Mine it with the GPU you already own, poke at the wallet, and if you still find it interesting a week or two later, that is your business. My guests did not object. Pavel Nikienkov even suggested people skip mainnet altogether and grab some testnet coins from a faucet, since the testnet "is ahead of the main chain" and already carries features that have not shipped yet.

That is a strange way to start a two-and-a-half-hour conversation, but Zano is a strange and fascinating project. The short pitch I had heard from Roger Ver, who name-dropped it when he joined me in S15 E26, is "Monero privacy but for tokens." The long version involves a hybrid proof of work and proof of stake chain, confidential assets that look identical to native coin transfers, a decade of tribal warfare inside the CryptoNote family and a pseudonymous cryptographer who used to sit at the next desk.

My guests were the two co-founders. Andrey Sabelnikov, better known on GitHub and Bitcointalk as crypto_zoidberg, wrote the original CryptoNote code base at Bytecoin, the project whose code would later be forked into Monero. He then built Boolberry, which became Zano. Pavel Nikienkov is the product mind who handles the roadmap and, as Andrey told me, "is the father of tokenization" in Zano. We were live in front of roughly 850 listeners, and the result was much spicier than I expected.

From CryptoNote to Zano

Pavel gave me the broad strokes. "Originally this story of Zano begins in 2014 with the first CryptoNote project Andrey launched," he said, and CryptoNote itself "was launched as the next iteration of Bitcoin aiming to fix the issues Bitcoin was having." Andrey went on to build his own CryptoNote implementation, Boolberry, which served as Zano's predecessor. Over the years the team added a hybrid consensus system and a long list of improvements, until a single-coin project grew into an ecosystem with "completely anonymous proof of stake and the privacy tokens, which we are calling confidential assets."

Andrey's own path into this world is the opposite of the usual Bitcoin origin story. He came from eight years in antivirus companies and network engineering, and he was skeptical when a company started talking to him about "virtual money that is like real but not central, decentralized. I didn't believe in this at all." What convinced him was a generous offer, "higher than market," and then the work itself. He got excited from the inside, learned open source culture on the fly and posted on Bitcointalk because that was all he knew to do. "Originally I didn't know anything about Bitcoin," he admitted.

A Hybrid That Leans Toward Stake

My research suggested Zano alternates blocks between proof of work and proof of stake, so I asked whether it is really a proof of stake chain. Pavel's answer was candid: both run at the same time, each covers the other's weaknesses, and "frankly speaking we would move to proof of stake if we ever were able to solve all the issues proof of stake is having." He called it "an uphill battle."

Andrey is the proof of stake evangelist of the pair, and he knows the other side intimately. The first project he launched was pure proof of work, and he says he "learned my lesson in a bad way" once he calculated how cheap it was to attack a small proof of work chain. Proof of work stays in Zano mainly to block long-range attacks, where someone buys up old, emptied wallets from former holders and uses those historical keys to rebuild an alternative chain from deep in the past. For the common attack, a reorg of 10 or 20 blocks, he believes stake does the heavy lifting: "proof of stake is the main power that holds and gives security to the blockchain."

He distinguishes two families. PBFT-style systems have a delegated group of large stakers who agree on the chain and can offer finality, at the cost of decentralization. Zano's model is "statistical": anyone can stake a block with a probability proportional to their coins, much like proof of work, so it does not give true finality but makes deep reorganizations extremely expensive. I pushed for numbers. Andrey said a new consensus upgrade proposal was under review and he had asked reviewers to calculate the cost of attack, but he would not quote figures yet.

Then I played the nation-state card. What if an adversary with a printing press quietly accumulates coins over two or three years? "Of course they can do it," Andrey replied. "There is nothing impossible." His point is that consensus design is always a contest of costs, and for a state, renting or ordering hash power is "way cheaper" than cornering half the stake of a coin whose price would explode the moment you started buying. As for renting GPUs to dominate Zano's proof of work, Pavel said the team tweaked Ethereum's ProgPoW specifically to keep the big mining farms from switching over, and he did not believe the coin was popular enough to show up on NiceHash.

What Happens If the Founders Get Arrested

Since both co-founders are public, I asked what would happen if someone held them at gunpoint and forced a malicious protocol change. Pavel was refreshingly unheroic: "I'm not going to say I would resist being tortured. I would say I would do whatever." The protection, he argued, is that users don't have to follow. There are no control levers, no central server, and every release is open source. "Whenever you see something shady going on, just do not install the update." The team deliberately ships no auto-update button for the node, which earns them complaints, but every binary has to be downloaded and can be built from source.

Andrey added a request I will repeat for the record: "please don't arrest us." The mobile wallet is a softer spot, since it lives under the team's Google Play account and nobody can verify what was uploaded. Pavel's answer to that problem is to hand mobile over to others. The team was integrating with Cake Wallet and Bitcoin.com, and Andrey said they would be "really happy if there is going to be more third party mobile wallets," so they can focus on the core code.

Bytecoin, Monero and an Old Grudge

The history was where the temperature rose. Around a decade before our chat, Andrey said, he was "hired to the project that actually built the CryptoNote protocol," wrote its first implementation and then left after "a very questionable launch." Once the source was published, others forked it into Monero, and the years that followed were what he called "tribal wars," with Riccardo "fluffypony" Spagni (who has since been a guest in S17 E8) as his chief antagonist. "We had a very negative story the first few years," Andrey said.

He was frank about why he quit Bytecoin. In his telling, the team built a genuinely new technology from scratch but misrepresented the coin supply in circulation and how much of it they owned. "I didn't like it and I quit Bytecoin because of this," he said, while insisting that the developers were not criminals and that we should separate "the business side of things and the technology."

I read out a recent tweet from Riccardo about the CryptoNote launch and the long-running claim that Bytecoin originated with the Russian Business Network. Andrey did not hold back: "This is absolutely stupid conspiracy that people keep bringing." His theory is that the early Monero crowd needed a villain to separate themselves from Bytecoin while their own project was still young.

He also has a list of specific grievances. In his view, Monero at launch differed from Bytecoin by little more than the one-minute block time, and he objects to fluffypony being called Monero's creator: "it's like calling Michael Saylor Satoshi Nakamoto." He accuses the early maintainers of stripping the original copyright from the source code and of branding CryptoNote's ring signatures as Monero inventions, and he says Wikipedia still describes Monero as an implementation of the whitepaper rather than a fork of running code.

These are his claims, and I present them as such. Even so, he gives Monero credit where it is due. From 2015 and 2016 onward, the community "started to do a really great job" gathering researchers around the project, and Andrey called Monero "the most successful project that built on top of CryptoNote," adding that he is proud his name is still all over the source code.

The thaw came through Douglas Tuman, who runs Monerotopia and MoneroTalk. He invited Andrey on his show, then to the conference, where Andrey met the current Monero developers. "For me it felt like all this negativity left behind," he said. Today Zano works with Monero researchers, and the anonymous proof of stake design was built with help from one of them, who was hired as a reviewer and "quickly started to throw some ideas."

My takeaway was the same one I have had about GrapheneOS and CalyxOS, Zcash and Monero, or the Wasabi and Samourai Twitter battles I joined a few times: privacy people spend an absurd amount of energy fighting each other. Pavel put it neatly. Privacy is "a tiny piece" of the crypto market and people fight over "some tiny percent of the market cap," when they should be fighting outside the niche "to convince people to join privacy."

The Man Behind Nicolas van Saberhagen

Then came the moment I had been waiting for. Andrey wrote the CryptoNote code, but he did not invent the protocol and refuses the credit. The cryptographer behind it, known by the pseudonym Nicolas van Saberhagen, "taught me basically all things about crypto back in these days." I asked whether this makes him the Satoshi Nakamoto of Monero. Pavel corrected me: he "came up with the math," while a business side ran and paid for everything.

Does Andrey know who he is? "Yeah, I know who he is," he said. "He was sitting next table to me." He still meets him a few times a year in different places, and he even invited him to attend Monerotopia incognito. Nicolas helped him build Zano's first proof of stake and the concept of a stake modifier based on key images, and he supported Andrey after he left Bytecoin, when the founder had effectively told everyone not to talk to him.

Back in 2014, as Andrey was trying to build a memory-hard hash function based on Keccak and doubting himself ("I'm not a cryptographer, why am I doing it at all"), Nicolas told him to keep going. That function became the basis of Boolberry. Andrey even sent him some Zano from the genesis block.

So is Nicolas van Saberhagen also Satoshi, as one popular theory goes? "I know it for sure that it's not," Andrey said. As for who thankful_for_today, Monero's original launcher, really was, Andrey declined, citing an NDA he signed when he left Bytecoin. He would only say that "the guy wasn't an average community person."

Is Zano Better Than Monero?

I demanded a yes or no answer, then made him wait through the ad break. Andrey came back with no short answer. The products are different: Zano is building a platform for others to build on, while Monero is "building a pure coin for paying the cup of tea." Monero has a deep bench of researchers and many eyes on its code, while Zano is smaller, takes bigger risks and makes faster decisions. Zarcanum, the hard fork that brought hidden amounts and private staking, was one of those risks. "I cannot even tell you how much risk we took," he said.

So I narrowed it down. If you send plain Zano, not a token, how does that compare to sending Monero? Here he did something I rarely see from a founder in front of a live audience. Monero, he said, has a longer history of hidden amounts, a bigger user base and more transactions, which means more decoys to hide behind, so sending coins "would be more private on Monero at this moment."

Zano's bet is that token transfers look exactly like native coin transfers to an outside observer, so a busy token economy should grow the decoy set quickly. Pavel finished the scorecard himself: "In terms of privacy, Monero is better," and in terms of liquidity too. I told them I respected the honesty, and I meant it.

Andrey did claim one clear win, consensus. He wants Monero to adopt proof of stake once it finishes full chain membership proofs, and he asked Douglas to organize a proof of work versus proof of stake panel at the previous Monerotopia so he could make that case. Peter Todd was on it, bringing "all arguments against proof of stake from 2014," and the moderator compared proof of stake to the banking system. Andrey was not discouraged. He asked Monero developers to review his new consensus proposal and made a bet on air: "in five or eight years they will switch to a new consensus model."

Private Tokens in Practice

The real selling point of Zano is its confidential assets, and Pavel was clear about the level of privacy they get: "It's the same level of privacy as the native Zano coins. There are literally no difference," except that fees are paid in Zano. His motivation was practical. "People don't pay for the coffee with Zano or Monero or Bitcoin. People pay for the coffee with stable coins."

The underlying math came from Zano's main mathematician, known as sowle, whose Zarcanum paper with koe describes proof of stake over hidden amounts, followed by a confidential assets paper that extends it to tokens. The team won't issue a private stablecoin itself, since that requires collateral and financial expertise, but wants to provide the tools, the way Ethereum gave stablecoin issuers the tools without issuing anything itself.

Of course I tested this myself. Before the show I minted a "Bitcoin Takeover Podcast Season 15 Episode 60 Airdrop Token" in the Zano wallet, 100 units, and offered them to listeners. An earlier experiment with a token I called Vlad coin had frustrated me, because I could not batch payments and had to wait for change to confirm before every send.

Pavel said that is "an interface issue": the command line wallet supports up to 30 outputs per transaction, and new mints now come pre-split into several outputs. Andrey explained the deeper reason. In a privacy chain the wallet cannot order transactions the way a Bitcoin wallet chains unconfirmed spends, so "you cannot send coins that did not get confirmed," and change takes 10 blocks.

Two other design choices came up from the chat. New assets show up as anonymous stars until you whitelist them, because otherwise people would spam wallets with slurs, scams and worse. "If you make a transaction on Ethereum network with a big amount of stablecoins, you are getting spammed with all kinds of crap," Pavel said. And when a listener asked how to send Ethereum privately through Zano, Pavel pointed to Confidential Layer, a decentralized bridge for wrapping assets from public chains onto Zano and back, distinct from the older Zano wrapped on Ethereum contract that the team holds keys for.

Zano also has on-chain aliases, so people can pay "@name" instead of a long address, and I made the mistake of comparing them to the Ethereum Name Service. Andrey bristled: "I created this in 2014 before even Ethereum was created." Then I reminded him of Namecoin, and a listener chimed in that Namecoin domains date back to 2011 and 2012. Andrey accepted it with grace: "that's my bad, so not the first." He simply had not been following other projects when he built it, since Nicolas explained everything he needed.

Tail Emission, Burned Fees and the Premine

Zano issues one coin per block forever, which is 1,440 coins a day and, as Pavel put it, about 2% a year that shrinks as the supply grows. Every fee on the network gets burned, whether it comes from transfers, alias registrations or marketplace offers, so sustained usage could even make the coin deflationary. Pavel was blunt about why Zano did not copy Bitcoin's halving curve: "the Bitcoin curve for a smaller project is a death sentence." There will never be enough fees to pay the miners and stakers.

Both founders want people to stop treating staking as a savings account. "Everything there is because of the security, not because we see it as an interest pay mechanism," as they explained it. That is why the mobile wallet does not stake and there is no delegation: "staking is the actual job," Andrey added, and the yield tends to settle around 3% to 5%. A listener asked about the dev tax. There isn't one, but there is a premine of around 800,000 coins held in a public audit wallet that the team stakes, funding itself mostly from the staking proceeds and dipping into the principal only for big expenses.

Fees came up because the 0.01 Zano I paid to send a token worth about 6 cents struck me as ironic, given that Roger Ver is one of the project's loudest supporters. Pavel said it was not a hard rule and that a fee market was planned for Q4 2024 or Q1 2025. Since fees are burned anyway, their only purpose is to stop spam.

Scaling a Private Chain

I asked what would happen if an entire nation of a million people showed up tomorrow. Andrey called scaling his concern "for ages," because validating private transactions is far more expensive than validating Bitcoin or Ethereum transactions. Zano's maximum capacity is around 12 to 15 transactions per second, according to old stress tests. The paths forward are optimizing (already pushed nearly to the limit), heavier hardware requirements or sharding. The fastest fix would be a PBFT layer with non-private validators, but he does not want it: "I would rather have it slow but completely decentralized and anonymous." I told him he is clearly not a marketer. "That's my only excuse, that I'm technical guys," he laughed.

On full chain membership proofs, the Monero upgrade that will replace small decoy rings with a much larger anonymity set, Andrey was genuinely enthusiastic. He met Luke Parker at Monerotopia when the idea was still considered impossible, saw a working proof of concept not long after, and promised to adopt it for Zano while keeping token creation intact. "It brings the whole family of the projects to a new level," he said. Tari, the Monero merge-mined token project, got a polite shrug. Pavel had not seen it ship, and Andrey was puzzled about proof of work until I found RFC-0132 on merge mining.

Bitcoin, Maximalists and Why Privacy Is Not a Crime

The designer who makes my YouTube thumbnails sent a question meant to provoke: why do they live in 2017, when people still believed altcoins had a future? Pavel answered with an offer: "If at some point Bitcoin will adopt the technology we are building, we would ditch right away whatever we are doing and work on Bitcoin." Andrey refused to be negative and said he likes Bitcoin, even if it is "not a very innovative project these days." His wish is simple: "I just hope that nobody screws up the project, nobody screws up the emission."

Pavel's critique of Bitcoin was sharper. In his view the ETF era has turned it into a wealth preservation story, and as long as the ledger is public, it lacks fungibility: "one Bitcoin is not equal to one Bitcoin," because an average person cannot check whether their coins once touched hacked funds. I agreed more than he probably expected. A fresh receiving address gives you decent privacy, but your privacy "only degrades over time" as you, or the people you transact with, make mistakes. I wrote about this in more detail in On The Limitations of Bitcoin Privacy.

The end goal, in Pavel's words, is to become "a digital cash platform," and Andrey wants to break the myth that privacy is for criminals. Ethereum users, he warned, will be surprised when all their transactions are tied to their names, and with AI, digesting that information is getting easy. As one of them put it, "people don't post their banking statements online," yet they happily do the equivalent on a transparent chain. The word criminal, they pointed out, depends heavily on geography. "Being a Russian citizen, I do a lot of illegal stuff just by existing," one of them joked.

Humble Founders, Real Risks

What baffles me about Zano is how it attracts supporters without any marketing charisma from its founders. Roger Ver backed it years ago, Andrey was shocked he even agreed to a call, and Aaron Day, who once debated me on behalf of Bitcoin Cash, now onboards people to Zano. Pavel's guess is that the CBDC opponents like private tokenization.

Andrey credits his link to Nicolas and a bit of Monero's reflected shine, while Pavel pointed to sowle's paper on anonymous proof of stake. "The fact that we haven't bailed on this thing for many, many years," Pavel added, "shows that we are not here just to get a quick buck." Compared with his first project, which he built alone in a toxic environment, Andrey said the last few years feel "so, so different."

The last serious question came from the chat. With the developers of Tornado Cash and Samourai arrested, how safe are privacy developers? "We don't know and we hope it wouldn't get to us," Pavel said. They write open source software and take no cut, but laws change. The one thing they can promise is structural: "We do not have a kill switch." Locking them up would not stop the network.

We ended in a much lighter mood. I sent tokens to Pavel's alias, @ravaga, and to Andrey's, @zoidberg, the real one, because "there are at least five of them" squatting similar names. We agreed, half joking, that only Nicolas qualifies as the Satoshi of Zano, and that Andrey is not Nicolas.

And I closed with the thought that this is technology which "could have been built on Bitcoin, but that's another story for a parallel universe where we could have had real cypherpunk money." The story continued later in S17 E3, when Andrey returned with sowle to talk gateway addresses, the move to full proof of stake and FCMP++. If you want to follow the project, the team is most active on Discord and the Zano X account, and the code lives on GitHub.

Listen to Andrey Sabelnikov & Pavel Nikienkov on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:54 – Introducing Andrey & Pavel
00:02:46 – What is Zano?
00:04:50 – Hybrid Consensus Mechanism
00:07:15 – Challenges of Proof of Stake
00:10:27 – Security Aspects of Consensus
00:13:13 – Cost of Attacks on Consensus
00:15:09 – Nation-State Threats
00:18:00 – Open Source Development
00:20:07 – User Control and System Integrity
00:21:24 – User Interface
00:21:51 – Decentralization in Zano
00:22:30 – Mobile Application Concerns
00:23:13 – Integration with Cake Wallet & Bitcoin.com
00:24:31 – Sideshift & Starkware
00:25:59 – Introduction to Zano
00:26:40 – Zano's Technology Overview
00:27:40 – History with Monero
00:29:51 – Collaboration with Monero Developers
00:31:44 – Background in Bitcoin?
00:32:55 – Nicholas von Saberhagen's Role in Monero & Zano
00:35:19 – Conspiracy Theories Surrounding Satoshi
00:36:02 – Support from Nicholas von Saberhagen
00:38:28 – Addressing Community Drama
00:40:24 – Defending Developers Against Conspiracy Theories
00:42:10 – The Negative Narrative Around Privacy
00:43:06 – Infighting in the Privacy Field
00:43:51 – Polarization Among Blockchain Projects
00:44:34 – Criticism of Proof of Work vs. Proof of Stake
00:45:51 – Historical Innovations in Privacy Projects
00:47:41 – Community Dynamics in Crypto Projects
00:49:34 – Privacy as a Niche Market
00:50:16 – Tribalism in Wallet Choices
00:51:13 – Misconceptions About Monero's Origins
00:55:14 – Support and Community in Early Crypto
00:59:38 – Comparing Zano and Monero
01:02:45 – Zano Token Issuance and Privacy
01:03:14 – Monero's Privacy Advantages
01:04:48 – Future of Zano's Privacy
01:05:29 – Appreciation of Honesty
01:06:18 – Liquidity and Usability
01:07:50 – Building Private Stablecoins
01:08:39 – Consensus Mechanism Comparison
01:09:45 – Debating Consensus Models
01:11:51 – Market Influence of Discussion
01:12:30 – Privacy of Issued Assets
01:14:51 – Zano Wallet Experiment
01:15:36 – Batch Transactions Limitations
01:19:18 – Technological Limitations Explained
01:20:34 – Decentralization and Project Economics
01:23:06 – Discussion on Monero Fees
01:23:30 – Zano's Emission Strategy
01:24:35 – Clarifying Staking Misconceptions
01:27:28 – Challenges of Scaling Zano
01:30:25 – Transaction Speed and Validation
01:33:59 – Future Plans for Fee Market
01:35:35 – Discussion on Zano's Fees
01:36:41 – Audience Questions on Tax and Premium
01:38:44 – Whitelist Functionality in Zano Wallet
01:40:31 – Confidential Layer Project
01:42:13 – Adoption of Full Chain Membership Proof
01:44:24 – Zano's Domain Name Feature
01:44:59 – Zano's Core Features
01:45:32 – Comparison to Ethereum Name Service
01:46:20 – Origins of Namecoin
01:47:17 – Skepticism About Bitcoin
01:49:20 – Namecoin Functionality
01:50:32 – Decentralization Trends
01:51:08 – Zano Fee Burn Rate
01:51:44 – End Goals of Zano
01:52:31 – Privacy Misconceptions
01:54:03 – Transparency in Ethereum
01:55:03 – Bitcoin Privacy Concerns
01:56:30 – Criminal Definitions and Taxation
01:58:17 – Living in 2017?
01:59:21 – Bitcoin Maximalism vs. Alternative Projects
02:02:00 – Current State of Bitcoin Privacy & Fungibility
02:06:10 – Future of Zano
02:08:10 – Competing with Monero
02:09:40 – Industry Influence on Zano
02:10:18 – Tokenization and Practical Applications
02:12:52 – Competition from Tari
02:18:54 – Community Support and Development
02:20:06 – Recognition Despite Size
02:21:06 – Legal Risks for Privacy Developers
02:23:12 – Final Thoughts on Zano
02:25:15 – Use Cases for Zano
02:26:16 – Market Value of Privacy
02:26:35 – Following Zano's Work
02:28:05 – Twitter and Engagement Challenges
02:28:47 – Sending Bitcoin Takeover Zano Tokens
02:29:35 – Mobile Wallet Features
02:30:07 – Caution with Impersonators
02:31:06 – Closing Remarks

The thing is MWEB, the MimbleWimble Extension Block. If you have followed the show, you have heard about it from the other side of the table: Charlie Lee pitched it here back in S11 E5, long before it activated on Litecoin in 2022. As I put it in my intro, the idea dates back to Andrew Poelstra in 2015 or 2016, "but it was just an idea. It was never coded. And this is the man who made it happen."

