order book ships with an MCP server, so an AI agent in Claude, Cursor or any MCP client can open an account, read the markets and trade on the private book with test money. Agents get the same privacy as people: their strategies stay out of the public book.

Why nobody built this before

Until recently a hidden book on Solana meant heavy cryptography, multi-party computation or zero-knowledge proofs, which is far too slow for a book of resting limit orders that match in milliseconds. So private trading on Solana stopped at private swaps and private transfers. MagicBlock's private rollup reached mainnet in March 2026 and changed what is possible.

Even with the right tool, a private exchange leaks in small places: an error message that reveals the book, a signer reused across orders, a book written back to Solana. We designed each of those out before writing the program. The result is the first order book on Solana where resting orders and positions stay private, running today.

Trade on it today

The terminal is live on Solana devnet with three markets: NSOL-PERP and NNVDA-PERP perpetuals, and the NSOL-NUSD spot market. Test tokens follow real SOL and NVIDIA prices. Create a test wallet, get test money and place your first private order in under a minute.

The program, the engine, the client and the MCP server are all published on GitHub, so you can read exactly what runs.