Just how far into the weeds are you willing to go? This is a subject I could discuss endlessly. Privacy and security are things I find genuinely fascinating.
In the end, the level of security and privacy you achieve comes down to how far you're prepared to take things.
A few things to mention: (1) Forgive me if this wanders a little, it's somewhat of a stream-of-consciousness piece. I attempted to have Claude tidy it up, but the result was worse, so what follows is my own writing with nothing changed by ai. (2) I say "DEX" throughout, though frequently this isn't restricted to genuine DEXes. Plenty of different kinds of services exist that provide cross-chain swaps, and a lot of them aren't really DEXes even when they label themselves that way. For the purposes of this discussion, that distinction doesn't really matter.
If all you're doing is a SOL -> USDT swap on the SOL blockchain, you get essentially zero privacy from it. It's completely visible on SOL's ledger. It's no improvement over simply shifting SOL between wallets.
Should you want to head down the privacy road, you essentially have to bring Monero (XMR) into the picture. Something like BTC -> XMR -> SOL is possible. Routing it through XMR ensures there won't be any directly publicly visible or traceable route from BTC to SOL.
But that's when the real descent into the rabbit hole starts.
Suppose you perform BTC -> XMR -> SOL through a single DEX, all in rapid succession and all from the same browser on your machine. That DEX holds those records. Your IP is known to them. Your browser fingerprint is known to them. They can observe your BTC to XMR transaction and your XMR to SOL transaction. Those records aren't publicly accessible, but that doesn't guarantee they'll stay private forever. Data breeches occur. Data gets shared. Data gets sold. And obviously, if KYC is demanded, then privacy is completely gone.
So you choose to use one no-KYC DEX for BTC -> XMR and another for XMR -> SOL. Fine, now two separate DEXes hold records. Matching them up is harder, though not impossible. Should a single party obtain the logs from both DEXes, metadata still lets them correlate things.
A VPN is an option, or public WiFi. Browser fingerprinting remains a problem regardless. You might use separate computers or VMs for each leg of the transaction, each with its own VPN provider. Ideally one paid for in crypto and not tied to your real name either.
So....yeah. There are plenty of methods to help boost your privacy.
For the majority of people, BTC -> XMR -> SOL would be a solid first step. Ideally don't rush it, let the money sit in XMR for a while. Where possible, avoid matching the input and output amounts. So send $1k from BTC to XMR but then only $800 from XMR to SOL. On the next round, draw on some of the leftover XMR so that you send $1k from BTC to XMR but $1.1k from XMR to SOL. These are just example amounts, you don't need to leave much money in XMR. It's kinda volatile. Never reuse the same SOL destination address, obviously. You don't want to create a pattern. This gives good privacy against simple public ledger analysis, but won't help if someone has the DEX logs.
The next steps would involve using different no-KYC DEXes for each leg of the transaction. Use different VMs for each leg of the transaction. Use TOR and the TOR Browser if the DEX doesn't mind it. Use Mullvad Browser without TOR if TOR isn't permitted. Make sure you know how to use those browsers effectively so browser fingerprinting becomes far less useful. Use a different VPN for each leg of the transaction if TOR isn't an option. The VPN should be paid for with crypto and shouldn't carry your identity, naturally. If using TOR, use different exit points for each leg of the transaction.
Even after doing all of the above, there's no 100% guarantee your transactions will stay private. The more you do, the more private the transactions are likely to be. But the more time-consuming and difficult it becomes. Each person has to decide how far they want to go, and how much privacy they actually feel is important.