David is the Grin++ developer, the guy who wrote an entire MimbleWimble node in C++ for fun before Litecoin came knocking, and a co-author of the two Litecoin Improvement Proposals that define MWEB. He is also one of the most refreshingly modest privacy engineers I know, someone who flinches at the words "privacy coin" and openly admits he could screw up an implementation. Forty minutes was not a lot of time, but we covered Grin's rise and fall, stealth addresses, peg-out leaks, coin swaps, a multi-coin future and, inevitably, drivechains.

An Anonymous Drop, Refined by a Wizard

Before I could finish crediting Poelstra, David politely corrected the history. "It was actually even before Poelstra," he told me. "It was like an anonymous drop and then he refined it." That drop was the original MimbleWimble text, signed "Tom Elvis Jedusor" (Voldemort's French name, for the Harry Potter fans) and dated July 2016, which Andrew then polished into a proper paper. David also reminded me that Poelstra "also proposed the extension block" route for Bitcoin.

That stung a little, because I had interviewed Andrew earlier in the year for S15 E17, and he had told me roughly that it was cool to see Litecoin pull it off, but that MimbleWimble isn't very relevant for Bitcoin anymore in the post-Taproot era. I admitted to David that I was a bit disappointed. He shrugged it off with a line every Bitcoiner should tattoo somewhere discreet: "You know, fads that come and go for Bitcoiners. It was the greatest thing and then they moved."

He was careful not to call MWEB itself a fad, though. His hope is more humble and more interesting: "I hope that in 10 years from now we have really, really cool privacy tech and that maybe we'll be regretting our choice of MWEB, or maybe find a way to scale it."

How a Grin Developer Ended Up Working for Charlie Lee

The way I remembered the origin story, Charlie had been reading about confidential transactions created by Adam Back and Greg Maxwell at Blockstream, stumbled on MimbleWimble, and first tried to work with the team behind Beam. Only later did he find "this very smart Grin++ developer," which is Grin written in C++.

David confirmed the Beam part without any drama. "The Beam guys, I like them. They're smart people," he said. "They had so much they were trying to ship," and they simply did not have resources to dedicate to Litecoin. Meanwhile, David was looking for his next challenge. He had already done a lot with MimbleWimble, "but then we just had these small ecosystems" that "weren't really mature at all." What he wanted was to see the tech running in "a large, mature ecosystem, basically." Litecoin, with its exchanges, wallets and a decade of history, was the perfect lab.

MimbleWimble in Plain English

I asked him to break it down for people who have never heard of Grin. His explanation was one of the cleanest I have recorded. MimbleWimble, he said, is a clever combination of two ideas: confidential transactions, "which just means hidden amounts," and something like a CoinJoin mechanism that "combines all the transactions, all the inputs from one, from all of them, and the outputs from all of them into one big transaction to help eliminate the privacy leak that comes from transaction graphs."

Glue those together with "some clever proofs based off Pedersen commitments and just some really simple math, actually," and you get a chain where you can still verify that no coins were created out of thin air. Grin was the first implementation, built in a very cypherpunk way. "There were a lot of pseudonyms working on it," David recalled, and plenty of smart people from outside the Bitcoin community contributing. After almost three years, Grin was born.

Then it struggled. I reminded him how hyped Grin was at launch. In my memory, it was the most exciting grassroots privacy project since Monero, something purely driven by users. Then came a report claiming you could watch the network and surveil Grin transactions, and many people gave up on it. David's take on that moment is honest and a bit sad. Adoption was already slipping and big early supporters had left.

The report, in his words, "was sort of like stating the obvious," the equivalent of announcing that "if only one person is transacting a minute, I can tell only one person is transacting a minute." It was well written, but it "looked like a big hit piece," and for the people who were already struggling to stay interested, it was "the nail in the coffin."

I also passed along greetings from Marek Narozniak, the physicist who joined me in S15 E37 to talk MimbleWimble and quantum computing, and who very much looks up to David. Marek's one complaint was that David sometimes takes a month to reply to emails. David took it with a laugh: "I enjoy working with him. He's a very smart guy, too."

Why Boring Math Still Matters

So why is MimbleWimble still relevant in a world of fancy zero-knowledge rollups? Because it is boring, in the best possible way. It provides practical privacy "in a very scalable manner without introducing any kind of complex new primitives," David explained. "There's no like crazy SNARKs or anything like that."

That simplicity is a security argument. MimbleWimble is "very simple to audit, simple to understand for anyone with any kind of crypto background," whereas Zcash runs on "really fancy stuff" that requires putting a lot of faith in a small group of people. He acknowledged that ZK proofs have become more approachable lately, but "still there's nothing so simple," because MWEB is based entirely on the same cryptographic primitives that Bitcoin and Litecoin already use for everything else. No drastic security adjustment required.

Stealth Addresses and the Interactivity Problem

Here is where MWEB parts ways with Grin. In its purist form, MimbleWimble has no on-chain addresses at all. "One of the hurdles with pure MimbleWimble is that you can't just send to someone offline," David said. "You have to actually communicate with the person you're sending to, there's a back and forth protocol." Grin's addresses are really meeting points: the wallets first try to talk over a Tor onion address, and if that fails, you encrypt a packet, hand it over manually, and wait for the recipient to sign it and give it back. That interactivity "led to a lot of issues with adoption for Grin."

Litecoin could not live with that. Exchanges and wallets expect to send instantly to a static address. So MWEB adopted stealth addresses, "based off the stealth address technologies used in Monero and some other coins," where the sender generates fresh one-time addresses from a couple of public keys, so there is no address reuse. David admitted he had "serious concerns early on" about whether this would work with the existing ecosystem. It did, but not without homework: "We worked with some academics on it. We worked with some auditors," and in the end, "we were able to fortunately find a very good solution, I think."

The other half of the job was user experience. In Litecoin Core, he said, the focus was on making sure "first off it works seamlessly," so ordinary users don't need to know what happens under the hood, while also "choosing private defaults. Because if you just send whichever, whatever, you can lose the privacy benefits."

Counting the Kinds of Privacy

I tried to get him to grade MWEB on four kinds of privacy: sender, receiver, amounts and network level.

Network level was the quickest answer. MWEB doesn't "do anything particularly new there." You can run your node over Tor, use a VPN, and follow the same practices as with normal transactions.

Receiver privacy goes back to Satoshi. The whitepaper already says that a new address for every payment gets you pretty far, until you combine multiple inputs and give chain analysts a clue about who owns what. MWEB doesn't make input linking vanish completely, but it gets "much closer to Satoshi's vision for what good privacy would be."

Sender privacy, David said, is really about input selection, and it "would rely strictly on the sender making smart choices, which we always try to do the best we can for you." Litecoin Core leans on the research into coin selection algorithms, but "if you're an advanced user and you understand UTXO management," you'll do even better.

Amounts are the strong suit. "Yes, it's very good at that," David said, then added the caveat that makes him trustworthy: it is not perfect "because of the peg-in, peg-out mechanism." If you peg in and right back out, someone may be able to put a range on your amount. "But if you're using good practices and you're keeping your coins on the MWEB side," you end up with perfect amount privacy.

The Weak Link Is the Exit

I mentioned that Charlie once suggested CoinJoining into MWEB and CoinJoining back out. David said a peg-in already behaves a little like a CoinJoin, but whether it adds a real advantage "gets a little complicated." His advice is simpler: "The weak link there is the peg-in, peg-out mechanism," because you have to interact with the transparent chain, which doesn't have the automatic CoinJoin. "So the key to improving your privacy is always going to be limit main chain use."

I also asked a nerdy question I had never tested myself: can one transaction spend an MWEB input together with a regular chain input? It can, and it works nicely. You peg in and the MWEB transaction pegs out all in one go, so observers "don't even see the link from peg-in to peg-out."

When I brought up Wasabi Wallet's then-new feature that lets you pay directly from a CoinJoin, David got visibly excited. He mentioned that a coin swap service, where you hand over "a dirty UTXO" and get "a clean one that's mixed with lots of other users," could one day include a send to someone else at the same time. "There's a lot of interesting research into this."

Please Don't Call It a Privacy Coin

Naturally, I asked whether Litecoin is now the most liquid and most listed privacy coin. David squirmed. "I'm very hesitant to label anything privacy," he said, and pointed out that you can still screw it up. MWEB "has good privacy against many attacks," especially the practical ones everyday people worry about, but that does not mean you can do whatever you want. It's best, as he put it, "to understand what its capabilities are and what its limitations are if you want to really preserve your privacy." If you want to go deeper on that mindset, my essay On The Limitations of Bitcoin Privacy lands in the same place.

He did concede that among coins with serious privacy features, Litecoin would be the most liquid. Later, after the formal goodbye, he also gave me the sharpest distinction of the interview: privacy is less about liquidity than about the anonymity set. "The most important part of any privacy system is the anonymity set," he said, because if you are trying to hide by yourself, it's no good.

Swaps and a Multi-Coin Future

Would we see swaps between MWEB Litecoin and Monero? "Absolutely. There's already efforts to do that," David said, though he wasn't sure a successful swap had happened yet. He praised the Monero crowd for being "pretty good at swaps" and expected at least one wallet to offer swaps into Monero. (Cake Wallet, for what it's worth, shipped MWEB support not long after we recorded.)

I said that, as fun as it would be to have Bitcoin do everything, it seems unlikely at this point. David agreed: "As far as I can tell, it's always going to be a multi-coin future." His dream is that people won't have to think about which coin they hold. "You store your coins in whatever you're comfortable in," and when you pay, the wallet swaps it under the hood "in a decentralized and maybe not instantaneous, but relatively quick way. That's the goal."

Drivechains: Not Anti, Just Unconvinced

Full disclosure, which I also gave on air: LayerTwo Labs sponsored the episode, and they were trying to bring drivechains to Litecoin. I knew David wasn't a big fan, so I asked him to lay out his arguments.

He started by refusing the villain role. "I'm not the anti-drivechain guy." He has some concerns with the design, calling it "one of the hackier protocols I've seen," but says those could be solved. His real objection is about motivation: "My concern is that everybody just wants drivechains because they want drivechains." He has seen nobody say, "wow, this will help me do XYZ, I have this business idea."

Compare that with MWEB, where "the clear goal was privacy," or fungibility. Charlie didn't marry a technology either. He started with confidential transactions, then found MimbleWimble was even better and moved on. "Just going from finding a solution without a problem just seems like the wrong way to approach it."

The risk side is personal for him, since he would presumably be the one implementing it. "I don't have 100% faith in everything I do, so I could screw up the implementation and cause an issue." On a network this large and valuable, touching consensus code "without a clear benefit from it is an unnecessary risk." He has nothing against layer twos in principle and mentioned conversations with another team about adding a ZK proof verification opcode. What matters most is "having people ready and really wanting to do these things," and a community that sees a real benefit. "You can always experiment in lower value coins."

For the other side of the argument, Paul Sztorc made his case on the show in S15 E16, and Charlie Lee talked Lightning and payment coins in S15 E30.

Virtual Private Money?

My last question was a marketing one. Some in the community wanted to rebrand MWEB as VPM, Virtual Private Money. David's answer was perfectly on brand for a developer: "I'm not a marketing guy, so I'm gonna just keep writing code and let the community adopt whatever terminology they see fits best." He did find it a bit odd, since the addresses already carry an MWEB prefix and renaming would cause "another mess." And frankly, he likes the original name: "I've grown to like it over the years, so it seems odd to change it now without a good reason."

Then someone called him for the group photo, and that was it. If you want to keep up with his work, he says the best place is his X account, @DavidBurkett38, with the caveat that he is "very far behind on everything in life right now." The specs themselves live in LIP-0002 and LIP-0003, and the code in the Litecoin repository. It's a strange thing to say about a privacy engineer, but the most reassuring part of this interview was how often he admitted what his own protocol can't do.

Listen to David Burkett on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:55 – Introduction to MWEB and David Burkett
00:01:40 – Origins of MWEB
00:02:07 – Comparing MWEB to Bitcoin's Taproot
00:02:32 – Community Trends in Bitcoin
00:03:23 – Historical Context of Litecoin's Privacy Features
00:04:09 – Challenges in Development
00:05:03 – Explanation of Grin and MWEB
00:09:01 – Grin's Adoption Issues
00:10:06 – Marek Narozniak's Insights
00:10:48 – Relevance of MWEB Today
00:12:13 – MWEB vs Grin
00:14:23 – Technical Challenges of MWEB Implementation
00:16:28 – User Experience in MWEB
00:18:03 – Types of Privacy in MWEB
00:18:18 – Network Level Privacy
00:19:16 – Satoshi's Vision on Privacy
00:20:05 – Limitations of MWEB
00:21:07 – Sender Privacy Considerations
00:22:04 – Combining MWEB and Clear Chain Inputs
00:22:05 – Understanding MWEB Pegging
00:23:02 – Privacy Considerations in Transactions
00:24:45 – CoinJoin and MWEB Integration
00:26:46 – Liquidity of Privacy Coins
00:29:24 – Future of Swaps Between Coins
00:31:57 – Drivechains
00:35:02 – Risks of Consensus Changes
00:37:16 – Rebranding MWEB as VPM
00:38:37 – Anonymity vs. Liquidity

The timing was almost poetic. Client-side validation is an idea that Peter Todd wrote about many years ago, and the week we recorded, HBO's "Money Electric" documentary had just nominated Peter as its favorite Satoshi Nakamoto candidate. So, as I put it at the top of the show, we were talking about "a concept that was first created by someone who might just be Satoshi according to HBO," which was then made private with zero-knowledge proofs.

The lineup was a small dream team. Jonas Nick works on research at Blockstream and had been on the show once before, back in S6 E9 with Peter Todd and Alekos Filini. Robin Linus of ZeroSync and BitVM was making his second appearance of the season, after S15 E13. And Liam Eagen of Alpen Labs, a mathematician with great hair and an even greater beard, was joining me for the first time. What followed was almost two hours of shielded transactions, OP_CAT drama, block size heresy, quantum doom and, inevitably, rare Pepes.

What Client-Side Validation Actually Is

Liam took the first swing at the basics. A blockchain, he explained, is invented to prevent double spending, "but it actually does two things in the case of Bitcoin": it stops double spends, and it also validates every transaction published to a global public ledger. Client-side validation splits those jobs apart. Rather than putting whole transactions on chain, "we can keep them off chain and only put commitments to transactions on chain."

The catch is history. To trust a coin you receive, you have to check every transaction that came before it, and as Liam warned, "that history blows up exponentially over time." Another co-author picked up the thread and described how the receiver doesn't just verify one payment, but "essentially a whole graph of a whole tree of transactions." Without some cryptographic magic, the advantage over regular Bitcoin "is not particularly large."

That magic is recursive proofs. Shielded CSV builds on proof-carrying data, so every coin travels with a compact zero-knowledge proof that its entire past was valid. On the chain itself, each transaction leaves behind only a small piece of data that the paper calls a nullifier, which is enough to stop double spending and nothing more.

When I tried to translate this into pleb language by saying they were adding more state to Bitcoin, I got corrected immediately: "actually less state." Then came the elevator pitch I should have led with. The protocol "increases the on-chain throughput to about like a hundred transactions per second," and it hides both the transaction amounts and the transaction graph.

A Separate System That Still Needs a Bridge

One of the authors was honest about the elephant in the room. Shielded CSV borrows Bitcoin's blockchain for double-spend security, but "the Bitcoin system is a separate system." To actually bring privacy to bitcoin the asset, you need a way to move BTC in and out, which means peg-ins, peg-outs and a bridge.

That is where Robin's other famous project comes in. When I teased him about why there are so many versions of BitVM ("It's a hype topic," he deadpanned), he got serious quickly: "BitVM is definitely a real breakthrough because now we can build these bridges." Shielded CSV, he added, "would be much less interesting if we didn't have BitVM." A soft fork that allowed bridge contracts to be verified directly on chain could offer even better security, but that path depends on consensus nobody has yet.

As for how users would touch any of this, the answer was refreshingly unhyped. First they have to implement the protocol. Wallets come later. Atomic swaps between the Bitcoin main chain and Shielded CSV are supported in the design, and swaps with Lightning are possible too, but because shielded transactions are commitments in Bitcoin blocks, you still wait for confirmations. Instant, trust-minimized, Lightning-compatible shielded payments "are currently an open question."

Lightning as a Settlement Layer, Not a Consumer Product

Somewhere in that discussion, one of my guests dropped a line that will annoy a lot of Lightning maximalists: "lightning doesn't work for end users as well as people had wished." That, he argued, is why so many custodial solutions exist. But as a settlement layer between ecash, rollups, sidechains and protocols like Shielded CSV, "it can work really well."

I reminded everyone that atomic swaps across chains were one of the original Lightning promises, a way to trade Bitcoin, Litecoin and even Monero without centralized exchanges. It never really happened. The answer pointed at a known culprit: the free option problem, which makes "these atomic swaps quite quite problematic in practice."

How It Compares to Zcash and Monero

Naturally, I had to ask how a Bitcoin-native shielded layer stacks up against the privacy coins I keep bringing on the show. Jonas said that part of the motivation behind Shielded CSV was to show that there is "an alternative approach to private cryptocurrencies that seems to be better in many dimensions." The privacy is essentially the same as in Zcash, with "some very minor" differences, but with one huge advantage: "there are no big zero-knowledge proofs on the blockchain."

Liam explained why that matters beyond saving block space. Because proofs travel peer to peer instead of living on chain, you can use heavier proof systems. A STARK that would be tens of kilobytes is unacceptable for an on-chain transaction, but "sharing it peer to peer is a negligible additional cost."

Then came my contrarian question. Why bother building something this complex on Bitcoin when you could just swap BTC for Monero or ZEC? The reply was short: "People want to use Bitcoin, no?" The market has spoken about which asset is most valuable, and Bitcoin "should be used as a currency." Swapping into Monero and immediately back doesn't really work either, as one of them noted, because the round trip itself can be correlated on chain. You'd have to actually hold Monero, and "most people, I don't think, want to hold Monero just to get privacy."

OP_CAT, STARKs and the Covenant Wars

Since StarkWare was sponsoring the show at the time, and since they were loudly campaigning for OP_CAT, I asked the panel what they thought about STARKs coming to Bitcoin.

The first answer framed the debate in terms of bridges. Whether you use BitVM, OP_CAT with a STARK verifier, or something else, the criticism "is not an argument so much against STARKs per se, as it is against like the concept of the bridge in and of itself." OP_CAT would allow a proper STARK verifier on chain, but "that does have significant on chain costs."

Another guest went further and refused to call CAT a covenant proposal at all. "It is true that CAT can emulate covenants in a very clunky and expensive and weird way," he said, but if we want covenants, we should discuss real covenant designs like TXHASH or the introspection opcodes that exist on Liquid. His bigger worry is scope: CAT "enables everything in at least some clunky way," which makes it "hard to reason what it can do and what it cannot do." Still, the conclusion was constructive. Bitcoin needs some way to verify proofs eventually, because "proof systems are the future for sure."

Later I noticed that nobody had mentioned CTV, and I said so. The strongest technical argument against it, I was told, is "that it's actually too limited." For BitVM in particular, a covenant that can commit to inputs would remove the trusted setup, and CTV only commits to outputs. The wish list that did come up was the Great Script Restoration, which brings back the opcodes from Satoshi's original implementation, along with big integer arithmetic. "Anything that gets us closer to SNARK verification would make bridges a lot simpler and a lot more secure," as one of them summed it up.

The Taint Question and the Economics of Privacy

Of course I had to ask whether coins that pass through Shielded CSV would come out "tainted" in the eyes of exchanges and the Michael Saylors of the world. The answer: an exchange only sees "that they receive a valid coin," with no visible history. They can refuse shielded coins outright, but they can't single out the bad ones, because "all of them look the same to them." Exits from the shielded system might be visible depending on how you do them, but the regular notion of taint doesn't apply.

