Aptos Deploys Encrypted Mempool to Shield Users From Bots

Aptos has activated an opt-in encrypted mempool on its mainnet, in which its own validator set, rather than a separate committee, decrypts transactions only after blocks are finalized.The feature, which went live on October 12, uses batched threshold decryption so that no single validator can read a pending transaction before block finalization.

Threshold Decryption Keeps Payloads Hidden Until Finalization

The upgrade follows governance approval of AIP-144 and ships as an optional feature that users activate on a per-transaction basis. Compatible wallets encrypt the transaction payload on the sender's device before submission. Validators then order blocks without seeing the called function, input parameters, asset types, or transfer amounts, Aptos confirmed. Sender addresses and network fees remain visible throughout the process. Once a block reaches finality, the validator set collectively decrypts the batch using a stake-weighted threshold. Aptos measured approximately 20 milliseconds of added latency per block across a 50-node test environment, within the sub-second finalization window of its AptosBFT consensus. The minimum gas-unit price for encrypted transactions doubles to 200 octas, with an additional 375 gas units charged for payload decryption.

Aptos Positions the Upgrade as Native MEV Protection

Aptos stated that "Bots use that visibility to trade against you or copy your strategy," framing the encrypted mempool as a direct counter to automated extraction.A breakdown describes the system as providing "payload privacy rather than transaction anonymity," drawing a distinction between concealing trade intent and concealing participant identity, according to a technical breakdown of the feature's design.Petra is the first wallet to integrate the encryption option directly into its signing flow. Decibel, a perpetual futures exchange built on Aptos, plans to adopt encrypted transactions for private pending orders. Encryption support ships in version 7.0.0 and later of the Aptos TypeScript SDK. Keyless signers and account abstraction signers are not yet supported.

Protocol-level Privacy Shifts the MEV Arms Race

Most blockchain approaches to maximal extractable value (MEV) protection rely on external services, off-chain relays, or application-layer workarounds that introduce additional trust assumptions. Building encryption into the consensus layer removes the need for a separate committee or relay network, but it also concentrates decryption authority within the existing validator set. That trade-off may suit networks with broad validator distribution, though it raises questions for chains where stake concentration gives a small group effective control over the decryption threshold.

Sandwich Attack Data Underscores Demand For Shielded Transactions

The launch arrives amid growing concern over automated extraction across major blockchains. Bitquery data covering roughly 11 months through early October 2026 recorded approximately 6.9 million sandwich attacks on Solana, extracting $29.7 million before trading costs.The activity involved approximately 2,545 bot wallets that targeted around 2.2 million wallets. ZKSecurity completed an independent security review of the Aptos encrypted mempool before the mainnet deployment.Aptos set an initial throughput target above 1,000 encrypted transactions per second under AIP-144, though encrypted capacity is expected to remain below the chain's unencrypted maximum. Adoption will depend on wallet integrations beyond Petra and whether decentralized exchanges route order flow through the encrypted pathway by default.