Public lending and savings have become some of crypto’s most successful products. Morpho’s deposits passed $13 billion in 2025, with counterparties like Coinbase, Crypto.com, and SG-FORGE. Aave’s new consumer savings app onboards through more than 12,000 banks and pays yield that compounds every second. When the experience is good, people are glad to earn onchain.
These products win on experience. They hide the machinery of the chain behind an interface that feels like a normal savings app. But the positions still sit on a public chain under the user’s own wallet, and pseudonymity is thin cover. Once a wallet is linked to a person, the balances and history are there for anyone to read. The privacy a user feels today comes from the app holding the link between them and their wallet, not from the chain ever forgetting it.
Today we are introducing Private Yield in TACEO Merces, our private finance solution for the chain you already use. Merces already powers private payments and Confidential x402, and Private Yield adds earning to the same private account. Positions stop being individually legible onchain, and no single party has to be the one place that knows who holds what.
What you would be integrating
Private Yield, available in TACEO Merces, gives each user a private yield vault that sits alongside their public and private accounts. Balances on the private side can earn yield without their positions showing up onchain, and without the app becoming the sole keeper of the link between a person and their money. It extends Merces from a confidential transfer system into a confidential earning system, using the same private-balance model as Private Payments and Confidential x402: balances are held as secret shares across the TACEO Network, every state change is cryptographically verified onchain, and the integrity of every update is guaranteed by the protocol. No party, not the app, not TACEO, not the nodes running the computation, can move a user’s funds or read their balance on their own.
For an integrator, this changes the shape of what you carry. The map between a user and the amount they hold moves into private shared state, where neither you nor anyone else can read who owns what. You still own the parts you should, onboarding and identity verification among them, but the link between identity and balance, today reconstructable from your records plus a public chain, no longer is. Your users get privacy without leaving your product, and you offer it while holding less of the sensitive data yourself.
How it works
Private Yield sits on top of Merces as an ERC-4626 vault whose internal balances are held as secret shares across the TACEO Network, the same way private transfer balances are. A user’s position in the vault is represented as vault shares (vUSDT). Shares grow in redemption value as the vault accrues yield. Both the share count and its underlying value stay private.
To the user, the flow maps cleanly onto an existing savings product:
Deposit. A user moves USDT from the public side of their account to the private side (USDT on Plasma testnet on the Merces app). Nothing leaves their control; the balance simply shifts from public to private. Onchain the funds join the encrypted Merces pool, and the user’s private balance updates inside the network.
Supply. From the private account, the user deposits into the vault. Their private USDT balance decreases and their private vUSDT balance increases. The vault contract holds the underlying pool in aggregate, and each user’s share of it is accounted for as encrypted state in the MPC network. Onchain, all anyone sees is the vault’s total balance, never an individual position.
Earn. As yield enters the vault, the redemption value of each vUSDT share grows, and every depositor earns proportionally to their (private) share of the total. The current testnet deployment generates yield with a simulated source that periodically tops up the vault at a fixed 7.5% APY, so the full mechanics can be demoed end-to-end. The vault is a standard ERC-4626 contract, so production yield sources like Aave or Morpho plug into the same interface; that integration is the next milestone.
Withdraw. The reverse path. The user redeems vUSDT shares back to private USDT in their Merces account, including any accrued yield. From there they can move the proceeds to the public side or keep them private.
A note on what “private” means here. Moving value between the public and private sides is a real token transfer, so that individual amount is visible at the moment it happens. What stays private is the standing position: the allocation, the size of holdings over time, the strategy, and the link between a balance and an identity. For flows where even the in and out amounts are sensitive, Merces can batch them so individual figures are no longer distinguishable.
Compliance comes with it
Privacy is only useful to a regulated product if it keeps the compliance story intact. Private Yield inherits the Merces compliance layer: contract-layer allowlists, authorized audit disclosure, reveal rules, and viewing keys apply to earning exactly as they do to transfers. An authorized auditor can verify holdings, activity, or eligibility for a defined scope without any single party having to store user identity and balance side by side. Pre-transaction policy enforcement with partners is on the same surface and shipping next. You keep the controls, and you carry less of the raw data.
A foundation, not a standalone feature
Private Yield shows up in the app as its own account: alongside a user’s public and private accounts sits a private yield account, funded with one tap from the private account and earning from the moment money lands there. But the account that matters is the private one underneath. It already lets users send, swap, and transfer privately, and Private Yield is the latest capability to plug into it. We wrote about how Merces became the backbone of our finance solution in Merces: Six Months In.
For an app, that is the real opportunity. You are not bolting on a single private feature, you are giving users a private side to their financial life, already able to send, swap, and now earn, that can grow into a complete product, with privacy as the default rather than something they have to leave your app to find.
Integrating it
TACEO Merces is API-first. Each deployment runs an onchain Merces contract with an ERC-4626 vault on top, and a client SDK (TypeScript and Rust) that handles intent signing and coordination with the MPC network. Your end users never see TACEO. They see your product.
For a builder, the line between what you carry and what Merces handles is clean.
You keep the user-facing product, the onboarding and identity verification flow, the wallet abstraction, and the decision about which compliance attestations a given user needs.
Merces handles the private balance model, the vault contract, all cryptographic operations (coSNARK proving, MPC settlement, onchain verification), and the encrypted accounting of each user’s share of the vault.
A yield integration sits on top of an existing Private Payments integration. The yield-specific surface is four methods:
client.vaultDeposit(amount): move private balance into the vault, receive vault sharesclient.vaultWithdraw(shares): redeem shares back to private balance, with accrued yield includedclient.getVaultBalance(): read your own private share countclient.convertToAssets(shares): read the current USDT value of those shares
Private Yield is live today on Plasma testnet. The reference app at merces.taceo.io/accounts/vault walks the deposit and withdrawal flow end-to-end. For the full integration guide, see the Quickstart and the How it works docs.
Try it
Private Yield is live in the TACEO Merces app, running on Plasma testnet. Read the Private Yield docs for the full picture, see where Merces is at six months in Merces: Six Months In, or reach out if you are building a product that should earn privately.