Then came the part I found most hopeful. If the protocol is widely adopted, nobody can be blamed for using it. And because it is a scaling solution as well as a privacy tool, users "contribute to the anonymity set in a pro social way." In his words: "It's not like more expensive to be private, it's actually cheaper."

Fees work through publishers, who batch shielded commitments into blobs, pay miners to include them, and collect fees from users. Regardless of how large the shielded transaction is, the commitment that goes on chain "is 64 bytes," far less than an average Bitcoin transaction, and that is where the speedup comes from. My dreams of fitting 60,000 transactions into 64 bytes were quickly crushed, though. To reach 100 transactions per second, "you would need to have a full block full of shielded transactions." The upside is that such a block is much cheaper for full nodes to verify than a block of normal transactions, and it doesn't bloat the UTXO set.

And if the receiver is offline? The sender can post the commitment on chain and leave the coin on a server, and if the server deletes it, the sender simply resends. That's a big difference from MimbleWimble-style protocols, where sender and receiver need back-and-forth communication and both have to be online in some sense at the same time.

Robin Asked God About the Block Size

This is where things got delightfully spicy. Because Shielded CSV transactions are so cheap to validate ("you just have to hash for them," with no signatures to verify) and don't load the UTXO set, Robin argued that "if that protocol catches on" we should think about increasing the block size. The bottleneck would become the network, but he believes networks will keep getting faster.

So I asked him for a number. "I asked God and God told me the perfect block size is of course 32 megabytes," he joked, before admitting that "it's up to debate." Another guest preferred caution: the environment is very different from the last time this question came up, so "I would rather see actual simulations and data before forming an opinion on that."

I used the opportunity for one of my favorite rants. People have been indoctrinated to believe that because Bitcoin rejected a block size increase back in 2015, it agreed never to raise it. In my view, many who said no back then objected to the terms and the pressure of the New York Agreement, not to bigger blocks in principle. With fees bound to rise, users deserve something better than "just use Liquid or just use custodial Lightning." I joked that I'd get my guests canceled for this conversation. I'm only half sure I was joking.

The block size also reappeared in the quantum section, because post-quantum signatures are much larger than today's. With a fixed limit, as someone pointed out, we might "only be able to fit one transaction per second into the Bitcoin blockchain."

Drivechains, Soft Forks and Rough Consensus

The sponsor read for LayerTwo Labs turned into an actual discussion about drivechains, the project that Paul Sztorc has been pushing for years and that I covered in S15 E16. The panel liked the general idea of exploring different ways to enable bridges ("BitVM is one approach," but "mostly like a clunky workaround to hack it into Bitcoin"). One guest didn't see drivechains endangering the main chain: users would decide whether they trust miners not to steal from a sidechain. The activation plan, however, "has a lot of potential for drama."

Jonas brought up rough consensus, which prompted me to admit that "I don't think anyone knows exactly what rough consensus means." The panel described the dilemma well. On one hand, if it were easy to change Bitcoin, "it would be very easy to attack it or to weaken it in ways that might be devastating," so the process must stay rigorous and slow. On the other hand, Bitcoin can't stand still while other chains innovate much faster.

Quantum Computers: Satoshi's Coins and Google's Hype

The quantum segment opened with a practical proposal: to protect Taproot outputs, Bitcoin needs a way to disable the key spend path, so that "even if you know the key you cannot spend from it, you can only spend from the script," and that script could hold a quantum-resistant signature scheme. A Rootstock developer had presented a Winternitz-style scheme in Frankfurt a couple of weeks earlier, which one of my guests described as "just a form of Lamport signatures essentially."

When I asked how imminent the threat is, someone immediately passed the ball: "Liam is the cryptographer here." Liam laughed that he's "not a quantum computer expert" and pointed to Scott Aaronson's recent warnings. The real problem in Bitcoin, the panel agreed, is that there's no plan that actually works yet.

We also went down the familiar rabbit hole of Satoshi's coins. Many early coins sit in pay-to-public-key outputs that a quantum computer could steal, while pay-to-public-key-hash outputs are safer until spent. Freezing vulnerable coins with a soft fork "could be considered stealing" too. One of them suggested a cleverer route: a protocol where you prove knowledge of the hash preimage and a signature without revealing them, "a snarky kind of post quantum solution."

Then the skeptics took over. Google, one of them noted, usually produces devastating results, like an AI that crushes a world champion and then a successor that beats the old system 100 to zero. On the quantum side, by contrast, they come up with "hand wavy, hype driven things" that "don't have much substance." Someone else pulled up the quantum records on Wikipedia: the largest number ever factored that way is 21. As in, three times seven. "Which is not very impressive."

Self-Custody, Threat Models and a TABConf Correction

After the Hodling.ch read, I asked what kind of setup an average long-term holder should use. "Complexity is the enemy of security, that's for sure," came the first answer. Twelve words alone isn't good enough, but "some multisig setup would be good, but like not some complicated thing." And it all depends on your threat model: if yours includes a malicious hardware wallet manufacturer, you need multisig or no hardware wallet at all.

That reminded me of a well-known developer who lost coins kept on an internet-connected server, reported it to the FBI, and whose case ended with a conference in Atlanta being asked for attendee email addresses. For the record, and Michael Tidwell made me promise to say this: it was not TABConf. Two of my guests had assumed it was. "Don't flame TABConf," we agreed, and someone added that it's awesome and they should sponsor the show.

Timeline, Business Models and the Federation Idea

How long until Shielded CSV exists as software? There's a big gap between a proof of concept and mainnet. The paper deliberately doesn't even pick a hash function. As one of them explained: "We just tell you the properties that a hash function should have." That research, along with choosing the recursive proof system, has to happen before implementation can really start.

Business model? This might be the least VC-friendly answer in my show's history. Transaction fees won't make anyone rich unless you process "billions and billions of transactions." One guest said flatly, "I don't believe in any bullshit business model that creates all kinds of bad side effects." Publishers could earn small fees, but "anyone can become a publisher," so it's "essentially a race to the bottom." The same goes for offline-receiver servers and BitVM operators. The purest path, they agreed, would be research grants.

One interesting alternative did surface. Commitments don't have to live on the Bitcoin blockchain; they could be sent to a federation while still bridging to Bitcoin, with trust-minimization tricks so that a coin confirmed long enough can't be stolen. That would mean no Bitcoin fee per 64-byte commitment and instant confirmations. My reply: there's a reason Liquid and Rootstock didn't get much traction. They're not really trust minimized.

They also confirmed that while their Rust specification supports a single asset, multi-asset support would be "quite easy," including Tether. Yes, technically you could mint Vladcoin on it. No, they don't see "a legit reason why you would add a token."

Why Client-Side Validation Might Be the Future

When I wrapped up by saying they weren't very good at selling their own work, one of them objected: "I disagree, by the way." Client-side validation, he said, "will probably be the future of blockchains, at least when it comes to payments," because "it's vastly superior to most other approaches." Global-state applications like AMMs are a different story, but for processing payments, it's the best approach we know.

So why the delay? "Without SNARKs, it's essentially a bit of a joke," because the history grows too quickly. Combining CSV with SNARKs "is what gives you the breakthrough," and it only became possible recently, with Plonky2 described as "probably the first proof system that is fast enough to enable client-side proving" on consumer hardware.

Liam, who was a little sick that day, admitted he also struggles with self-promotion, at which point a co-author jumped in: "I don't struggle with Liam promotion. Liam is awesome." Robin also clarified his views on proof of stake: classical proof of stake "tries to secure itself with itself which is kind of absurd," while Bitcoin-backed staking interests him because it uses an external resource.

Rare Pepes, Phil Zimmermann and Pieter Wuille Facts

No Bitcoin Takeover episode is complete without a detour. One of my guests' girlfriend draws rare Pepes for people, not inscribed or tokenized, just drawn, and we briefly wondered whether our numbers are prime. I used the moment to vent about a run-in with PGP creator Phil Zimmermann, who lectured me about Pepe as a hate symbol, which struck me as ironic given that PGP itself was once framed as dangerous technology in the hands of America's enemies.

There was also a lovely moment about learning. One of the guests said he answers every good question people send him on Twitter or Telegram, because that's how he learned: people like Pieter Wuille and Andrew Poelstra "were super approachable on IRC," and he feels obligated to pass that on. Which led me to confess that I'd tried hard to book Pieter Wuille, pitching him on reacting to the Chuck Norris-style facts website about him.

If you want to follow the project, the code and paper live on the Shielded CSV GitHub, and the paper's introduction and technical overview are, as they promised, "not too complicated." You can find Jonas as @n1ckler on X (he said I can call him Nick, but it makes him feel like he's back in the army), Robin as @robin_linus, and Liam under his own name. And if you watched this far, they asked for one thing: leave a comment with a shield emoji.

Two years later, this episode reads like a time capsule from the moment Bitcoin privacy research quietly got exciting again. If you want more Robin, go back to S15 E13, then jump forward to S17 E4 on BitVM optimizations, where Robin and Liam returned together.

Listen to Liam Eagen, Robin Linus & Jonas Nick on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:51 – Introduction
00:02:09 – What is Client-Side Validation?
00:04:20 – Trade-offs in Client-Side Validation
00:05:18 – Comparison with Existing Protocols
00:09:21 – On-chain Throughput and Privacy
00:09:55 – Connecting Bitcoin and Shielded CSV
00:11:07 – User Interaction with the Protocol
00:12:22 – Challenges with the Lightning Network
00:14:56 – Atomic Swaps and Compatibility
00:16:12 – Shielded CSV vs Monero & Zcash
00:19:28 – Discussion on STARKs
00:21:46 – OP_CAT and Covenants
00:24:03 – OP_CAT and Functional Encryption
00:25:21 – Exploration of BitcoinOS
00:26:11 – Potential of BitVM
00:28:21 – Bitcoin as a Currency
00:30:40 – Funding for CSV Projects
00:31:14 – Taint Concept in Shielded Transactions
00:34:08 – Adoption and Privacy Protocols
00:35:08 – Transaction Fees in Shielded Transactions
00:36:04 – Throughput and Base Layer Efficiency
00:38:12 – Node Behavior During Transactions
00:39:41 – Comparison with MimbleWimble
00:40:29 – Cryptosteel’s New Device
00:41:04 – Drivechains
00:43:51 – Concerns Over Soft Forks
00:45:04 – Rough Consensus Definition
00:46:15 – Challenges of Soft Fork Implementation
00:47:29 – Balancing Stability and Innovation
00:48:38 – Miner Incentives and Fee Structures
00:49:44 – Future of Post-Quantum Proposals
00:50:00 – Increasing Block Size for CSV
00:53:08 – Ideal Block Size Debate
00:59:02 – Quantum Computing Threat
01:00:24 – Potential Consequences of Quantum Attacks
01:02:23 – Post-Quantum Solutions
01:02:50 – Quantum Computing Timeline
01:03:31 – Complexity of Quantum Computers
01:05:44 – Quantum Records and Limitations
01:06:12 – Chat Question on Shielding Protocol
01:06:45 – Hodling.ch
01:09:15 – Self-Custody Security
01:09:58 – Threat Models in Security
01:10:33 – Hardware Wallet Cautionary Tale
01:12:05 – Conference Discussions
01:13:58 – Shielded CSV Funding and Development Timeline
01:15:29 – Prototype Development Outlook
01:17:31 – Concerns Over Adoption
01:19:34 – Scalability vs. Privacy Debate
01:22:04 – Tether on Shielded CSV?

01:22:22 – Revenue Models Discussion
01:23:25 – Transaction Fees and Profitability
01:24:16 – Publisher Fees in CSV Protocol
01:25:40 – Competition and Business Models
01:26:07 – Soft Fork Proposals for Improvement
01:27:30 – Script Restoration and Arithmetic Improvements
01:37:23 – Future of Shielded Client-Side Validation
01:38:44 – Keeping Up with Developments
01:41:05 – Self-Promotion and Team Dynamics
01:42:51 – Proof of Stake?
01:43:56 – Rare Pepes in Shielded CSV
01:46:18 – Acknowledgment of Guests
01:47:57 – Call to Action: Shield Emoji
01:48:07 – Importance of Learning Bitcoin
01:48:31 – Resources for Learning Bitcoin
01:49:26 – Commentary on Pieter Wuille
01:50:02 – Block Size Debate
01:51:05 – Optimizing Bitcoin for Global Use

So when we met again in the media room of the Proof of Work Summit in Frankfurt (thanks to Bob for organizing the event and letting us borrow the room), the mood was different. Citrea had just launched its testnet, Orkun had just given a talk on hyperbitcoinization, and he reminded me, with some pride, that "your podcast was the first one that we explained Citrea." In 33 minutes we went from the basics of rollups to ordinals, drivechains, StarkWare, ecash and the one change he would make to Bitcoin if he had a magic wand. He had also coached me on the proper pronunciation of his surname before we hit record, so any butchering that followed is entirely my fault.

Rollups vs. Sidechains, Explained Without Tears

I started with the question that every newcomer asks. What is a ZK rollup, and how is it different from a sidechain, which was the promised scaling solution for the longest time?

Orkun's history lesson was quick and clean. A sidechain, in the traditional definition, is just another independent blockchain, like Ethereum Classic or Litecoin, that happens to use bitcoin as its asset. The idea goes back to the Blockstream sidechains white paper of 2014, and in his view it "never taken off because there were a lot of problems with regards to their peg mechanism." A decade later, the peg is still the weak spot, because the sidechain remains "an independent blockchain" with its own miners or validators.

The rollup arrived in 2018, when Barry Whitehat of the Ethereum Foundation proposed using zero-knowledge proofs, which had been proven practical in Zcash and similar projects, to build something stranger. Instead of another chain, "you simply have a virtual blockchain" that executes transactions off-chain, produces a proof of execution and posts that data and the proof to the L1. The base layer does not have to repeat every transaction, and it finally knows what is happening on the L2, which opens the door to a trust-minimized two-way peg that "was previously impossible with sidechain idea."

His favorite detail is the security model. A rollup can run on a single computer that processes everything, but "that computer cannot steal money because there's a ZK proof protecting all the money." Pair that with Bitcoin, which he still calls "the most censorship resistance blockchain" despite some miner centralization, and you get the combo he is betting on: "you get cheap transactions, you get fast transactions and you still have censorship resistance." A sequencer with a cryptographic leash, in other words.

Why Bitcoin Needs a Rollup (Blame the Ordinals)

Rollups were born out of Ethereum's scaling crisis, so I asked him why Bitcoin needs one at all. Orkun's answer is that rollups are a generic technology, so much so that even Solana, which promised to do everything on a monolithic L1, now has them. As long as there is space on the base layer to post data, a rollup is "definitely more efficient than doing everything on the L1."

On Bitcoin, the trigger was inscriptions. Casey, the inventor of ordinals, found a way to put more data on the Bitcoin blockchain without changing it, and since a rollup is literally about posting data to the layer underneath, the conversation about whether you could build a ZK rollup on Bitcoin took off from there. Orkun was careful to credit the people who came before, including John Light, who had researched the topic earlier.

What surprised me is that Citrea's origin story is not about transactions per second. When the team started thinking about it, around February or March of 2023, "it came from scaling Bitcoin in terms of features." People were buying, selling, lending and borrowing ordinals directly on the L1, which he calls "extremely inefficient." It annoyed both camps.

The monetary maximalists watched their UTXO set get bloated with arbitrary data, and ordinals users suffered through three to five transactions just to make a trade. Citrea's pitch was to embed a generic EVM-style virtual machine into Bitcoin without changing Bitcoin, so that the ordinals crowd can do more powerful things off-chain, the UTXO set stays small and less data lands on the L1. Peace through compression. I like it.

Trust Minimized, Not Trustless

Here I asked the question that had followed Citrea since day one. If I understand correctly, it does not use BitVM the way some other ZK rollup builders planned to, so how does it actually work?

Orkun split the problem in two. The rollup itself is a generic machine that produces ZK proofs and sends them to the L1, so every full node of the rollup can look at Bitcoin and verify those proofs. Bitcoin Script does not need to verify anything for that part. The second problem is the bridge: Citrea wants people to use real bitcoin on the rollup, not some other asset.

That is where BitVM comes in, and Orkun was honest about the guarantees. BitVM makes the bridge "trust minimized not trustless," because it emulates a ZK verifier with a one-of-n trust assumption. With a covenant like OP_CAT, he said, "we can actually build a ZK verifier" directly in Script and have fully trustless ZK rollups on Bitcoin.

(For the curious: Chainway's BitVM-based bridge is open source under the name Clementine. Orkun did not name it in this episode, but it is the work he means when he says one of his teams is focused on ZK verification on Bitcoin.)

That distinction matters, and it is the kind of nuance that earned the project its grudging respect from people like Robin Linus, who invented BitVM and had been among the skeptics before he came around.

Seventy Layer 2s and Only One Real Rollup?

I reminded Orkun that, after Citrea's launch, a whole wave of self-described Bitcoin L2s appeared, Alpen Labs among them, and that I had heard surprisingly little from most of them since. He pointed me to Bitcoin Layers as the place to compare them, and offered a sobering count: around 70 or 80 projects claim to be Bitcoin L2s, probably half of them say they are rollups, "but if you look at the technology it's not a rollup."

His claim, which I am reporting rather than certifying: "if I'm not mistaken today we are the only real rollup" that is working, has an open source code base and runs on testnet. He was friendly about Alpen Labs, whose team members were at the same conference, but noted that their product was not live yet and, as far as he knew, not open source, so "I cannot verify whether they're building a rollup or not."

I also brought up Edan Yago of BitcoinOS, who had claimed that his team was the first to verify a zero-knowledge proof on Bitcoin. Orkun did not dispute the milestone. He said they may well have been the first to verify a ZK proof with their BitSNARK framework, but "building a ZK rollup and verifying a ZK proof is not very correlated." Inside Chainway, he explained, those are two separate teams, each with more than eight or nine people. Building the rollup is a lot of work. Verifying a proof is one piece of it.

What Does a HODLer Actually Do With Citrea?

This was my favorite question to ask, because most bitcoiners look at all this fancy tech and have no idea how they would use it. Orkun said I was the first podcaster to ask him which wallets people should use, and admitted that builders often assume everyone knows how to use EVM wallets. They don't. Most people at the summit, him included, were using Lightning and Bitcoin-native wallets.

So he compared Citrea with Lightning. On Citrea you get an address derived from your seed phrase, fully non-custodial, and "it's a really static address that you can share with anyone." Nobody has to create an invoice and wait, you can receive payments even when you are offline, and you never have to think about inbound or outbound liquidity. You just have an account with an address and a balance.

But payments are not the point. The real pitch is smart contracts, and Orkun's example is painfully familiar. You don't want to sell your bitcoin, but rent is due, so you hand your coins to a custodial lending desk and hope.

"Who knows whether you can get your Bitcoin back," he said. On Citrea, the lending, borrowing, stablecoin and even private payment applications can be smart contracts. I summarized it as BlockFi, the lender that went bankrupt, rebuilt as code you can audit instead of a company you must trust.

He agreed: "it's a code that everyone can see and everyone can audit." If the conditions are never met, "the Bitcoin never leaves that smart contract." His shopping list for the ecosystem: think BlockFi, think Coinbase, think perpetual DEXes, think prediction markets, all built in a non-custodial way on Bitcoin.

My Sponsors, His Competitors

Then came a slightly awkward moment that I had engineered on purpose. Two sponsors of my show at the time were, in their own ways, competing with Citrea, and I wanted Orkun to explain the difference on air.

The first was LayerTwo Labs, which is building drivechains to deliver sidechains close to what was promised in 2014 and 2015, one sidechain per use case. Functionally, Orkun conceded, the two approaches are not that different. Someone will build an EVM sidechain and get similar features. Security is another story. Drivechain assumes miners are honest about approving withdrawals, and that is independent from them being honest about mining Bitcoin. "It's a different trust assumption that I don't like," he said. Citrea, in contrast, sends all its data to the Bitcoin blockchain itself, not to some other chain.

He was also skeptical about drivechain's chances. It depends on a BIP, which means a soft fork, and "I'm very suspicious that it will ever get accepted." By his count the proposal has been around for six or eight years without significant support, compared with the attention OP_CAT and CTV get, and he mostly sees Paul Sztorc (and sometimes Robin) pushing it. Paul would certainly disagree, and he made his case on my show in S15 E16.

The second sponsor was StarkWare, whose Starknet also relies on zero-knowledge proofs but needs OP_CAT to settle on Bitcoin. Orkun started with respect: StarkWare are the pioneers of STARK proofs, and "we have like a lot of respect to them." Then came the technical disagreement. StarkWare plans to settle on both Bitcoin and Ethereum, and he is not convinced.

"I don't think that's going to work well," he said, because in case of a malicious fork on either chain, "you can just lose your assets." He also pointed out that Starknet uses its own VM, which, despite some creative applications, has not taken off after about three years live. The EVM, on the other hand, comes with documentation, videos, guides and hackathons.

