Privacy-preserving multi-token transfer