Skip to main content
Privacy tools attract impersonators: lookalike domains, fake tokens, “support agents” in your DMs. This page is the canonical reference. Bookmark it, and check anything that claims to be Cloak against it.

​
The one program ID

Cloak runs on exactly one Solana program: 
zh1eLd6rSphLejbFfJEneUwzHRfMKxgzrgkfwA6qRkW
This is the only Cloak program — if a site, token, or DM points you anywhere else, it is not Cloak. There is no “v2 contract,” no migration address, and no Cloak token. Anything selling you one is a scam.
SurfaceOfficial address
Appcloak.ag
Docsdocs.cloak.ag
GitHubgithub.com/cloak-ag
npm@cloak.dev/sdk
X@cloak_ag
If a link is not on this list, treat it as untrusted — including mirror sites, “official” community admins, and handles that differ from the real ones by a single character.

​
How to verify before you interact

Check the program ID. Before you approve any transaction, your wallet shows which program it calls. Compare it against the ID above — every character. You can also paste the ID into any Solana explorer (Solscan, Solana Explorer, and others) to confirm you are looking at the real pool before you send anything to it. Check the domain spelling. Phishing sites rely on near-misses: an extra letter, a swapped character, a different ending than .ag. Read the address bar character by character, and reach the app through your own bookmark rather than links from search ads, DMs, or group chats.
Bookmark cloak.ag and docs.cloak.ag now, while you are on the real site. A bookmark you made yourself beats any link someone sends you later.

​
What Cloak will never do

  • Cloak will never DM you first. No support agent, admin, or team member will ever reach out to you unprompted. Anyone who does is an impersonator.
  • Cloak will never ask for your backup file, seed phrase, or private keys. Your backup file is the money — anyone holding it can take your private balance. No legitimate support flow needs it, ever.
  • Cloak will never ask you to “validate” or “sync” your wallet. The real app asks your wallet to sign exactly two things, both on cloak.ag: its sign-in message and your own shield (deposit) transactions. Anyone asking you to sign anything else, or to connect your wallet on another site, is an impersonator.
If someone claiming to be Cloak does any of these, disconnect and report it privately to the team via contact@cloak.ag.

​
Where next

Honest FAQ

Straight answers to the questions people actually ask before using Cloak.

Security and what Cloak cannot do

The audit status, the threat model, and the limits we publish on purpose.