His biggest argument was about timing. Citrea is live on testnet "even without" a covenant, so "we don't depend on any soft fork." First show bitcoiners that they can borrow against their bitcoin without losing custody, and then let them decide whether a soft fork to make it trustless is worth it. In his words, "first getting live and showing a use case to bitcoiners is important for social consensus."

I added that the coolest part about both sponsors is that they let me criticize them in interviews. Orkun's verdict on the competition was generous: "better options, better competition, better products and that's that's good for Bitcoin."

The Road to Mainnet

Asked about the future, Orkun warned me it is a long-term goal with a lot of work ahead. After mainnet, Citrea plans to introduce decentralized sequencers to reduce the trust in the sequencer and raise censorship resistance. Then comes native account abstraction, which lets you program your own account cheaply, for example to block yourself from spending more than 0.01 bitcoin per day, "and that's all in your control." Finally, a volition model would offer even cheaper transactions by skipping Bitcoin for data availability and relying on Citrea's peer-to-peer network instead. That adds a trust assumption, but it is optional.

None of that matters without users, and he said so himself: "if you build all this stuff and we don't have any use case then it means nothing." The end goal is to have applications ready for bitcoiners, with various trust assumptions, but always non-custodial.

As for what changed since our February chat, the answer was a lot. "Six months ago Citrea was merely a design and proof of concept code base," as he put it. Since then the team announced a fundraise, open sourced its code on GitHub, started accepting outside pull requests ("we accept PRs"), contributed to the BitVM repos, funded research grants at local universities and shipped a devnet followed by the testnet. The testnet, which shows exactly how much Bitcoin block space Citrea uses and what fees will look like, is "probably the biggest milestone that we had so far." Mainnet was next on the list.

A High Five Against Ecash

Orkun had just presented on hyperbitcoinization at the summit, framed around bringing bitcoin back into the economy without custodial shortcuts. Next on his tour were Hackers Congress in Prague and Bitcoin++, and along the way he planned a presentation on why ecash is so bad and ZK is better. He expected "a very interesting crowd," and I believe him.

I asked if I could high five him for that part, and I did. His argument: ecash "was a great experimentation 40 years ago but not anymore," because "we have Bitcoin which is better digital money," and now people are turning it back into a custodial solution with excuses like using small mints for small payments. He sees the same custodial gravity in Lightning's requirements, and blames it on the lack of primitives to build directly on Bitcoin.

On privacy, he kept it modest. Citrea is a public ledger, much like Bitcoin, but with a full VM people can build private systems on top, such as dark pools, private payments or something like Tornado Cash. "I'm not promoting" any of it, he said, but "privacy is needed for the future," and Citrea's job is to be generic infrastructure that "doesn't promote like or demote anything."

If He Could Change One Thing About Bitcoin

My closing question is always the same: if you could add any BIP, soft fork or hard fork to Bitcoin, what would it be? Orkun warned me up front, "I have a lot of bias on this," and then said that ZK proofs should have been discussed much earlier, because Bitcoin has problems with privacy, verifiability and small block space.

He reminded me that zero-knowledge proofs were introduced in 1985, older than Bitcoin itself, and dated the first practical implementation to Zerocash (he said 2012, though the Zerocash paper came out in 2014). His wish is a ZK covenant or a "pay to ZK address" type in Bitcoin, "because it can solve a lot of problems with privacy and scalability." Then he laughed it off: "that's my biased answer."

He also had a softer wish. He likes Bitcoin's culture of overwhelming consensus discussion, but "I wish like people just listen each other more carefully," and he would prefer upgrades to come every two years or so instead of taking this long.

Looking back, this interview captures Citrea right at the moment it stopped being a promise and became a testnet you could actually poke. Two years later, the Chainway crew is still on my show: Ekrem Bal of Citrea stopped by my TABConf 8 livestream in S17 E47 to explain the project's pivot to privacy. If you want the origin story first, start with S15 E18, and then come back here to see how the people who called it a scam ended up eating their words.

Listen to Orkun Kilic on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:02:02 – Rollups vs. Sidechains
00:04:18 – The Need for Rollups in Bitcoin
00:06:29 – Citrea's Unique Approach
00:08:08 – Building a Generic Virtual Machine
00:09:10 – Citrea as the First ZK Rollup on Bitcoin
00:09:56 – Comparison with Other Projects
00:12:08 – Use Cases for Average Users
00:14:44 – Citrea & Non-Custodial Financial Services
00:16:30 – Citrea vs Drivechains
00:17:05 – Differences in Trust Assumptions
00:18:14 – Drivechain Proposal History
00:19:13 – StarkWare and Zero Knowledge Proofs
00:19:35 – Technical Limitations of Starknet
00:20:24 – Building Non-Custodial Solutions
00:24:05 – Future of Citrea and Decentralization
00:26:14 – Progress Since Last Interview
00:28:03 – Presentation on Hyperbitcoinization
00:29:37 – Privacy Benefits of Citrea
00:30:49 – Potential Changes to Bitcoin

The first time we met, we shared a panel at Mallorca Blockchain Days 2021, alongside Amir Taaki and Joshua Scigala. I admitted to him on air that my first instinct back then was suspicion. "This guy used to be a banker, why should I trust what he says?" But here was a man who wanted to decentralize central banks and do economics by looking at data instead of reciting ideology.

I had wanted this interview for a year, and in 2024 it finally happened on the sidelines of a conference where he had just debated an Austrian economist on stage. In 51 minutes we covered why banks literally create money, why CBDCs are a hostile takeover of the banking system, why I still pay for bread in cash, and his forensic (and spicy) reading of the collapse of Silicon Valley Bank.

Why a Central Banking Insider Likes Bitcoin

My opening question was simple: why does he like Bitcoin? His answer was not about number go up. Werner has spent years looking for alternatives to a system in which central bankers act as central planners, and he says that system "has created a lot of problems for a lot of people." In his words: "it's the central planners' dominance that's been the issue."

Bitcoin, for him, is intriguing because it is "seen as a way of having some more decentralization and having alternatives to the current central banking dominated system." That is a cautious endorsement, and it is worth noticing the word "alternatives." He is not a maximalist who thinks one coin fixes everything. He is a decentralist who sees Bitcoin as one tool among several, and that framing runs through the entire conversation like a watermark. A man who studied central banks from the inside does not want a new monopoly, even a digital one.

Banks Make Money Out of Nothing (and He Proved It)

I asked him what is wrong with central banks, and mentioned that he might have been the first economist to show that private banks are the ones creating new money when they issue loans. He pointed me to two papers. The first is his 2014 empirical study, "Can banks individually create money out of nothing?", and the second is "A lost century in economics" from 2016. Both are, as he put it, easy to find and free to read. In them, as he told me, he could show "that when banks give a loan they create money out of nothing."

This sounds like something every bitcoiner already "knows," but Werner insists it was controversial and disputed by mainstream economists, journals and textbooks until he tested it empirically. Even now, some still debate it. His conclusion is calm: "Banks are special, they have a special power, namely to create money." And he treats that power the way an engineer treats a tool. "Like any tool, tools can be used for good and for bad," he said. He has watched it used for bad "quite a lot," but believes small local banks can point it toward good.

The twist comes next. Once his studies were out, he says, the central planners acted surprised, as if they had just discovered this, and their conclusion was to "quickly abolish this" and "take away that power from ordinary people." Their goal, as he sees it, is to drive banks out of business so that only the central bank survives, with a central bank digital currency as the vehicle. Which brings us to the scariest three letters in this episode.

The C in CBDC

Werner's definition of a CBDC strips away the marketing. A central bank digital currency is "ultimately the offer by the central planners for you and for me and for everyone to have an account at the central bank." In other words, the regulator starts competing with the banks it regulates. That, he argues, explains 20 years of anti-bank policy: they were "already planning to compete against them." If we allow CBDCs, "ordinary banks and small banks" will be driven out of business until only the central bank remains. His verdict did not need any embellishment: it "gives totalitarian powers to technocrats over our daily lives of an extent that's unprecedented in human history."

I brought up something Ben Arc had told me at the same conference, namely that CBDCs could offer some confidentiality for small payments, say up to 100 euros. I also listed the dystopian features: programmable restrictions, helicopter money you can only spend on approved products, and the Canadian truckers who got their bank accounts frozen. Was it a paper tiger?

Not at all. "We should definitely be worried about it," he said, and then went further than most economists I know would dare: "we need to stage demonstrations in front of central banks against central bank digital currencies." Peacefully, he stressed, but strongly and clearly. As for the privacy promise, "I got to laugh when I heard that," he told me, recalling Christine Lagarde's sales pitch. Cash will always be more private, and privacy up to 100 euros is, in his sarcastic phrasing, "very generous." Even a 100% privacy setting would be a mirage: "That's a joke, right? They're in control. They can press the button and from tomorrow it's suddenly not private anymore."

He also dismantled the claim that CBDCs are a response to Bitcoin. We have been using digital money for decades through bank transfers, cards and PayPal. Bank digital currencies are old news. "What's new is the C," he said, "the centralized aspect, which is only good for the central planners." So he proposed a simple test. Before central bankers even study a CBDC, their own daily transactions should become visible to all of us, and we should get to vote on what they are allowed to buy. "You do it first, guys." His prediction for how popular that would be: "I think it would be quickly off the table." I would buy a ticket to that vote.

RFK, Blockchain Budgets and the Red Lines

At the time of our conversation, Robert F. Kennedy Jr. was running for president and kept talking about putting the US budget on a blockchain so every transaction could be audited. I told Werner that this sounded to me like a Trojan horse. What currency would run on that chain? Something issued by the government or the Federal Reserve, not private money. It felt like a way to open "the gates of hell for making CBDCs more acceptable."

He agreed, and he did so with some regret. "I like him as a person," he said, and he found most of Kennedy's policy ideas sensible, but this was "definitely one of them," the areas where he disagrees.

He wondered aloud whether Kennedy's running mate, whom he described as "somewhat connected to Google in some ways," had anything to do with it, and then floated a darker hypothesis: maybe "you can only be a candidate if you conform on some key red line issues, red line for the establishment." That is speculation, and he presented it as such. But it is the kind of question a decentralist should keep asking whenever a populist candidate starts sounding like a central bank brochure.

Cash Is Freedom

Here I made a confession. In Romania, more than half of my daily transactions are settled in cash. I keep the bare minimum in my bank account, withdraw whenever I can and happily carry coins in my pockets. My girlfriend once asked me if I carry cash because I want to commit crimes. My answer was that one day the government may become abusive enough that it is morally imperative to break the rules, and if I don't create demand for cash, it will disappear before then.

Werner did not laugh at me, which I appreciated. "Cash is a basic right, it's a human right," he said, meaning the right to settle transactions with a means of payment that is "under our control" and visible to no one else. The reason central planners dislike cash is precisely that "they don't know who's spending what, when and where," and they cannot stop a transaction once the notes are circulating. The association with money laundering and tax evasion is, in his phrasing, a technique of "blackwashing." Crime remains crime, he added, but cash is simply the payment method "where we have more freedom and we're less controlled and less monitored."

His advice matches my habit: use more cash, "even if sometimes it's inconvenient," because the statisticians are watching. One day, he warned, they will announce that nobody uses cash anymore and quietly dispense with it, "and of course that's the moment when people will regret it." His summary deserves a T-shirt: "cash is freedom and the central bank digital currency is the entire opposite of that."

Then he raised the stakes. Cash is a liability of the central bank, and the European Central Bank is not accountable to any government or elected assembly. "It's above them, it's outside the law," he said, noting that even central bankers privately worry about the ECB's "democratic deficit." If the ECB wants to reconsider cash, then citizens should reconsider the ECB. "We want only democratic money, which is money issued by democratically elected governments." I am not sure the bitcoiners in my audience will love the idea of government money, but it is a consistent position from a man who cares about accountability above all else.

Gurus, Logic and the Scientific Method

The conference panel he had just finished put him next to an Austrian economist, and watching it, I realized that many bitcoiners are as puritan about ideology as any Marxist. They have a utopian, very logical system, and they believe it has simply never been tried properly. So I asked him what he would tell someone convinced that praxeology is the only valid way to look at economics.

He started with the common ground. Austrians are critical of mainstream economics, and he likes that. The problem is that every school eventually acquires gurus. For Keynesians it is John Maynard Keynes, who said so many contradictory things that "you can get a quote from Keynes on almost anything." Austrians have their own idols, and contradicting them makes people "quite upset." His position: "we shouldn't really have gurus." Theories should be derived from the facts and then tested against the facts.

His sharpest point was about how seductive logic can be. Physics, chemistry and biology have made enormous progress in 200 years, but "in economics there has been no progress for 200 years in the mainstream economics," because economists switched early to a deductive, axiomatic approach. A logically consistent system can still have "no relationship to the planet we live on." In his words, "whether a theory is logical doesn't tell you anything about whether it's true." Ideologists love deduction because it makes their ideas resistant to testing.

He closed this thread with a jab at the slogans of 2020. "Follow the science" was really an instruction not to test and not to check, which is a contradiction. "You don't follow the science, you do the science." That line could hang in any Bitcoin dev chat, frankly. Don't trust, verify, but for economists.

The Strange Death of Silicon Valley Bank

I had wanted to interview him in 2023 because the year handed us a lot of data. Silicon Valley Bank collapsed in March, and in Switzerland, Credit Suisse was swallowed by UBS (I first said HSBC and corrected myself mid-sentence) in a government-arranged deal that took less than a week. Is there even such a thing as private banking anymore?

Werner took Silicon Valley Bank as his case study and walked me through it like a prosecutor. Step one: the bank lost deposits, gradually, in the low billions. Step two was the strange part. Any normal banker would advertise a better savings rate and raise deposits. "Any experienced banker would not do this," he said of what they actually did, which was to sell their US Treasuries and realize losses they never had to realize. They could have borrowed on the interbank market or taken a repo loan from the central bank against those same bonds. Instead, "they essentially were acting dumb."

He also had harsh words for the narrative around it. When interest rates rise, the book value of long-term bonds falls on paper. That happens every time rates go up, and banks are actually required to hold such bonds under Basel III liquidity rules. Yet the FDIC, since late 2022, had been publicly fretting about unrealized losses in the US banking system, which he found suspicious coming from a regulator. He added that the FDIC has a habit of closing small banks, and that America went from tens of thousands of banks to around 5,000.

Step three: the bank tried to raise new equity, which forced every analyst in the country to scrutinize its behavior. They all recommended against buying, the share issue flopped and the whole world learned how badly the bank was run. Step four: big depositors pulled out. Werner named Peter Thiel as one of the biggest, saying he withdrew his money and the money of his portfolio companies and then publicly told others to do the same. "That's how you start a stampede." By his recollection, about $41 billion left in a single day, which he called the largest one-day withdrawal from a single bank in world history.

Then came a claim I have to flag. Werner said Silicon Valley Bank had joined a Federal Reserve pilot called FedNow, which supposedly meant it could not stop the outflows. "Oh, isn't that a coincidence," he said. I let it pass on air, but for the record, FedNow did not launch publicly until July 2023, a few months after the collapse, so I would treat that detail with caution until someone shows the paperwork.

His bigger point stands on firmer ground. The Federal Reserve was sold to Americans as a lender of last resort, there precisely to stop healthy banks from dying in a panic. Where was it? "It sat on its hands until the bank was bust," he said, and only after the FDIC closed it did the liquidity suddenly appear. He called the whole episode "an orchestrated takedown of a bank," and argued that it has been unfairly used as an argument against small banks, when it is really "an argument against central planners."

To explain why he does not trust the Fed's instincts, Werner went back to its origin story. America was a free country that disliked central planners, so how did it end up with a central bank? He reminded me that a central bank is one of the top demands in The Communist Manifesto, which calls for the centralization of credit in a national bank. "Look it up," he said. The most convincing argument for the Fed was that banks are inherently fragile and need a backstop against runs, sometimes runs organized by competitors.

Its track record, he says, says otherwise. In the 1930s, "more than 10,000 American banks died" under the Fed's watch, with no deposit insurance. Local families and small farmers lost their savings, while their loans survived because bigger banks took them over and demanded repayment. "That is outrageous," he said.

He contrasted the decentralized America of small independent farmers he knew from Western movies growing up in Europe with what came after, and drew a parallel with the Soviet collectivization of agriculture happening at the same time: "the same thing was actually orchestrated in America by the Federal Reserve." His claimed result is the rise of giant agribusiness and the end of a farming system built on local communities. It is a provocative thesis, and he delivers it with the confidence of a man who has read the archives.

Small Banks, German Lessons and a Limit on Money

Werner's practical program is not complicated. Small banks are locally accountable in a way that Deutsche Bank, which he says "is not accountable to anyone really," will never be. They are not systemically relevant, so there is no excuse for over-regulating them. Creating them should be deregulated, investors should help fund them, and they should be protected from being merged away. He has numbers on his side: "6,000 banks have disappeared under the watch of the ECB." That is one of the things he works on, and he asked my listeners directly: "I hope your audience is going to support me." You can follow his work on his official website.

I told him the odds looked stacked against small banks, and offered a Bitcoin parallel: Chaumian ecash mints, which work like community banks run by trusted members, with some confidentiality about who pays whom. I also admitted my reservation, namely that they "sort of defeat the purpose of Bitcoin," which was created to eliminate trust in central entities. What model of community bank does he think can survive?

His answer was the German community banking system, which he described as "very resilient" for about 200 years. It is under pressure too. The ECB's regulations and interest rate policy pushed even small German banks into real estate lending, which created a bubble that has already burst, and he expects falling prices to keep squeezing them. "I think there will be even a banking crisis in Germany," he said. And still, he believes they are the future, "because they're our banks." People forget that we want our own money creation.

And then, in the final seconds before the outro, he gave me his one real critique of Bitcoin. "With Bitcoin we can still mine money but there is a limit," he said, and that is why he would argue "it's not an ideal system." It is good that there are controls on money creation, he began to explain, and then the recording ends. For a bitcoiner, that cliffhanger is almost poetic. The man who coined quantitative easing and the man who believes in 21 million coins agree on nearly everything about who should not control money, and disagree about whether new money should exist at all.

Werner has since come back to my show twice, for S16 E34 and for the live crossover panel with Amir Taaki in S17 E40, where he kept hammering on community banks and CBDCs. If you want the opposite angle on the same fear, my conversation with Aaron Day on CBDCs vs Bitcoin pairs well with this one. Both men see the same cage being built. They just disagree about which key opens it.

Listen to Richard Werner on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:51 – Introducing Prof. Richard Werner
00:02:01 – Richard Werner's View on Bitcoin
00:02:45 – Problems with Central Banks
00:03:01 – Empirical Studies on Money Creation
00:04:16 – Decentralization and Local Banking
00:05:23 – Concerns About CBDCs
00:06:38 – Ideological Conflicts
00:07:30 – Importance of Empirical Data
00:09:51 – Critique of Theoretical Economics
00:11:07 – Scientific Method in Economics
00:13:50 – Concerns About CBDCs and Privacy
00:14:35 – Opposition to CBDCs
00:16:10 – Privacy Claims of CBDCs
00:17:16 – Misunderstanding of CBDCs
00:18:29 – Arguments Against CBDCs
00:19:42 – Transparency in Central Banking
00:20:31 – RFK's Blockchain Proposal
00:21:43 – Personal Experience with Cash Transactions
00:21:56 – Cash Transactions and Personal Choice
00:22:53 – The Human Right to Cash
00:24:06 – The Importance of Demand for Cash
00:25:08 – Accountability of Central Banks
00:26:18 – Support for Local Banks
00:28:40 – Recent Banking Crises
00:29:49 – Analysis of Silicon Valley Bank's Collapse
00:40:46 – Federal Reserve's Role in Banking
00:43:11 – The Federal Reserve's Inaction
00:44:21 – Impact on Farmers in the 1930s
00:45:34 – Centralization of Agriculture
00:46:53 – Critique of Central Planning
00:47:09 – Solutions for Small Local Banks
00:48:50 – Lessons from German Community Banks

I came to this conversation because Nicholas Gregory, the man behind Mercury Layer, told me Jake is the biggest privacy expert he knows. Jake played it down ("I don't know how much of a privacy expert people would consider me") and then spent three hours proving Nick right.

He was joined by Phoenix Green, a Decred community member who has spent the last few years explaining the project to newcomers and who brought along a lot of enthusiasm for Bison Wallet. We talked governance, mining, Lightning, block sizes, data centers, coin mixing, Zcash and Satoshi, and I closed with a live demo of the wallet. It is one of the most opinionated episodes of Season 15, and I mean that as praise.

The Man Who Rewrote Bitcoin Core

Jake's road into Bitcoin started with a failed product. His team had built Cyphertite, an encrypted offsite backup service, and when it went nowhere they looked at Bitcoin and decided to reimplement the full node from zero. Their first contact with the Bitcoin Core group was not what they expected. They offered to help with tests and to get things running on another operating system, and the response, in his words, was "instant hostility."

He is candid about what he is and what he is not. "I'm really more of a project manager than I am a developer," he told me. He steers, his people code. And what he learned while steering was that a second, independent implementation of Bitcoin was good for decentralization and bad for somebody's ego. People were told not to run their software. "I'm not the kind of person who gives up easily," he said, but at some point he had to ask where this was going.

