Turning a backend engine into private trading

On chain, every large trade is public. Whales get copied or traded against, and that costs them money on every move. Our tech lead had already built an engine that splits volume across many wallets. My job was to turn that capability into a product a trader would trust with real money.

Role: Product designer, owned the product and UX layer

Task to beta: 2 months
Of it was final design: 2 weeks
Traders in ongoing research: 6

The Ghost account screen showing distributed volume across wallet nodes

Problem

Not a privacy tool, a private terminal

The engine worked, but nothing showed what a trader does with it day to day. So the ambiguity wasn't technical. It was what someone needs to see, control and trust before putting serious volume into it. Close analogs exist on the cryptographic side, using zero-knowledge shielding. Ghost takes a different bet. Privacy comes from how volume is spread, inside a normal trading terminal.

The engine pointed toward a separate tool you visit before a big trade. Deposit, split, withdraw, go back to trading. The six traders I kept talking to through the project wanted the opposite. Their normal terminal, with privacy as a property of every trade rather than a step before it.

Key decisions

Manage the volume, not the wallets

My first direction listed every wallet as a configurable row. It was honest and unusable. I moved the unit up to the account as a group of nodes, with random, even or Pareto distribution. An even split is itself a readable pattern, so distribution is part of how well the product works.

Before and after: a list of individual wallets vs the account-as-group model — Left: every wallet as a row. Right: one account, many nodes. Traders care about total volume, not rows.

Selection had to be sloppy

Checkboxes push people toward tidy picks, and tidy picks leak patterns. Wallets became a grid you drag across, so selections are fast and slightly arbitrary. I built a clickable prototype of it with AI, since drag-to-select can't be judged in a static file.

Wallets as a grid of squares with a dragged selection region — The usability answer and the privacy answer turned out to be the same answer.

Hide trades from the market, never from the user

I tried simplifying the wallet view and trimming trade history. Each cut left traders blind to their own money. I checked that call against the same six traders as it evolved, and the work went into hierarchy instead of subtraction. The trade itself reuses our existing buy and sell widget, so everything new stays in the privacy layer.

The full Ghost terminal showing volume distribution, wallet groups, and trade history — Dense by design. What shows by default, what's on demand, what appears only when something needs attention.

Cut the feature everyone would ask for

Moving funds between your own wallets was an obvious convenience. On chain, those transfers create exactly the link Ghost exists to hide, and the engine couldn't do it without a trace. It didn't ship.

Create Ghost flow with empty, insufficient-balance, loading and error states

Outcome

Ghost reached beta two months after the task landed. Two weeks went into final design, the rest into figuring out what to design. On a platform of around 2,500 monthly actives, it was a niche feature for the top segment, and early adoption came from exactly that group. Priorities shifted after beta, so there are no long-term numbers.

What's still unfinished

Rebalancing between your existing wallets without a new deposit never shipped. If a distribution gets lopsided, the only fix today is adding more funds. Gas management and wallet filtering also stayed manual.

Back