Security

How sendstables keeps your USDC under your control, and what can still go wrong.

Custody
Non-custodialYou sign every app transfer
Fees
Fixed at confirmSigned quotes, ~2 min
Token
Native USDCNo wrapped tokens or pools

Quick answer

sendstables is non-custodial: your USDC sits in your own Privy embedded wallet (or your own connected wallet), you sign every transfer, and funds move directly from your wallet into Circle's CCTP contracts — they never pass through a sendstables account. Quotes are signed by our server and the fee is fixed when you confirm. What you receive is native USDC minted by Circle, not a wrapped token. The main remaining risks are the ones inherent to USDC and CCTP (Circle's contracts and attestation service), Privy's wallet infrastructure, and sending to a wrong address.

Your wallet, your keys

  • Embedded wallets by PrivyKeys live in Privy's wallet infrastructure, never with sendstables.
  • You sign every app transferThe fee payment and the burn come from your wallet. No sendstables omnibus account.
  • AI agents only by opt-inPer-transfer and daily limits, own wallets by default, hashed keys, revocable anytime.

More on agents: AI agents.

Fees fixed at confirm, checked on-chain

  • Signed quotesHMAC-signed, valid ~2 minutes. The fee you see is the fee you pay. Our fee includes a service charge and covers the cost of running sendstables and paying gas on your behalf.
  • Circle's fee is cappedThe burn sets a maxFee, and the quote shows the minimum you'll receive.
  • Server checks before deliveryWe verify on-chain that the burn matches the signed quote and that the fee was paid.
  • Server-built Stellar and Solana txsStellar burns are built after your fee is confirmed; on Solana, fee and burn are one atomic transaction.

Native USDC, no wrapped tokens

USDC is burned on the source chain and minted by Circle on the destination. No sendstables token, no liquidity pool, and no IOU that depends on our contracts. See native vs bridged USDC.

Risks we can't remove

  • Circle and CCTPIf Circle pauses attestations, transfers wait. Circle can freeze USDC at specific addresses.
  • Fast Transfer allowanceIf it runs out, a transfer settles at standard speed. Some chains take hours (see below).
  • PrivyWallet access depends on Privy and your sign-in. Protect your email account and connected wallets.
  • Our relayerWithout Circle's Forwarding Service, a delayed relayer delays delivery. The burn stays valid.
  • Wrong address or chainTransfers are irreversible. Stellar recipients need a USDC trustline.
  • PhishingTransfers can only be made on sendstables.com. Copies elsewhere are not us.
  1. Circle's published standard-transfer attestation averages for the Fast Transfer chains we use: Base, Arbitrum, Optimism, Ethereum, Codex, Plume, Unichain, World Chain, X Layer ~15–19 minutes; Solana ~25 seconds; Edge ~16–21 minutes; Ink ~30 minutes; Linea ~6–32 hours; Morph ~20–30 minutes.
  2. Exchange deposit addresses must accept native USDC on that specific chain.
  3. Like any software, sendstables can have bugs. Start with a small amount on a new route.

sendstables is an independent app. It is not operated or endorsed by Circle, and it is not a bank; USDC balances are not insured deposits.

FAQ

Can sendstables move my USDC without me?

Not from the app: every transfer is signed by your wallet. If you turn on agent signing for AI agents, our server can sign on your EVM wallet only within a Privy policy you own and the per-key limits you set; you can revoke keys or turn agent signing off at any time.

What happens if sendstables goes offline mid-transfer?

Once the burn is confirmed and Circle has attested it, the transfer can still be completed. For EVM and Solana destinations the attested message can be submitted by anyone, and where Circle's Forwarding Service is used Circle submits it. Our delivery worker retries until the mint lands, and the status page lets you check or resume a transfer.

Is USDC from CCTP the same as USDC bought on an exchange?

Yes. CCTP mints native USDC issued by Circle — the same token you'd receive from Circle or an exchange that supports native USDC on that chain.

Can a transfer be reversed?

No. Blockchain transfers are final. Double-check the recipient address and chain; the app asks you to confirm the destination chain when you paste an EVM address.

Found a vulnerability? Email [email protected].

Related