The answer came from the BitcoinTalk forum. Two pseudonymous users, tacotime and _ingsoc, approached him with a white paper called MemCoin2 and asked him to build it. He hesitated for a few months, then agreed in early 2014 on the condition that they help him launch. It took two years.

What pushed him was a governance problem he saw up close: Bitcoin was meant to be one CPU, one vote, but once the hardware gets captured by one group, "that sort of governance mechanism, voting with your CPU, becomes compromised." Then he watched miners and developers fight for years over every change, while nobody could explain who was going to pay for the work. "Apparently venture capital money is the answer," he said, "or, as we're seeing, BlackRock."

Proof of Work, "a Dumpster Fire"

I asked Jake to describe the differences between Bitcoin and Decred in his own terms, and he gave me four. The first is consensus. Decred is a hybrid: miners produce blocks, but stakeholders lock coins into tickets that vote on blocks and on the direction of the project. "It is one CPU, one vote when you're mining, but when it comes to decisions for the project it's one coin, one vote," he explained.

The second is funding, solved with a treasury that takes 10% of the block reward. The third is privacy, which he frames as a matter of sovereignty: "Are you truly sovereign if somebody knows where all of your money is?" The fourth is the free exchange of coins, which is where Bison Wallet comes in.

His verdict on pure proof of work is harsh. Economies of scale and ASIC manufacturing mean the game ends up being about who sits closest to the silicon and the money, and for him that is mostly China. "Proof of work went from a great, fair idea to a dumpster fire," he said, adding that by 2013 or 2014 it was already one, even if he did not see the full extent then.

I played the role of the Bitcoin maximalist and asked the obvious question. If Decred fixed all of this, why is Bitcoin number one and Decred somewhere around rank 200? Jake had clearly heard this before. He said "our tech is rock solid" and nobody has ever blown up a piece of it, but price is a different game. "If you're dumb and you think that price action is the only thing that matters with cryptocurrency, well yeah, then it's irrelevant."

The Cartel That Did Not Want the Price to Go Up

Here the conversation got juicy. Decred launched with a split of 60% of the block reward to proof of work, 30% to stake and 10% to the treasury, and Jake says his biggest regret is not listening to the people who suggested the reverse. The reason is that miners "accumulated an enormous amount of Decred very quietly using ASICs and GPUs" and then, he claims, used that inventory to push the price around.

I pushed back with game theory. A cartel sitting on a mountain of coins should want the price to go up so it can sell into demand. He agreed that a rational, profit-maximizing cartel would do exactly that, which is why he described this one as "a malicious cartel as opposed to a benevolent cartel." The way they operated was not specific to Decred, which made him wonder how many other proof of work coins have the same player inside them.

He insisted this is not a vibe. When the original DCRDEX saw sustained bidding, several million DCR flowed through it, and the team started asking where those coins came from. A lot came from Binance, but large amounts came through exchanges he never expected, including one he described as a ghost town for DCR trading that suddenly moved around 800,000 coins.

Trace it back and you find clusters receiving small mining rewards, and only someone with ASICs can mine. "These claims I'm making are not just idle claims," he said. "These are claims backed up by on-chain analysis and cluster analysis." The side lesson he took from it is that some exchanges work as relays, where coins go in and come out with no real sale, which creates plausible deniability about who holds them.

Phoenix then reminded us what happened next, and this is the part I find most impressive about Decred. The stakeholders voted to change the reward split. DCP-0010 cut proof of work to 10% and gave stakers 80%. After more research showed miners were still very profitable, DCP-0012 took it down to 1% for proof of work and 89% for stake, with the treasury untouched at 10%. "That's real power to the coin holder," Phoenix said, and asked me to imagine how long the same fix would take in Bitcoin. Jake was more cautious about the result. "I hope we pivoted soon enough."

We also traded war stories about mining hardware. Jake's community members have been reporting "dusty miners" since 2012, machines that clearly ran in a warehouse before anybody shipped them. He used to run trade show booths a couple of spots away from Butterfly Labs and found the whole thing "always so sketchy."

Sovereign Money Comes With Homework

My counterpoint to proof of stake is the nation state. A government can print money, buy coins slowly and end up controlling the stake. Jake admitted there is "no good way to fully stop an adversary" from buying up any asset, but argued that it has already happened to proof of work through the people who make and run the ASICs. He also bet on human stubbornness. Stakers have a reason not to sell out, and he certainly would not. "I'm a man who will go down with the ship kind of guy. If somebody comes to try to buy everything out, I'm not for sale."

He also offered a sharp critique of how Bitcoin is governed today, which he called a "developer central planning committee," meaning "a committee that does not have skin in the game and makes decisions for everyone else." Such a system is easy to capture: pay talented people more, hype a figurehead, control the figurehead. Buying up the majority of stake is far more expensive.

What about seizing hardware from home stakers? Phoenix pointed out you can stake through Tor or from a VPS that never holds your coins. Jake went further: sovereign money is like physical gold, and someone can always show up with a gun. The answer is personal operational security, from disk encryption to decoy wallets.

He called himself "a computer security nut" and said hardware wallets are "kind of junk" for someone like him, while conceding later that for people without strong opsec, "hardware wallets are a big win, apart from the privacy angle." And he finds the trade-off acceptable. A custodian going bust and wiping out everyone at once is a worse failure mode than a thief going door to door, and in any case, "how do you know you didn't get my decoy wallet?"

Lightning as Hashcash

Before the episode, Nick Gregory had told me Decred's Lightning Network works better than what I experienced on Bitcoin. A day before we recorded, Donald Trump had made a Lightning payment for burgers at PubKey in New York through a custodial app, and it was not the instant, seamless experience everyone had been advertising. Phoenix was blunt about his own past. "My experiences with Lightning before Decred's Lightning was horrible."

What changed for him was Bison Relay, a messaging and social platform that pays for every message with tiny Lightning payments. Jake explained the idea with a nod to Adam Back's hashcash, which was designed to make spam expensive. Instead of asking for your phone number, your IMEI or, as he joked, "a stool sample," the system charges a microtransaction on both the sending and the receiving side.

"Everything you do is gated by a microtransaction," he said, and that removes the excuse for collecting metadata. It also gives DCR a real utility, because this is a use case where "this technology straight up would not work without microtransactions." His server relays several thousand messages a day, which would be impossible on-chain.

The second ingredient is SPV, lightweight clients that check block headers and use filters so they only download blocks that matter to them. Decred went a step further and made those filters part of consensus through DCP-0005, so any full node can serve them. On Bitcoin, light clients have to go looking for the minority of nodes that offer filters. Jake called committed filters "a no-brainer," the "low hanging fruit" for Bitcoin, with one catch: it needs a consensus change.

Ironically, the code running underneath much of Bitcoin's Lightning economy comes from his old team. LND is built on btcsuite, "work that I did back between 2013 and 2016 with the developers that I work with." He has warm words for Laolu, the CTO of Lightning Labs, whom he called "one of the fastest English language speakers I have ever met." And he told me about stumbling on a zero knowledge proof repository whose readme thanked btcsuite for being so clear and well commented, which made him think of his colleague Dave Collins.

His diagnosis for Bitcoin's custodial drift is that nobody planned it. Merchants want dollars, wallet makers want one-click onboarding, and that combination naturally produces custodial services. He cited estimates that around 90% of Lightning's consumer side is custodial. His advice is to focus on use cases where people send and receive bitcoin natively, because "the big idea with cryptocurrency is we're gonna move beyond fiat currency."

Big Blocks and the Man in the Data Center

Jake left Bitcoin before the block size war turned into a divorce, so I asked where he stood. Back then he leaned toward larger blocks, mostly because Core never really sold the case for Lightning; it was presented as take it or leave it. Over time he changed his mind, and his reason was not one I had heard before. Bigger blocks push nodes into data centers, and in his opinion big data centers are crawling with government people.

He told me about renting colocation space in Chicago, on a floor with thousands of empty racks, where every single time he showed up, someone appeared to work on a rack right next to his. His conclusion: "Anybody who thinks that running stuff in data centers is a path forward for a cryptocurrency network doesn't know the first thing about opsec."

I confessed that I am something of a 2017-style big blocker today, fine with very large blocks if they let people get in and out of layer twos without custodians. I told them about my own disappointment running a routing node, giving up and moving to Phoenix, Blixt and Breeze. Phoenix frowned at my 32 GB blocks ("like, whoa") and said his goal is that as many people as possible can run a full node, with SPV as the next best option. Jake framed it as trade-offs all the way down, and even admitted his own worst one: arguing with tacotime about the proof of work and proof of stake split. "I will live to regret that one."

Bison Wallet: An Exchange Without a Landlord

Phoenix found Decred about five years ago and was drawn in by the first atomic swap the team performed on air with Charlie Lee, which he remembers as "fiddly as hell" but successful. Then Jake published a post about turning swaps into an exchange. The logic was simple. If Bitcoin lets two people pay each other with no one in the middle, "why should exchange be any different?"

The backstory is pure 2017. Jake recalled Binance as a ghost town at the time, asking Decred to buy around $250,000 in exchange tokens to get listed. "We're not going to buy $250,000 of your ghost town tokens so that we can be a member of the ghost town." Every major venue had its own version: blistering listing fees, then a market maker who needs a comically large loan of your coins. "I feel like it's incredibly corrupt," he said. In May 2018 he wrote the proposal for a decentralized exchange that would not extract rent and would also get rid of front running.

That became DCRDEX, and Bison Wallet is its user-facing side. Phoenix said it has cost roughly a million dollars to get where it is. Trades are plain on-chain atomic swaps, so your bitcoin goes from one Bitcoin wallet to another and your DCR from one Decred wallet to another, with no exchange token in between. The only place Decred inserts itself is a small fidelity bond, around a dollar, which you get back if you behave. "It almost sounds too good to be true," Phoenix admitted, and that is apparently the main marketing problem.

During the demo I scrolled through the supported assets: DCR, BTC, LTC, DOGE, DASH, DGB, ETH, ZEC, Firo, BCH, Polygon and a handful of stablecoins and wrapped tokens on Ethereum and Polygon. Anyone can run a server and list what they want, which matches the project's "no gatekeepers" philosophy. You can set up market making bots, and a Bitcoin wallet created in one click is an SPV wallet that synced in minutes on my livestream.

Jake pointed out that swapping BTC for USDT without KYC is useful for any bitcoiner, but warned that "tether and these stablecoins are not permissionless." He admitted he lives on the command line and was seeing much of the interface for the first time, crediting Brian Stafford as the lead on Bison Wallet and DCRDEX.

Why no Monero? Because the swap protocol assumes both chains support Bitcoin-style script, and Monero does not, so adding it is "very much a non-trivial addition." Zcash works only by connecting to a full node, since there is no ready-made light wallet to plug in.

CoinShuffle++ and the Fear of Stealth Inflation

Phoenix showed the privacy toggle in the Decred wallet. Turn it on and your balance gets mixed, which costs "a fraction of a penny." He even suggested a route for bitcoiners: swap into DCR, mix, swap back out. The mixing comes from staking. With around 10 million of the roughly 16 million DCR locked in tickets, the constant flow of coins in and out of the ticket pool feeds large anonymity sets.

Jake explained that the system is based on CoinShuffle++, a non-custodial coinjoin design where none of the participants can tell whose output is whose. Decred made two notable changes. "We made it post-quantum secure," he said, by generating session keys with post-quantum public key cryptography in an extra phase. And they removed the coordinator. "Now it's all peer-to-peer." Even when there was a coordinator, he stressed, it only relayed messages and never handled anyone's extended public keys. On dcrdata I looked at a recent block and he walked me through a ticket split mix, with its fixed denominations and floating ticket denomination, which he compared to old-school Monero.

The most interesting idea in this section, for me, was his ranking of priorities. Privacy matters to him, but avoiding hidden inflation matters more. With shielded systems "you basically can't transparently audit the supply," and in a proof of stake chain, "if stealth inflation occurred with Decred, it would literally destroy the project," because whoever inflates could take over staking. He is also wary of complexity. Auditing generic zero knowledge proof code, he said, requires at least master's level mathematics. He thinks Zcash "would have taken off in a different way" with privacy on by default, and recalled Ian Miers telling him in 2016 that the transparent side existed for compliance and exchange listings.

I showed him the Wasabi coordinator run by Kruw, which had mixed over 3,700 BTC with no fees, as an example of one brave individual carrying a torch. Jake supports that, but thinks Bitcoin Core should have built mixing at the project level a decade ago. Now, he said, it is very hard "to put the crap back in the horse," because exchanges have normalized asking where every coin came from.

On Samourai, he was blunt: "It's a non-custodial service. Doesn't matter." Two of its developers later pleaded guilty and were sentenced in late 2025, and I covered the wider damage in On the Limitations of Bitcoin Privacy. His darkly funny silver lining for Decred is "one of the luxuries of not having a lot of NGU": nobody is sending law enforcement after your developers.

Holdings, Provocateurs and Open Source Pride

A viewer in the chat said it is incomplete to discuss a governance coin without asking the creator about his holdings. Jake clarified he is one of three founders, not the founder, and that the terms of Decred's small premine were public at launch. Beyond that, he said demanding a founder's balance sheet in order to judge a technology is "clownish at best," like asking someone how much is in their bank account, and no answer would ever satisfy the people asking. He also described a handful of persistent provocateurs who tried to worm their way into the project and turned hostile once he opposed them.

I asked why Decred is still here when most of the 2017 ICO class is dead. His answer was open source. He has run open source software for decades, from OpenBSD to his own servers, and he came for sovereign money after seeing what happens "when people turn off your bank account." He does not like the Silicon Valley and Wall Street habit of hyping "toxic sludge" and dumping it on retail. "Most people in the space, the first open source software they ever worked with was cryptocurrency," he said, "and they're here to pump and dump on you."

He also explained, with real empathy, why Core developers were hostile to him back then. They were volunteers working for pride, and he showed up with money and a paid team. "I get it." The proof that his work mattered, for me, is that btcd is still maintained and used long after he moved on.

Does he feel ahead of his time? Absolutely. He paraphrased the saying that if you are a few years ahead of the curve people think you are a genius, but if you are ten years ahead they think you are insane. To him the hybrid consensus is like an alloy. "This is like the steel of the blockchain space," he said. I told him Zooko once confided a similar frustration to me privately, about being early to zero knowledge proofs and not seeing Zcash grow the way he hoped.

Fairer Games

Toward the end we talked about the future. Jake can see Bitcoin reaching around a million dollars against today's dollar, with more institutional ownership, fewer coins moving and less sovereign use. When I said I was not very bullish on the $100,000 target the ETFs were supposed to deliver, neither of us guessed it would get there about two and a half months later, in December 2024. He expects capital to eventually look past Bitcoin and into other chains, and he wants Decred alive for "20, 30, 40, 50 or 100 years."

We also talked about voting, which Bitcoin's high priests love to hate even though, as Jake put it, "proof of work is just voting with a CPU." I brought up Satoshi's email asking Laszlo Hanyecz to stop mining with GPUs, and Jake loved it. To him the whole industry is about "creating fairer games," and the eternal opponent is "somebody out there who's a jerk who wants to turn that fair game into some rigged garbage."

Satoshi, it turns out, had his own problem with miners too. His last thought before his kids came home was that the white paper, the full node and the GUI were very different skill sets, and he does not think "there's any way" they were all the work of one person.

Whether you agree with his hybrid model or not, Decred has done something rare: it caught a structural problem in its own design and used its own governance to fix it, while Bitcoin argues about the same issues year after year. As Jake signed off: "The revolution will not be centralized." You can find him as @behindtext, the project at @decredproject, and the community at chat.decred.org. If you like this kind of history, my Bitcoin Forks, Described by Dorks piece is a good next stop.

Listen to Jake Yocom-Piatt & Phoenix Green on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:11 – Introducing Jake & Phoenix
00:01:23 – Jake's Background
00:02:48 – Creation of Decred
00:04:41 – Challenges Faced in Bitcoin Development
00:06:11 – Initial Steps Towards Decred
00:07:20 – Governance Issues in Bitcoin
00:09:01 – Phoenix's Introduction
00:10:03 – Overview of Bison Wallet
00:10:52 – Phoenix's Journey with Decred
00:11:55 – Atomic Swaps and Bison Wallet
00:12:57 – Bison Wallet Development Costs
00:17:48 – Philosophy Behind Bison Wallet
00:18:18 – Corruption in Traditional Exchanges
00:20:58 – Bison Wallet Features Explained
00:21:52 – Differences Between Bitcoin and Decred
00:23:05 – Consensus Algorithm and Its Issues
00:24:02 – Governance Problems in Bitcoin
00:24:54 – Funding Challenges in Bitcoin
00:25:48 – Importance of Privacy
00:26:46 – Decred's Unique Approach
00:28:01 – Market Perception of Decred
00:28:33 – Challenges with Proof of Work
00:29:49 – Market Manipulation by Miners
00:33:22 – Malicious vs. Benevolent Cartels
00:36:21 – Historical Mining Equipment Issues
00:38:58 – Consensus Upgrade for Control
00:40:16 – On-chain Analysis of Market Behavior
00:43:02 – The Decred Project's Flexibility
00:43:54 – Challenges of Mining Rewards
00:44:53 – Evolution of Mining Dynamics
00:45:35 – Geographical Arbitrage in Mining
00:46:07 – Fairness in Mining
00:47:11 – Participation in Mining
00:48:31 – Inflation and Interest in Decred
00:49:53 – The Role of ASICs in Mining
00:50:37 – Nation-State Threats to Cryptocurrency
00:53:05 – Manipulation of Bitcoin Prices
00:54:20 – ETFs and Institutional Control
00:56:19 – Proof of Stake vs. Proof of Work
00:59:49 – Compromise of Bitcoin's Integrity
01:02:03 – Sovereign Money and Personal Responsibility
01:02:30 – Security in Digital Assets
01:04:26 – Optimistic Views on Bitcoin's Future
01:05:16 – StarkWare and ZK Rollups
01:05:16 – LayerTwo Labs and Drivechains
01:06:25 – Decred's Lightning Network Implementation
01:07:24 – Bison Relay and Privacy
01:10:08 – Challenges with Bitcoin's Lightning Network
01:12:49 – SPV and Lightning Network Integration
01:16:09 – Microtransactions as Anti-Denial of Service
01:18:24 – Decred's Unique Use of Lightning
01:20:34 – Recommendations for Bitcoin's Lightning Network
01:23:43 – Bloom Filters and Their Issues
01:24:01 – Frustration and Adaptation
01:25:37 – Consensus Changes and SPV Clients
01:26:27 – Challenges of Vendor Preferences
01:28:07 – Moving Beyond Fiat
01:29:00 – Block Size Debate Reflections
01:30:00 – Observations on Data Centers
01:32:00 – Evolution of Opinions on Block size
01:36:30 – The Need for Efficient Blockchains
01:39:17 – Trade-offs in Scaling
01:40:54 – Governance Challenges in Bitcoin
01:42:14 – Disclosure in Governance Coins
01:43:31 – Discussion on Coin Holdings and Privacy
01:45:20 – Challenges with Provocateurs in Crypto Projects
01:46:56 – Introduction to Bison Wallet Demo
01:48:16 – Overview of Hodling.ch
01:49:25 – Bison Wallet Interface Walkthrough
01:52:54 – Functionality of Bison Wallet
01:56:06 – CoinShuffle++ Explanation
01:59:24 – Creating a Bitcoin Wallet in Bison
02:02:27 – Network Level Privacy in Bison Wallet
02:03:36 – Conclusion and Farewell to Phoenix
02:05:35 – Wallet Functionality and Filters
02:06:32 – Monero's Atomic Swap Challenges
02:08:40 – Zcash Wallet Limitations
02:09:55 – Tether and Ethereum Wallets
02:11:03 – Bison Wallet Features
02:12:22 – Ethereum Account Generation
02:13:58 – Backing Up Wallets
02:15:36 – Concerns with Hardware Wallets
02:16:06 – Experience with Decred and Bitcoin
02:19:47 – Decred's Longevity and Community
02:20:14 – Principles Behind Decred's Development
02:23:49 – Legacy of Open Source Contributions
02:25:48 – Consensus Algorithms and Innovation
02:27:03 – Frustrations with Recognition
02:27:59 – Community Dynamics in Cryptocurrencies
02:29:07 – Zcash's Default Privacy Issues
02:30:08 – Challenges of High-Level Teams
02:33:21 – Privacy vs. Stealth Inflation
02:35:01 – CoinShuffle++ Explained
02:36:37 – Cost to Attack Analysis
02:38:39 – Mixing Techniques in Decred
02:40:10 – Wasabi Wallet and Decentralization
02:43:14 – Bitcoin's Privacy Future
02:45:02 – Implications of Recent Arrests
02:46:49 – Bitcoin's Future
02:49:22 – Decred's Longevity
02:50:43 – Challenges in Bitcoin Governance
02:52:11 – Voting in Bitcoin
02:56:16 – Satoshi's Vision
02:58:39 – Learning About Decred

That alone would justify an episode. But Kruw is also a tireless researcher, a part-time historian of Bitcoin privacy drama, and the kind of guy who shows up to an interview with a folder of receipts and a cat napping beside him the whole time. We planned a live experiment, he traced coinjoins on screen, and the conversation wandered for over three hours into covenants, Lightning, Tor exit relays and the block size debate. It is one of those episodes where the format is that there is no format, and I mean that as a compliment.

A Torch Nobody Wanted to Carry

Wasabi had become a recurring theme of Season 15. I opened the season with Max Hillebrand and Lando Rothbardian on the "Buy Anything" button, then covered the shutdown, then the project's future. What fascinates me is that the wallet survived without the company. Kruw pointed out that decentralized coordinators had already been shipped quietly in 2023, built by the BTCPay Server developer Kukks with Nostr as the discovery layer. "There was no big announcement or a pre-announcement of a pre-announcement," he said, in a not-so-subtle jab at Samourai's long-promised decentralized Whirlpool. Yet nobody cared, because "people hate or hated Wasabi so badly that this didn't get any traction."

The 2024 crackdown changed that. Kruw listed the casualties as if reading a war report: Samourai's developers arrested, Sparrow pulling the Whirlpool client, Bitcoin Keeper deleting every tweet that ever mentioned it, zkSNACKs closing its coordinator, Trezor dropping coinjoin support and Phoenix leaving the US. I reminded him of his own post saying the winner of the Samourai versus Wasabi war was the regulators. He agreed, and admitted Bitcoin "was a little bit weaker than people thought it was."

My own read is that Wasabi came out tougher. The Samourai camp was louder about dying for privacy, but when someone actually went to jail, most of its fans scattered toward Monero. The Wasabi community stayed and picked up the pieces, and Kruw is the most visible example.

Coinjoins Are the Worst Way to Use a Blockchain (and That Is Fine)

We started with a bet. I gave Kruw a fresh address and he promised to pay me directly from inside a coinjoin, a little-known WabiSabi trick that lets you do the premix, the mix and the payment in a single transaction. Samourai, by comparison, needed three steps. Then we would let the audience try to trace it.

While the round filled up, I pushed him on the obvious objections. Monero hides amounts; Bitcoin's ledger shows everything. Kruw explained that this is exactly why coinjoins produce equal-sized outputs: "if you have a 100K sat output, you can't tell it apart from someone else's 100K sat output." He was honest about the weak spot too, admitting the WabiSabi protocol is weaker "for the very largest whale on the transaction."

On speed, he had a line I loved. A coinjoin, he said, is "just like the worst version of transacting on a blockchain." Ten-minute blocks already rule out paying for groceries, so adding half an hour of mixing on top does not break anyone's use case. "There was no one in between 10 minutes and 40 minutes who is now no longer going to use Bitcoin." On fees, he argued you can even save a little, because the transaction overhead is shared across the round.

I brought up the dust problem. Every time fees drop, people are told to consolidate their UTXOs, which I called "the worst privacy advice ever," because one lazy consolidation can undo years of discipline on a permanent public ledger. Kruw's answer was Wasabi 2.0's payment builder, which pieces together standard denominations so you can pay "within a couple percentage points" of the amount and leave no change behind. He compared it to the branch and bound coin selection in Bitcoin Core: "a privacy tool and a blockchain efficiency tool."

The Coordinator That Charges Nothing

Wasabi's user experience got a lot of love in this episode. I raved about the one-click transaction boost, the rocket button that spares you from choosing between CPFP and RBF. Kruw praised it as abstraction done right, but he also confessed that the original 2.0 design went too far by hiding UTXOs entirely. "I think this was a mistake," he said, adding that nopara73 "will still defend it to this day."

Switching coordinators is now just a matter of pasting an address and a fee limit into the settings, and his own coordinator lives at kruw.io. Kruw loves the idea of a market of coordinators, each catering to a different user. His rounds run for an hour, which makes them big. zkSNACKs ran ten-minute rounds, and "two out of three of them would fail." He would like Wasabi to eventually pick a coordinator for you based on how much you want to pay and how long you want to wait, a bit like makers competing on JoinMarket.

So why zero fees? After zkSNACKs left, the new coordinators launched with matching fees, but running one costs maybe "$150 a month at the max." Kruw went for liquidity first, not money, and the first-mover advantage did the rest. Then he revealed the part most people miss. Because WabiSabi registers inputs before outputs, every participant leaves a few leftover satoshis behind, and a coordinator can collect them. "These little sats add up," he told me. "It's not tons and tons of bitcoins, but it'll pay for your server." He thinks that incentive could drive decentralization if more people knew about it.

He also let slip that Trezor's coinjoin code is still open source and could be pointed at another coordinator. He plans to test it on one of his many Trezors and write a guide, since cold-wallet coinjoins were always one of Wasabi's most underrated tricks.

Easy Mode, Medium Mode, Hard Mode

Then came the spicy part. I asked Kruw to share his screen and show how Samourai coinjoins get demixed. He pulled up an old OXT Research graph of a Whirlpool transaction: a premix split into five outputs, a change output and a Samourai fee output. The user later merged his change with all five mixed outputs, several of them on reused addresses, which drew a neat little circle on the graph.

Kruw was clear that this is user error, and that Samourai's own researchers would say so. His complaint was the double standard. "Samourai for some vicious reason every time this would happen, they would go out on Twitter and claim this means the implementation of their competitor was broken." Address reuse defeats everything: "No privacy tool, no Monero swapping, Lightning swapping, Whirlpool, nothing will protect you from that." He sorted tracing into tiers: reused addresses are easy mode, merged change is medium mode, and recombining the mixed amounts is hard mode.

He also went after the famous "132 arrests" talking point used against Wasabi. People who used Wasabi may have been arrested, he said, but claiming they were arrested because of Wasabi "is a leap of logic." Even F/Dev got a mention for asking Burak to say "coinjoin" instead of WabiSabi when crediting the protocol behind Ark. Fittingly, WabiSabi itself credits CashFusion from Bitcoin Cash, something I always enjoy pointing out.

I noted that privacy seems to always split into two camps: GrapheneOS versus CalyxOS, Zcash versus Monero, Wasabi versus Samourai. JoinMarket is the peaceful exception. Kruw called it "OG," the only place on Bitcoin where you can earn yield and privacy at once. "Count me in, that's awesome." He just prefers Wasabi for its privacy and block space efficiency.

"We're All Money Transmitters"

The question I most wanted to ask was the uncomfortable one. Kruw sounds American, admits he lives in "the territory of the Empire," and coordinates coinjoins at the same scale that got the Samourai developers charged. How is this safe?

He traced his answer back to 2020. Before Covid he was a number-go-up guy. Then he lost "not just one job but two jobs," the first to lockdowns and the second over the vaccine. "You start to realize that if you don't fight now, there's nothing left to fight for." On the Samourai charges, he refuses to play the legal-definitions game. "I'm a money transmitter, you're a money transmitter, we're all money transmitters. It's great, that's the whole purpose."

When I pressed him again, he did not pretend. "It's not" safe, he said. If he shuts down his coordinator, does he then shut down his Lightning node, and then his full node? "If you forfeit every piece of ground from here until self-custody, then you're guaranteed to lose the battle before it starts." He does not trust the Constitution to save him either, pointing to how gun rights have been chipped away. "Cypherpunks write code, and we build Bitcoin to be strong, we don't build it to be regulated."

I told him honestly that I worry about him. My previous guest was Charlie Shrem, who went to jail for treating bitcoin as fungible money. Kruw answered with a grim statistic about the US correctional system, then held up a physical Vlad coin and a Samourai Dojo node in a red case that cost him 0.1 BTC, as proof he puts his money where his mouth is.

Receipts on Samourai

Kruw is a Samourai critic who has actually contributed to Samourai, opening bug reports and buying its hardware. His main grievance was that Tor and Dojo were both off by default, which meant new users handed over their IP address and their xpub. "Nothing will matter if you hand them your xpub."

Then he scrolled through his notes. He showed old tweets where Samourai's team rejected block filters (BIP 157) with the claim that they were "a full node wallet" on phones, posts where Keonne Rodriguez warned against closed source wallets, and a later post welcoming a closed source Whirlpool client. He also showed Samourai saying it was not against Tor by default in principle, but worried about support costs, and then telling a contributor, ten days later, that it would ignore his merge request.

The sharpest point was Ricochet, the feature that hops your coins through several of your own addresses. Samourai charged 100,000 sats for it. "Does this sound like a service you should pay for? Not really." Worse, the fee output made those hops identifiable. The indictment, he noted, estimates about "$1.1 million for Ricochet transactions," which tells you the government could see them. Without the fee, those hops might have offered real deniability.

I admitted his note-keeping both impressed me and made me a little nervous. "That's my talent in this world," he said. "I'm a very vindictive person and I don't forget a lot of things." He says he applies the same standard to himself so that he argues "linearly and not in circles." For the record, he also refused to kick the Samourai developers while they are down: "they're victims, but not heroes." If you want to help them, he suggested, "go run your own coinjoin coordinator and just prove that you can't stop them."

Covenants, Ordinals and Old Pennies

The top of Kruw's Twitter profile at the time was a call to activate CTV, BIP 119. He admitted he wore a UASF hat during SegWit without really knowing what he was advocating, and supported Taproot mostly on the strength of his web of trust. CTV appeals to him because it is simple: "this is a pre-signed transaction, but it's enforced by consensus rules." His enthusiasm has cooled a bit only because the list of rival covenant proposals keeps growing. "Instead of true or false, you have A, B, C, D, E, and it's much harder to get a high score on that test."

I shared my view that CTV was the first serious proposal from outside the usual circle of developers, and that Adam Back did a masterclass in stalling it in the Cult of the Covenant Telegram group. Kruw credited Jeremy Rubin with doing "everything realistically possible" to prove its merits, from Sapio to his Advent calendar of blog posts, and called Speedy Trial a miscalculation, because a lack of pushback is not the same as support.

On ordinals, he was even more passionate. "The filter is the transaction fee," as I put it, and he agreed that the community's failure to stop inscriptions "is a success case for Bitcoin that proves how censorship resistant it is." Data has always lived on Bitcoin, from the Genesis block headline to the ASCII tribute to Len Sassaman.

He also dug up a 2017 Jimmy Song tweet saying coins signed by Charlie Lee would be worth more to him, much like collectible pennies. That gave me a chance to defend Litecoin's role in activating SegWit and my soft spot for MWEB, which I think is better than anything currently proposed for Bitcoin. When he asked me to rank privacy coins, I said Litecoin wins on liquidity, Monero on overall privacy and Zcash on cryptography.

How Blockchain Analysis Actually Works

Somewhere past the two-hour mark, Kruw gave what I called one of the best breakdowns of chain surveillance I have had on the show. He started with Roman Sterlingov, convicted as the operator of Bitcoin Fog partly on chain analysis evidence. Bitcoin Twitter called it pseudoscience. Kruw thinks that was the wrong defense: "start with the strongest argument: say this guy, whether he did it or not, let him go."

Then he went through his list. Address reuse comes first, which is why the whitepaper tells you to use a fresh address every time. Next is common input ownership, the heuristic that coinjoins and payjoins break. Then comes following the change, which usually matches the script type of the input. Round payment amounts give away the recipient, as do version numbers, locktimes and RBF flags.

Single-output transactions are where the guessing starts, because they could be a self-transfer or a spend. Add KYC data or a public Electrum server watching wallets sync, and "you can start to trace a huge amount of the Bitcoin network activity." Blocks are small, he reminded me, and "looking at 3,000 transactions or something is not that hard."

Why does he know all this? "I want to audit my own transactions," he said. "You don't want to find out later that you don't have privacy you thought you had."

Our live experiment, by the way, failed. Two hours in, the payment still had not arrived, and his logs said "overall balance must not be negative." It was a code problem, not a protocol one, but I made the point that if a power user cannot pull this off in two hours, it is hard to blame people for picking Monero or Zcash. "I can definitely see the appeal," he said.

Lightning Is Confidential, Not Private

It took us two and a half hours to say the word Lightning, which might be a record. Kruw's verdict was precise. The sender gets good privacy, but the receiver leaks unless they use blinded paths or BOLT 12, and an LSP sitting on both sides of a payment sees everything. "You only gain privacy on Lightning from extending the length of your route, which is not what Lightning is designed to do." He is a huge fan of Phoenix because splicing turns every channel change into something like a payjoin, "the coolest thing ever."

He was less kind to ecash. Fedimint, Cashu and friends are custodians either way, and he worries they will pull users out of non-custodial privacy tools rather than out of banks. He reminded me of a Mutiny federation that lost its DNS and left users unable to redeem their tokens.

I defended Nym, which I described as an incentivized mixnet inspired by David Chaum's work and a possible upgrade on Tor, whose exit nodes may well be run by agencies and embassies. Kruw, true to form, revealed that he runs a Tor exit relay himself. "You're a brave man," I told him. "You're fighting the fight, or else you're a fed."

Turning Into a Big Blocker

The last stretch was the most surprising, at least for me. I confessed that I am "turning into a big blocker." With Starlink and cheap storage, raising the block size is the most conservative way to add capacity, and the rest is politics. Maybe 16 or 32 MB, I said, enough to help millions onboard to coinjoins and layer twos without custodians.

Kruw was sympathetic but called it a slippery slope. "What if I say hey, I want eight?" He reminded me that Zcash had a long stretch of spam when block space was cheap, because "someone will do it just because they're an [expletive]." His benchmark for decentralization is running a full node on your phone, and he admitted he is a bit of a hypocrite there, since Wasabi itself uses block filters. I mentioned Amaury Séchet's speed limit analogy, and he argued that Ethereum is "what Bitcoin Cash would look like if Bitcoin Cash got adoption." I told him about the failed HTC Exodus 1s full node phone sitting in my drawer.

As we wrapped up, with his laptop battery dying and his cat still napping, Kruw added one more stat I had not expected. Under zkSNACKs, Wasabi was about four times bigger than Samourai in fresh on-chain volume. "There's some hidden bitcoiners out there with a lot of money who really like Wasabi, who are not very vocal on social media." That might be the best summary of this whole conversation: the loudest people in Bitcoin privacy were not the ones doing the work. If you want to see who is, connect to his coordinator, follow @Kruwed, and read my older essay on the limitations of Bitcoin privacy with his tracing tiers in mind.

Listen to Kruw on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:39 – Introduction
00:01:33 – Recap of Wasabi Wallet Discussions
00:02:28 – Samourai Wallet's Decentralization Announcement
00:03:56 – Challenges Faced by Privacy Projects
00:04:40 – Shift in Bitcoin Culture
00:05:32 – Impact of Regulatory Pressures
00:06:40 – Wasabi's Resilience
00:07:53 – Exploring Bitcoin's Privacy Features
00:08:36 – Demonstrating CoinJoin Transactions
00:10:24 – Differences Between CoinJoin and Monero
00:11:23 – Challenges with Bitcoin Transaction Privacy
00:13:11 – Concerns Over High Transaction Fees
00:17:40 – Wasabi's New Features for Privacy
00:20:14 – User-Friendly Features in Wasabi 2.0
00:21:18 – Transaction Speedup Options
00:23:05 – Critique of UTXO Management in Wasabi 2.0
00:23:38 – Wasabi Wallet User Control
00:24:03 – Switching Coordinators Feature
00:24:50 – Decentralized Coordinator Community
00:26:18 – User Preferences in Coordinator Selection
00:30:56 – Coordinator Fees Discussion
00:31:04 – Drivechains and Mining Concerns
00:34:25 – Market Dynamics of Coordinator Fees
00:37:43 – Collecting Dust from Transactions
00:38:09 – Trezor's Coinjoin
00:41:14 – Wasabi Wallet's Development Funding
00:42:36 – Samourai Wallet's Blockchain Analysis Tool
00:46:49 – Address Reuse and Privacy Challenges
00:49:40 – Mistakes in Privacy Usage
00:50:21 – Discrediting Wasabi Wallet
00:51:42 – Cash Fusion
00:53:23 – Reputation and Arrests
00:54:33 – Bitcoin Privacy Camps
00:55:56 – Join Market's Unique Position
00:56:21 – Legal Risks in Bitcoin Coordination
01:00:01 – The Fight for Bitcoin's Future
01:01:42 – Personal Ethics and Legal Protections
01:03:14 – Concerns Over Martyrdom
01:04:12 – Physical Tokens and Authenticity
01:05:10 – Critique of Samourai Wallet
01:08:09 – Transparency Issues in Samourai Wallet
01:09:55 – Closed Source vs. Open Source Debate
01:11:26 – Default Privacy Features in Samourai Wallet
01:13:13 – Ricochet Transactions and Fees
01:14:41 – Government Awareness of Transactions
01:15:01 – Implications of Fee Collection
01:15:53 – Personal Standards and Hypocrisy
01:16:21 – New Pepe Avatar Presentation
01:18:21 – Nostr vs. Twitter
01:20:11 – Support for CTV & Covenants
01:22:38 – Governance and Community Dynamics
01:22:53 – Concerns about ETF Privacy
01:24:08 – Complexity of Consensus Changes
01:28:20 – Community Understanding of Proposals
01:31:01 – Censorship Resistance in Bitcoin
01:32:46 – Market Dynamics and Filters
01:34:08 – Historical Context of Data on Bitcoin
01:35:31 – Criticism of Jimmy Song
01:36:30 – Litecoin's Role in Segwit Activation
01:37:47 – Bitcoin's Cultural Stagnation
01:39:45 – Ranking Privacy Coins
01:40:26 – Liquidity vs. Privacy
01:41:39 – Technological Advancements in Privacy
01:42:54 – User Resistance to New Technology
01:43:09 – 10101 Shutdown
01:44:16 – Drivechains and Altcoins
01:45:58 – Monero Liquidity Concerns
01:46:29 – Future of Bitcoin vs. Altcoins
01:47:20 – Cultural Conflicts in Bitcoin Development
01:48:26 – Blockstream's Influence
01:51:49 – Whale Bots in Bitcoin
01:52:52 – Michael Saylor's Influence
01:55:07 – Bitcoin's Future and Development
01:59:08 – Censorship Resistance vs. Privacy
02:00:05 – Satoshi's Coins and Community Reaction
02:01:08 – Blockchain Analysis Case
02:04:15 – Challenges of Privacy Services
02:05:20 – Tracking Methods in Blockchain
02:06:39 – Understanding Transaction Outputs
02:09:03 – Heuristics for Blockchain Analysis
02:10:06 – Personal Experience with Blockchain Analysis
02:10:58 – Samourai Wallet's Controversies
02:13:37 – Victims vs. Heroes in Privacy Projects
02:16:46 – Bitcoin Soft Forks for Privacy
02:18:18 – Statechains and Privacy
02:20:08 – Interactive Transactions Challenges
02:22:25 – Monero and Chainalysis
02:23:01 – Network Level Privacy Issues
02:24:01 – Future of Privacy Tools
02:24:49 – Zano's Hybrid Consensus Model
02:25:13 – Tail Emission Interest
02:26:11 – Consensus Mechanisms Explained
02:27:05 – Future of Bitcoin on Layer 2
02:28:28 – Lightning Network, Finally
02:29:24 – Confidentiality vs. Privacy
02:29:39 – Privacy Concerns in Lightning
02:30:12 – Splicing and Lightning Efficiency
02:32:40 – Public vs. Unannounced Lightning Channels
02:34:12 – Custodial Systems and Privacy
02:35:31 – Investment in Privacy Technologies
02:36:57 – Nym Security Token Overview
02:40:03 – Challenges of Decentralization
02:41:22 – Tor and Bitcoin Privacy
02:42:10 – Running a Tor Relay
02:48:55 – Ordinals & Spam
02:51:20 – Block Size Debate
02:52:41 – Challenges of Block Size Increases
02:57:48 – Ethereum vs. Bitcoin Cash
02:58:57 – Dynamic Block Size Mechanisms
03:00:10 – Running Full Nodes on Mobile
03:03:49 – Wrap Up and Future Prospects

I had tried to get him on the show many times, and the calendar always won. What finally broke the stalemate was a Twitter exchange. The person behind the BitMEX Research account had described Charlie's position on the block size wars as clearly pro-BTC, Charlie replied that he had never actually clarified it, and I jumped in to offer him a microphone. "Let's do it," he said, and so I ended up live with him, freshly haircut (for those of you listening on Spotify, that is a reason to watch the video).

What followed was an hour of history from someone who mostly watched the scaling debate through the mail, a surprisingly cheerful take on stablecoins, a gloomy detour into fear and privacy, two surprises from my side, and a poem he wrote on the day he got arrested. If you expected a bitter man, you will not find one here.

Missing the Civil War

My first question was the obvious one: where did Charlie stand when Bitcoin tore itself apart over block size? His answer started with a correction about vocabulary. "I don't even like calling it a war," he said. And he pointed out that nobody had ever sat him down to ask how he saw it in historical context, including the author of The Blocksize War, a book he had promoted many times on his own podcast, The Charlie Shrem Show. In his view, the author simply "read from historical context what he thought my position was or would be."

I confessed that I was only a spectator back then. I was not running a node, I was just hearing about SegWit, SegWit2x, Bitcoin Classic and Bitcoin Unlimited the way you hear about storms in another country. Only later, after I "got radicalized a bit by the winning side," did I discover that many people now labeled small blockers had once wanted bigger blocks. BIP 103 is living proof that Pieter Wuille and others were interested in a gradual increase at one point.

Charlie zoomed out. When he got arrested in January 2014, an entire era ended within a couple of months: Silk Road had been shut down, Ross Ulbricht was in custody, Mt. Gox was proven insolvent, and the price hit its all-time high before dumping. Before that, words like censorship and size war simply did not exist in the community. "If the concept of raising the block size had come up one year earlier, probably it wouldn't have been anything like what it became," he told me.

What he described next sounded like a changing of the guard. It was "the end of the anarchists and the misfits and the people throwing shit at the wall to see what sticks," the end of the BitInstant era and the rise of the Coinbase era. Of the companies from those days, he could only name two that were still operating: BitPay and Blockchain.info. Vitalik had not even talked about Ethereum until a couple of months after his arrest.

Smart Scaling Beats Fast Scaling

Charlie did not pick a jersey so much as recite two lessons that stuck with him. The first one came from someone who told him: "Charlie, you can't solve a technical problem with a political solution." That was the moment he realized SegWit2x would not succeed.

The second came from Bitcoin developers, many of whom are his friends and live near him in Florida. "Charlie, smart scaling is better than fast scaling," they told him. The argument was that the block size would not stay frozen forever, but if Bitcoin bent the knee to all the forces pushing on it, "we will have failed the social experiment that is Bitcoin." Did scaling and growth eventually come? "Yes, no, how, maybe," he laughed. Those are questions we can debate.

He summarized the technical side the way most of us remember it: bigger blocks, once they filled up, would in theory make it impossible to run a node on smaller computers. SegWit, in his opinion, "was probably one of the best technical solutions at the time." On top of that you had political and personal attacks, and a layer of American versus Chinese tension that he says is more transparent today than it was back then. "There's so many layers to this story," he said, which is exactly why he recommends the book.

Just to be fair to everyone involved: Charlie spent the hottest years of that debate in a cell. "When I was in prison was when the block size debate started, which is why I missed out on the Hong Kong agreement and the New York agreement," he explained later in the episode. His main source of news was Roger Ver, who kept mailing him information from the outside. So the clarification he gave me is less of a verdict and more of a testimony from someone who heard the gunfire from very far away.

The Rise and Rise of Charlie Shrem

Before the interview, I watched The Rise and Rise of Bitcoin, a documentary that foreshadows an absurd amount of what happened over the last decade. There is Bobby Lee talking about BTCC and mining migrating to China, and there is the filmmaker's brother, an enthusiastic miner who preorders Avalon machines and gets burned by Butterfly Labs before giving up on mining altogether.

Charlie said that was simply life in those days. You would buy machines without knowing whether they would ever arrive, and cloud mining "was like 90% of it was a scam." His explanation is pure game theory: if you build a machine that mines bitcoin, why ship it before you run it yourself while the difficulty is low? Most early miners were funded by forum posts along the lines of "hey guys, I have an idea for a Bitcoin miner, everyone give me 10 bitcoin," and "most of those people never came back."

The same documentary has a scene I could not get out of my head. During the 2013 crash triggered by the Mt. Gox shutdown, Charlie tries to explain to BitInstant customers that they still have their bitcoin, and even that he gave them extra, but all they want is their US dollars. So I asked how that same man feels about Elon Musk pumping bitcoin and Tesla letting people preorder the Cybertruck with BTC. "It's very humbling," he said. "It's happened too fast."

He even reframed the block size fight as a sign of success. The scaling war happened because people were using Bitcoin and blocks were filling up. "It was a champagne problem," as he put it. "I still don't believe it," he added, and that disbelief is part of why he is writing a book about it.

Tether Is a Financial Backbone

Then came the first question I expected to make him wince. In 2012, would Charlie Shrem have believed that stablecoins would one day have a much higher trading volume than bitcoin? To me it feels like a defeat. He did not wince at all.

His view is that stablecoins have become a great explainer of crypto, and that most people who touch a stablecoin end up using bitcoin or something else too. He thinks it will take "probably another 100 years until you see like a Bitcoin standard," and until then people need a way to move in and out of their fiat currencies. "If you look at Tether across the world, it is literally a financial backbone that is taking millions of people out of poverty every single day," he said. Get a cell phone with a Tether account and "you can now use your brain and start a business."

I brought up something closer to home. My girlfriend is from Iran, her parents cannot use the banking system to send her money, so they send Tether, because everyone wants dollars and bitcoin looks too wild. I keep telling her she should use bitcoin, and I am conflicted about it. Charlie's answer was philosophical. "We are just humans living the short amount of time," he said, and the transition to better money "may not happen during our lifetimes."

He also admitted that the cypherpunks of his generation missed something. "We're a bunch of kids in our parents' basements," he said, and while they theorized about Cyprus, Argentina, Weimar Germany and Zimbabwe, nobody predicted that the first effect would be a stronger dollar. His explanation is that America is exporting its inflation to the rest of the world, and he thinks "it's really wrong that the American government does that." Later he came back to the point with a question for me: don't I think the dollar is also losing its purchasing power, "just a little bit slower"? I do. But as I told him, people have limited patience and they choose whatever works right now.

A Pepe, a Dishwasher and a Snow Plow

At this point I had a surprise. My girlfriend, who was taking a medical school exam while we were recording, had drawn Charlie as a Pepe that morning after we watched the documentary together. I asked him to look at it on his phone. "That's beautiful, can you put it back, I got to see it again," he said, and suggested inscribing it on Bitcoin. (She passed her exam during the episode, and he liked the Pepe. Good day for our household.)

The drawing led us to the other documentary, Banking on Bitcoin, which I remember as "the one where you wash dishes." Charlie remembers that job fondly. "That was a good job for six months, 'cause you're just putting headphones on and you're washing dishes and you don't have any problem in the world." I reminded him of the ankle bracelet and the miserable wage. He reminded me that in prison you only make "like $30 a month or something like that."

Everyone has to work in prison. Charlie spent a few months in the education department helping inmates get their high school diplomas, then got transferred to landscaping, which he called "a great job." It was nearly always cold, so he drove a snow plow, salted the ground and drove a big tractor over something like 5,000 acres. I told him about the Simpsons episode where Homer becomes Mr. Plow, which he somehow did not remember, and we agreed that there is something therapeutic about being the person who clears the road for everyone else.

Rebirth With a Million Dollar Debt

The tone shifted when he described what he walked out to. "When I got out of prison I was poor," he said. "Not only that, but I had a million dollar debt I had to pay to the government," as part of his plea agreement. All his money had gone to lawyers.

What he said next was the most personal moment of the conversation. "My parents abandoned me, excommunicated me. I haven't spoken or seen them in 10 years." The person who held everything together was his girlfriend, now his wife, who left New York, moved about an hour away from the prison and sent him money. The Bitcoin community split down the middle: "half the Bitcoin community supported me, half didn't," but many people sent beautiful letters and money.

Being that deep in debt had a strange side effect. He stopped thinking of money as something to accumulate over the long run, and the fresh start felt "almost like a rebirth." He worked as a dishwasher, a waiter and a table cleaner at a restaurant in Pennsylvania, eventually moved to Florida, and at the time of our recording had been free for eight years. They got engaged the day he was released, married a year later, and were celebrating their seventh wedding anniversary.

I told him I hoped to hear a similar story about Ross Ulbricht soon. Charlie was optimistic about Trump's chances, and showed off his sense of humor about it. As a felon himself, he owns a hat that says he is voting for the convicted felon.

Why the Crypto Anarchists Went Quiet

When I asked about the state of Bitcoin, Charlie gave me a gift basket. He praised Layer Two Labs and Paul Sztorc, whose white paper he went through with Paul himself, calling drivechains "one of the best technological solutions that we have for scaling for Bitcoin." He likes that there are so many competing methods, from soft forks to OP_CAT, with websites that explain the trade-offs. In his view Bitcoin is "a couple of years behind" the rest of the crypto ecosystem, and the only place it is really lacking is the user experience. "I have really nothing bad to say," he concluded.

So I complained instead. Bitcoiners used to be far more enthusiastic about creating anarchy with cryptography and building a parallel economy. Charlie knew exactly where I was going, and he admitted he has spent "a lot of sleepless nights over this culture loss." His explanation was blunt: "the fact of the matter is too many people went to prison." The Amir Taakis of the world, the ones pushing for maximum privacy, will either stay undoxxed and be ignored by the mainstream, or they will simply be afraid.

He did not sugarcoat it. Outside America, he said, they are arresting people, and he pointed at France and the CEO of Telegram. "You think you can be safe writing a blog post about privacy on Bitcoin? Absolutely not." His conclusion was even darker: "No one wants to be the next Ross." He also thinks the community is splitting into people who want everything regulated and people who say regulate crypto but leave bitcoin alone, which he finds unfair: "why are we throwing crypto into the fire?"

I offered a different perspective from Romania. Our constitution was drafted with the memory of the communist regime, it is more freedom-centric, and I am not aware of anyone being arrested here for privacy activism. Charlie's reply was that in the US "they come up with another charge," because the authorities do not want to create martyrs. I noted that the conversation "got pretty gloomy very fast." He protested: "I was the positive one."

The Only Opt Out

And he really was. Charlie loves bitcoin for what it is today: "it's the only opt out financial system we have." Before Bitcoin, there was never a way to say no to the money printing and the loss of purchasing power. All the narratives about what bitcoin needs to be are subjective, he argued. "Bitcoin is whatever you want it to be because it's yours."

The most beautiful thing he said in the whole interview involved an 11-year-old relative who had visited him. "Her whole life, Bitcoin has existed. She doesn't know a world without Bitcoin." That brought a tear to his eye, because to him it means the experiment already succeeded. "Bitcoin's existence is validated by its existence through time," he said, and every holder, every distributor and every podcast like mine extends that validation. I answered with the old saying that you win when you outlive your enemies, which he liked.

When I pressed him about scaling, with Lightning not getting much traction and custodial solutions like Fedimints and ecash looking like banking reinvented, he admitted that he does not know the answer. What he does know is what bitcoin meant to him: "I possess the money now." He described Bitcoin as two things sharing one name, the financial system and the monetary unit, and said "Satoshi should have named them separate things."

The unit has succeeded slowly, held by enough people to represent "some macro thing in the world." The system is where he wants growth: he wants the Uber driver and my girlfriend's parents to use it, and he notes that the number of bitcoin sitting on exchanges keeps falling, which could someday feel like a supply squeeze.

His bedtime reasoning goes like this. The monetary unit might need a couple more decades, but in the meantime people are getting used to the technology Bitcoin created. Satoshi's solution to the Byzantine Generals' Problem enabled the blockchains where Tether lives, so "over time we're going to see both come back together." Then, with a smile: "sorry for the long-winded answer."

Bitcoin Cash and the Cult of No Leader

The Bitcoin Cash community had asked me to get Charlie's take on their project, which focuses on peer-to-peer payments and has added opcodes Bitcoin lacks. I like that kind of open source experimentation, because the most conservative project gets to pick what works. Charlie was diplomatic but honest. He called it "a shame how Bitcoin Cash was created," because of the con artist who convinced people he was Satoshi, a man Charlie will not name "because I don't want that guy to sue me." That stain, in his view, spread mostly to the Bitcoin SV side after the fork.

He spoke warmly about Amaury Séchet, the longtime lead developer of Bitcoin Cash, whom he had hosted on his own podcast and met in Mexico. Amaury told him, "Charlie, it'll just take time." I had to break some news: Amaury had already left Bitcoin Cash and was running his own fork, eCash (XEC), with the Avalanche protocol layered on top of proof of work. "It's a fork of a fork," Charlie said. "I can't even keep up anymore."

That turned into his strongest thesis of the episode. "I don't like any crypto that has a leader," he said. Satoshi disappeared, and anyone who tries to become Bitcoin's leader gets humbled or rage quits. He named Elon Musk and Michael Saylor as examples. "Our value and the reason we exist is because we have no leader," he said. "Once we have a leader, you can take it down. It's over."

I pointed out that Ethereum and Tron do not seem to suffer from having famous leaders. Charlie's answer was that they are different things: smart contract platforms, "very interesting scientific experiments," which need people behind them, especially when raising money. He applied the same logic to Zcash. "I love Zcash, but at the same time I don't see it being a replacement for Bitcoin because it's VC funded, has leadership." He does love their research, though.

As for other projects, he advises a few crypto teams on fundraising and launches, but when he goes to a friend's birthday party, the gift is still bitcoin. "I'm still orange-pilling people," he said. "The crypto, I still don't know what to do. I'm still experimenting."

Two Poems and a Book

My second surprise was a poem by a listener named Samuel, who desperately wanted it on screen during this interview. Charlie insisted on reading it aloud himself, new glasses and all: "it captures the shape of what occurred, the movement of itself by our movement." He loved it, and asked permission to print it in his book, where he plans to open every chapter with a poem.

The book is the project he cares about most. He started journaling the minute he got into Bitcoin in late 2010, because "I knew something really important, something really big" was happening. The notes, stories and blog posts piled up, then prison happened, then the letters from Roger and the rest of the community. "In order to understand where we're going, we really need to understand where we came from," he said, and his book is meant to cover the early days and all those stories. You can follow his work on his website.

Then he read the poem he wrote on the day he was arrested, which he wants to turn into a song. It is funny and dark in equal measure: "here comes my legal team, they're setting bail, please God help, I'll never survive jail." And later: "from early on Bitcoin was on the frontier, we decided to change the way we've lived for thousands of years." I told him it has to go in the book. He promised it would.

We wrapped up with plans to meet at the PoW Summit in Frankfurt, which he called "the coolest city ever." Charlie is a man who lost his company, his freedom, his parents and a million dollars to the US government, and he still ended the call by saying "I love you." The block size war may have happened while he was away, but the optimism of the BitInstant era never left him. In a space that keeps trying to crown kings, that is a pretty good lesson to take from the original Bitcoin martyr.

Listen to Charlie Shrem on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:23 – Introducing Charlie Shrem
00:01:51 – How This Interview Happened
00:02:41 – The Block Size Wars
00:05:16 – 2014 Marked the End of an Era
00:06:55 – Bitcoin Community Dynamics and Changes
00:08:04 – Technical and Political Challenges
00:10:43 – The Rise & Rise of Bitcoin Documentary
00:12:39 – Stablecoins vs. Bitcoin
00:15:29 – Philosophical Reflections on Money
00:17:02 – Charlie Shrem's Pepe
00:18:18 – Personal Reflections on Prison Life
00:21:45 – Rebirth After Prison
00:23:17 – The State of Bitcoin
00:27:09 – Cultural Shift in Bitcoin Community
00:30:03 – Privacy Concerns in Bitcoin
00:32:09 – The Future of Bitcoin
00:35:05 – Scaling Challenges
00:36:33 – Bitcoin's Value and System
00:37:55 – Bitcoin's Success and Adoption
00:39:04 – Bitcoin's Transactional Volume
00:40:03 – Encouraging Bitcoin Usage
00:41:26 – The Role of Stablecoins
00:42:32 – Bitcoin Cash
00:43:34 – Samuel's Poem on Bitcoin
00:46:08 – Bitcoin Cash's Origins
00:47:27 – Amaury's New Project
00:48:17 – The Importance of Leaderless Systems
00:50:12 – Interesting Projects Beyond Bitcoin
00:52:14 – Elon Musk and Bitcoin
00:53:54 – Working on a Bitcoin Book
00:56:00 – Charlie Shrem's Poem
00:57:40 – PoW Summit in Frankfurt
00:57:54 – Closing Remarks

The first thing he did was refuse the compliment. "I didn't do all those things," he corrected me within the first minute. Then he spent the next 45 minutes defending the Lightning Network at a moment when almost everyone else seemed ready to bury it, while a guitarist played somewhere in the background.

If you came here for a eulogy for Lightning, you will be disappointed. Ben thinks the job is barely started.

The Gavin Andresen of LNbits

Ben describes himself as a starter, not a finisher. "I think I'm quite good at coming up with a proof of concept, but as a developer I'm not the best," he told me. The Bowser hardware wallet and the Nostr signing device were perfected by Vladan, and LNbits itself grew up thanks to a crew he rattled off with obvious affection: Vladan, Black Coffee, Tal, dni, fiatjaf and others.

He even jokes that his own pull requests now struggle to get into LNbits core, which he considers a sign of health. "You don't want me committing to LNbits core," he laughed, and then reached for a comparison any Bitcoiner will recognize: "I feel like the Gavin Andresen of LNbits." The founder steps aside, the project outgrows him, and that is how it should be.

The trick that keeps him useful is the extension framework. LNbits is designed so that novice developers, and people who were never classically trained, can still ship an extension. I had my own thank-you notes to add here. Black Coffee agreed to list the Bitcoin Takeover magazine in the LNbits shop, printed in the UK and sold for roughly what it costs me to print and ship it. And Vlad Stan, a Romanian LNbits developer, is now firmly on my list of guests to chase.

Five Percent Done

Then I brought out the uncomfortable question. Since we last spoke, Antoine Riard had disclosed Lightning vulnerabilities, node and channel counts had dipped, and the spotlight had moved to Ark, statechains like Mercury Layer and drivechains. Does he still believe in Lightning?

Absolutely, and with a statistic I have not been able to stop thinking about. In his view, "5% of the work has been done to make Lightning functional and already it far surpasses other payment networks such as Visa." The remaining 95% is unglamorous. "Bitcoiners love a panacea," he said, "and the reality is it's blood, sweat and tears."

He gave a concrete example. LNbits used to rely on Ride The Lightning for node management, but the software was so heavy that it crashed their server, so the team built its own node manager into LNbits. "It's crazy to me that after whatever four years," he said, nobody had solved basics like channel balancing and automatic swaps. His rewrite of an old line went like this: it is not about what Lightning can do for you, "it's what can you do for Lightning."

Channel factories were the cornerstone of the very first Lightning hack day he attended, months after mainnet launch, yet barely anyone has worked on them since. The reason is simple: when on-chain fees are low, Lightning feels good enough. That is why Ben, of all people, has a soft spot for ordinals. When the inscription wave pushed fees up and everybody's Lightning node got squeezed, solutions came "out of the woodwork": submarine swaps, Liquid-based rebalancing, serious channel factory talk. His conclusion is almost Darwinian. "We don't tackle scaling Lightning Network properly until on-chain fees are critical."

He also suspects that part of the gloom is manufactured. "There's an incentive to FUD on Lightning," he said, pointing at the money behind ecash, and he flatly rejects the claim that the world must rely on federated mints. "We can have a Lightning node on everybody's phone. Seven billion people have smartphones."

No Trusted Third Parties, Please

Ben's filter for every new scaling proposal is the one Satoshi baked into the whitepaper. "Bitcoin's whole thesis is trying to remove the trusted third party," he reminded me, so it makes no sense to turn around and declare trusted third parties acceptable, as long as we federate them. The entire reason we tolerate "this ridiculous blockchain thing" and the convoluted machinery of Lightning channels is to get rid of the middleman.

"Any proposal or solution which requires a trusted third party, I'm instantly skeptical about," he said. Drivechains get a more nuanced treatment. He likes them, but suspects that if they ever arrive, we would simply end up with a sidechain optimized for Lightning sitting beneath it. Ark, too, could offer channel factory-like behavior. The point is to organize protocol layers in the right order, with bidirectional payment channels on top doing what they do best.

Swaps, Liquid and a Cambrian Explosion

This is where my sponsor read turned into an argument. SideShift, which lets you swap between coins without an account (think of the old ShapeShift), had removed its Lightning option for lack of liquidity, while a memecoin mocking Joe Biden supposedly did more volume. Ben was not impressed by the comparison. In his experience, people paying for things with bitcoin use Lightning, and much of that shitcoin volume is wash trading. "You can't really trust the volume."

He does agree that swap services matter enormously, and LNbits has a direct line into one: dni also works on Boltz. Ben explained how LNbits sits on top of any funding source, from LND and Core Lightning to custodial services, because he was tired of rewriting every project for a different API. The latest addition came from Jackstar, the same developer who built the node management tool, who had messaged him the day before to say the Boltz funding source was finished.

The result is something like Aqua wallet inside LNbits. Your balance lives in Liquid, and Lightning payments are auto-swapped in and out. Fees were around 100 sats per swap at the time, but according to Ben, Michael from Boltz planned to bring them down to about 40, "which then becomes nominal" when you are buying a beer. For an LNbits software-as-a-service install, it means users get Lightning without the team becoming custodians.

Add Galoy's Blink, ACINQ's Phoenixd and Blockstream's Greenlight to the mix, and Ben sees a pattern. "There's been this Cambrian explosion of solutions for Lightning Network," he said, and it happened precisely during the bear-FUD cycle. "If only they had existed like three years ago," running a node on a Raspberry Pi would have been far less painful.

ZK Rollups, Covenants and a Boeing 747 in Flight

Next came a pitch from another sponsor, StarkWare, which wants OP_CAT activated so it can bring ZK rollups to Bitcoin. Ben's take on zero-knowledge tech was warm, with a jab at a certain privacy coin: "It's a shame that Zcash acted so coiny, because it's a good concept." He hopes we eventually get something like Zcash on Bitcoin, perhaps through ZK rollups, perhaps through drivechains.

He is allergic to anyone claiming to define Bitcoin's final form. "The worst thing any Bitcoiner can do is to say I can define what Bitcoin is," he told me. Covenants, in his words, "unlock a whole bunch of new potential ways" of engaging with the network, and the right response is more experimentation and more computer science. I added my favorite ZK party trick: a phone that syncs by verifying a single proof, no Electrum server peeking at your xpub.

When the conversation reached drivechains (yes, Layer Two Labs was also a sponsor), I suggested that Litecoin might test them first, the way it tested SegWit. Ben agreed that "SegWit arguably might not have happened had Litecoin not done it first," and then gave the best defense of conservative development I have heard in a while. Working on Bitcoin is like working on "a Boeing 747 flying through the air," and you are servicing it mid-flight. Break something and everyone falls.

His most interesting point was that drivechains already delivered something useful just by being proposed: they "really highlighted how centralized mining is." Work like Stratum V2 becomes urgent, and he summarized the critics' stance fairly as "nice proposal, but not while mining is so centralized." Thesis, antithesis, synthesis. I told him it was a rather diplomatic answer. He did not deny it.

The Trouble With Mints

I confessed my own discomfort with Cashu. I love Calle, I remember him babbling about Chaumian ecash at a bar and then coding the backbone of Cashu the following week, but promoting custodians as a scaling solution feels like it defeats the reason I got into Bitcoin in the first place.

Ben's answer started with a family history. Calle works on LNbits, and the first Cashu MVP was built from LNbits' fake wallet funding source, essentially "a chopped up LNbits." So ecash, he said, "came out of the womb of the LNbits ecosystem." He thinks it is powerful technology with real use cases such as paid API calls. Then came four words in a row: "However, however, however, however."

His concern is the game theory nobody has worked out. "Who's going to run mints?" If you run a mint, you are effectively producing currency, and jurisdictions tend to dislike that. Ecash is not really pegged to bitcoin either. "I bought a beer in the conference, it doesn't mean the beer is pegged to bitcoin." There is no good proof of reserves, and the privacy that protects users also strips away the double-entry bookkeeping that lets you prove the custodian lost your funds. LNbits support tickets are full of "this didn't seem to happen" moments, and inflation bugs, as Monero has shown, are hard to catch in private systems.

Federation is no magic fix. Ben pointed to Liquid as the expensive way to do it right: members are vetted so they are not geographically clustered, and someone literally flies out with a box of custom hardware to onboard each new functionary. Now picture that being replicated by casual community banks. In his village in Wales, he estimates "maybe three, four people" could realistically operate a Lightning node, so how would a less connected community run a federation of mints? Ecash may still become an important part of the world's economy, maybe even as a federated digital dollar. But dropping trustlessness for convenience, he warned, is a little like "let them eat cake."

A Castle Built on Sand

I then tried to get him cancelled. Name three cryptocurrencies that are not Bitcoin and not complete scams.

He managed two. He likes Monero because people actually use it and because it explores the real problems of private digital money. And he credited Litecoin for the service it did to Bitcoin with SegWit, plus MimbleWimble as "good computer science." That was enough. "I don't need a third, do I?" Ethereum, in his view, is "a castle built on sand," which is exactly the worry he has with ecash: if the foundational assumptions are wrong, all the wonderful work on top can be made redundant.

He kept clear of the ordinals debate, which I told him was pointless since he was already cancelled. His home is payments. "Lightning is where I live," he said, and making nodes easier to run plus exploring micropayments is enough for him. Still, "the world's not binary in software." Good ideas from what he called "the crazy weird outland of shitcoin" usually make their way back to Bitcoin eventually, and that, he agreed, is what drivechains are designed to enable, even if "Bitcoin's not ready for drivechains" yet.

Wrong Jungle

Ben closed the theory part of the interview with a fable. A team is tasked with cutting through a jungle. They are wonderfully efficient, slicing through vines, and just as they reach the destination someone at the back raises his hand and says: "Oh, wrong jungle."

"We can pursue something to incredible work and then figure out we're just actually in the wrong jungle," he told me. That, he admitted, is roughly how he feels about ecash. It is also a decent warning for every Bitcoin project, his own included, and I suspect he knows it.

Where to Start, and What Comes Next

Before pointing listeners anywhere, he added a disclaimer: his opinions are his own, not those of the Nostr community or of LNbits. "They're not from LNbits, they're just from me."

For newcomers, the entry points are simple. LNbits.com links to the GitHub repo and to a hosted version that lets you spin up an instance in minutes, a "good place to experiment." Nostr.org has an explainer video and a long list of clients for your phone or laptop. MakerBits covers the hardware side: ATMs, points of sale, cheap signing devices and hardware wallets, with its own Telegram group and YouTube channel.

His goals for the following year were concrete. He wanted LNbits out of beta, used by "some big institutions to manage their Lightning payments," with a fully hardened core and ten times as many extensions. On Nostr, he wanted themed clients. The old internet was made of forums for golden retriever owners and Oasis fans, until Twitter and Facebook pulled everyone in and stripped those communities bare. "With Nostr, you can have both," he explained: subject-specific clients that still plug into the wider social graph. You can see how that wish played out in our 2025 conversation about LNbits V1.

He ended his answer at the exact moment the guitar player in the background stopped, which I found very poetic. Then he turned the tables and thanked me for the magazines, calling me "a chronicler of Bitcoin and its journey" and telling me not to let the maxi trolls get to me for interviewing fringe Bitcoiners. Coming from someone who keeps handing credit to everyone else, that meant a lot.

Listen to Ben Arc on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:23 – Introducing Ben
00:01:41 – LNbits Contributors and Collaborators
00:05:01 – Scaling Challenges of Lightning Network
00:06:06 – Bidirectional Payment Channels
00:07:22 – Need for Development in Lightning Network
00:09:32 – Skepticism Towards Trusted Third Parties
00:12:20 – Importance of Swapping Services
00:17:40 – Innovating Lightning
00:18:15 – ZK Rollups and Future of Bitcoin
00:19:49 – Covenants and Computer Science
00:20:21 – ZK Proofs and Mobile Wallets
00:20:51 – Drivechains
00:22:10 – Litecoin's Influence on Bitcoin
00:23:06 – Centralized Mining Concerns
00:24:13 – Community Contributions and Tribalism
00:25:04 – Self-Custody Consulting
00:26:08 – Cashu and Its Implications
00:27:08 – Game Theory and Custodial Solutions
00:29:58 – Mints and Trust Issues
00:33:37 – Ecash and Its Future
00:34:12 – Regulatory Environment for Cryptocurrencies
00:35:02 – Alternative Cryptocurrencies
00:36:50 – Bitcoin's Payment Technology
00:38:58 – Pursuing the Right Focus
00:39:23 – Getting Started with LNbits and Nostr
00:39:37 – Disclaimer on Personal Views
00:40:03 – Exploring LNbits
00:41:18 – Ben's Current Projects
00:41:47 – Acknowledging Team Contributions
00:42:00 – Future Aspirations for Lightning Payments
00:43:00 – Thematic Nostr Clients
00:43:47 – Closing Remarks
00:44:18 – Mutual Appreciation
00:45:09 – Acknowledging Hard Work

Mike has spent the better part of a decade inside the plumbing of the internet's naming system, and he came out of it with one stubborn conviction: names should be owned the way bitcoin is owned. His answer is Spaces Protocol, a naming system anchored to Bitcoin with no token, no premine and no foundation. When we spoke on August 21, 2024, it was running on testnet4 and he hoped to reach mainnet "in the next month or so."

He also started by calling the Bitcoin Takeover his favorite Bitcoin podcast, which is the fastest way to get invited back. I arrived about 30 minutes late to my own show, so I suppose we were even.

Why Bother With Digital Identity?

I came in playing the cynic. We already have a beautiful KYC system, right? You upload your ID, everyone knows who you are, and your social security number is sitting on some darknet forum anyway. Why decentralize any of this?

Mike reframed the question. What Spaces really handles is naming: usernames, user IDs, domain names. "Bitcoin was a revolution for money," he told me, and money is the one thing Bitcoiners agree must be decentralized. But naming sits right next to it. Cities have names, companies have names, websites have names. "You can't just refer to a city by like geo coordinates," and you cannot run the web on raw IP addresses either. Right now, almost every name we use lives under someone else's control.

His path here started with domains, not Bitcoin. After park.io he founded Impervious to work on Handshake, a Bitcoin fork with its own blockchain, and later on ENS. Both experiences convinced him the job belonged on Bitcoin, for two reasons. First, it is "by far the strongest proof of work blockchain," so why put decentralized names anywhere else? Second, Bitcoin itself needs a naming system. He pointed to Matt Corallo's BIP 353 for human-readable payment instructions, which currently leans on DNS, and DNS is "completely centralized."

So the team spent a year focused entirely on Spaces, with one design ideal repeated like a mantra: "100% cypherpunk." No separate chain, no token, no premine, no foundation, and a light footprint, without "clogging up all the block space."

Namecoin's Squatters and the Lessons of the First Altcoin

I could not resist the history lesson. Back in 2010, the decentralized DNS conversation produced Namecoin, and Satoshi encouraged its creators to build a separate, merge-mined chain instead of stuffing names into Bitcoin. Today I am not even sure anyone still maintains the domains people bought on Namecoin, and the idea has found its way back to Bitcoin.

Mike gave Namecoin its due. The fact that the very first altcoin was about names "shows like the importance of naming," and Spaces was built "on the shoulders of all these other" projects. In 2010, a name system on Bitcoin simply could not scale to hundreds of millions of entries, so a separate chain made sense. But he cited an academic paper on why Namecoin failed, and its conclusion was distribution. You could register tens of thousands of names for very little, so the whole namespace got squatted and real users could not get anything useful.

ENS got a fairer review than I expected from a Bitcoin builder. Mike said it has been "super successful in a lot of ways," doing hundreds of millions of dollars a year in registrations. His problems with it are structural: everything sits under a single top-level domain, .eth, and verifying Ethereum yourself is hard enough that most people end up trusting an RPC provider.

Hundreds of People Between You and Your Name

This is where the conversation got political, in the best sense. If you buy a domain at GoDaddy, Mike explained, "there's like literally hundreds of people who have access to your domain name," from the registrar to the registry to ICANN and every employee in between.

His favorite example is .cat, the top-level domain for Catalonia. During the independence push, Spanish authorities raided the registry's offices, .cat domains were taken down, and, as he recalled it, a technical lead was arrested for sedition. And it is not only domains. "If they can do it to the president, they can do it to anybody," he said, pointing at Donald Trump's removal from Twitter.

The argument mirrors the one every Bitcoiner already knows by heart. People say their bank works fine. "Why should there be banks in between and everybody else in between you and your money and why should there be people in between you and your name," Mike asked. "There should not be."

Security is the second half of the case. He mentioned the 2024 Squarespace incident, in which attackers hijacked domains and crypto companies lost user funds. Then there is HTTPS itself, which depends on certificates from trusted third parties. In his words, your traffic ends up "signed with somebody else's keys, really."

At Bitcoin Takeover, With No Dot

Then came the part I actually cared about: how do I get my name? I warned listeners on air that if anyone squats on my handle, I will hunt them down, because someone already owns bitcointakeover.com and wanted far too much for it.

Mike walked me through the design. There are top-level spaces and subspaces, and only the top level touches Bitcoin. To claim one, you open an auction with a Bitcoin transaction and place bids on-chain. There is no dot. The syntax looks like @bitcointakeover, and the owner can then hand out subspaces underneath, sell them, give them away or keep them all.

To keep Bitcoin's blocks free for money, the number of top-level spaces is capped at roughly ten per day, "like 3,600" a year. The winning bid is burned: "it's just gone forever," and none of it goes to Impervious. They considered sending it to miners, but that got complicated, and burning was the cleanest cypherpunk option.

Squatting gets the same treatment. Auctions last ten days, and "any bids in the last day extend the auction by one day," which makes last-second sniping very hard. Namecoin's ghost was clearly sitting at the design table.

Zero-Knowledge Proofs Instead of a Fee Spike

My natural worry was that every subdomain would be another on-chain transaction, and that a domain craze would push up fees for the people who use Bitcoin for remittances. Mike shut that down quickly. Subspaces are managed off-chain in a tree, and ownership is proven with zero-knowledge proofs. The team has a proof-of-concept tool on their GitHub that uses RISC Zero to produce a succinct proof, which could be committed on-chain to attest to changes.

The numbers explain why. There are about 300 million registered domain names on the internet today, and "you can't have that on bitcoin." So Bitcoin carries the scarce top layer, everything else scales off-chain, and no consensus change is needed. "It's running just as Bitcoin is now," he said, yet it remains anchored in that block space for its security. I told him it sounded even lighter than OpenTimestamps, which is about as non-contentious as non-monetary Bitcoin use gets.

Typing @bitcointakeover into Chrome is a different story. The team has focused on the protocol first. Names will point to data stored on a peer-to-peer network: DNS records, an onion address, a Nostr identity or a BIP 353 payment address, all verifiable against the name's key with a quick proof check. Browser support would come after mainnet. Impervious already built one browser for this, Beacon, which Mike described as the first to resolve ENS names through real DNS instead of a redirect, and the first to support DANE, so "you have the keys, nobody else has the keys to encrypt that traffic."

I argued that redirects are fine for vanity, but they do not "defeat the Hydra." If every decentralized name just forwards to an ICANN domain, you are only an interface to the system you wanted to replace. The real win is people building native sites and apps on these names.

Truckers, Venmo and Human-Readable Money

The first killer use case Mike sees is payments. He brought up the Canadian truckers' protest, when GoFundMe decided not to pass the donations on. With a human-readable name, you could tell people to send bitcoin to something like "truckers at fund," with no platform in the middle. And the owner of a top-level space does not need to set anything up: with the current Spaces wallet, anyone can send bitcoin straight to @bitcointakeover.

He also referenced a Lyn Alden interview about combining Nostr and Lightning into something that works like Venmo, except "it's Venmo without the usernames." Add Spaces, and you get a decentralized Venmo.

My own question about identity got a more cautious answer. I said a single Bitcoin address as someone's identity feels limited and leaky. Mike agreed that pinning a name to a reused address has privacy issues. What a naming protocol really does is tie "a name to a key," so you can prove ownership, and he mentioned silent payments as the kind of tool that can work with a space name. The darker side came up two years later, when members of the Spaces team joined my TABConf 8 livestream and warned that a well-known address bound to a findable person invites wrench attacks.

Block Space Has Value Beyond Money

I predicted that some Bitcoiners would complain once Spaces went live, the same way they complain about ordinal inscriptions: this is a money network, so get your JPEGs off it. Mike answered with the philosophy behind the whole project. What makes Bitcoin special, to him, is its block space, "this truly decentralized" ledger secured by the most proof of work in the world. "Money is the first killer app" that used it, and a very important one. But naming deserves a place there too, and he does not think it takes anything away from money, especially with a footprint this small.

He has been touring BitDevs meetups, and the reaction surprised him. Some attendees who openly dislike how ordinals use block space told him Spaces is "the only thing built on bitcoin that I see that has value."

I also pointed out that Paul Sztorc is building BitNames, a Namecoin-style sidechain for his drivechain vision, and that sidechains could take the high-volume names Bitcoin's base layer cannot carry. (Paul explains the bigger picture in my S15 E16 conversation about scaling.) Spaces takes a different route by scaling with proofs instead of a new chain.

First Inning of Decentralized Naming

I was honest with him. I remembered emoji domains being pitched after a Bitcoin Group episode in 2021, at the peak of NFT mania, with no browser support and pure speculation behind them. I never heard about them again.

Mike knows the skepticism well. When he brings this up with domain industry veterans, they roll their eyes: "oh another blockchain solution to naming." But he has worked with ICANN and with registries such as .io and .ai, he got into Bitcoin in 2013, and park.io ran one of the first 50 nodes on the Lightning Network. His conclusion is that domains are digital assets and belong on a blockchain. "There's no way we're gonna live in a world in like 20 years from now where" every name is centralized, he said, and he self-funded the first year of Spaces because of that belief.

He is not dogmatic about winning, which I liked. "We're still like in the first inning of this decentralized naming stuff," he said, and if something better comes along, he will be interested in that instead. ENS revenue and Unstoppable Domains' reported billion-dollar valuation show the market already sees value. He believes the solution that finally works should be built on Bitcoin.

He also sees a market for names. Short, memorable spaces like @bitcoin will be valuable, the same way short domains and Twitter handles are. A graphical wallet was in progress to replace the command line, and Impervious planned a service that lets the owner of a top-level space sell subspaces, generating the zero-knowledge proofs for them. Imagine owning @bitcoin and selling mike@bitcoin or vlad@bitcoin.

Friendster, Hi5 and the Fun Internet

Breaking monopolies is hard. GoDaddy advertises at the Super Bowl, and here in Romania even the small registrar I use resells names governed by the central .ro authority. Network effects decide these fights, and Mike knows it from the other company he runs.

His Friendster story is pure domainer instinct. park.io was a drop-catching service, writing scripts to grab valuable domains in the fraction of a second after they expired. When friendster.com expired, someone else caught it, Mike bought it from them, and he picked up the abandoned trademark too.

His goal is a social network that "puts users first" and does not sell your data, an antidote to platforms that manipulate people with ad algorithms until they feel "depressed and isolated." He mentioned a study in which people said they would pay money to leave certain social networks, but stay out of fear of missing out. Friendster had around 250,000 people on its waiting list, and he hopes every user could someday get a Spaces subspace username.

We wandered into nostalgia: Google+ and its circles arriving about eight years after Friendster, and Hi5 in Romania, where everyone learned a bit of HTML to get an animated page with a song playing in the background. "The internet used to be more fun," I said, and he agreed. And then the idea clicked for me: Friendster users who do not care about Bitcoin might come for the names, and once regular people show up, Bitcoiners will follow. That is a growth path most protocol builders do not have.

Before we wrapped, I asked him to recreate the hair from his Twitter profile picture. He told me someone once said he had "the best hair in the domain name industry," which made us, by his math, "two of the best hair guys on a pod." You can find him by visiting cypherpunk.com, which redirects to his X profile, a domain flex if I have ever seen one.

From Testnet4 to Mainnet

About 400 people listened live, and I told them to grab testnet4 coins from a faucet and start bidding. Mike pointed everyone to the Spaces explorer to watch auctions, to @spacesprotocol on X, and to the project's Telegram for questions.

Looking back from October 2026, the mainnet did happen. When Spaces came onto my TABConf 8 livestream, the team said it had launched on mainnet about a month earlier, with roughly 3,700 top-level spaces and about 120 @bitcoin handles. The auction limits and burned bids Mike described are live today. As for me, I am still going to find whoever owns @bitcointakeover if it is not me.

Listen to Mike Carson on Spotify, Apple Podcasts, YouTube, and More

▶ Play video Watch on YouTube

Time stamps:

00:00:41 – Introduction to the Podcast
00:02:44 – Importance of Digital Identity
00:05:25 – Overview of Spaces
00:06:38 – Development of Spaces
00:08:38 – Historical Context of Domain Names
00:10:02 – Challenges with Namecoin
00:12:49 – Censorship and Domain Ownership
00:13:52 – Technical Limitations of Ethereum
00:17:27 – Value of Impervious Spaces
00:18:33 – Functionality of Spaces
00:19:58 – Auction Mechanism Explained
00:21:05 – Sponsor Introduction
00:22:26 – Concatenation Opcode Discussion
00:23:29 – Domain Access Query
00:23:43 – Decentralized Naming System Details
00:25:25 – Integration with Existing Systems
00:25:58 – Data Storage Capabilities
00:27:02 – Browser Integration Possibilities
00:28:28 – Redirecting vs. Building
00:29:33 – Squatting Prevention Measures
00:30:35 – Human-Readable Payment Addresses
00:32:50 – General Purpose Naming Integration
00:33:22 – Open Source Development
00:33:55 – Sidechains and Domain Names
00:35:00 – Scaling Bitcoin Discussion
00:36:08 – Self-Custody Consultancy
00:37:09 – Digital Identity Importance
00:38:03 – Potential of Naming Protocols
00:40:00 – Marketplace Potential for Spaces
00:40:27 – Value of Domain Names
00:41:07 – User Interface Development
00:42:13 – Selling Subspaces
00:42:50 – Concerns About Domain Services
00:43:26 – Past Domain Protocols
00:44:07 – Importance of Decentralized Naming
00:48:24 – Challenges of Competing with Established Services
00:49:36 – Community Support for Decentralized Projects
00:50:59 – Bitcoin Address Integration
00:54:14 – Zero Knowledge Proofs for Scalability
00:56:08 – Security and Decentralization of Block Space
00:57:19 – Community Adoption of Spaces Protocol
00:58:16 – Expected Launch Date for Spaces Protocol
00:59:42 – Overview of Other Projects
00:59:46 – Building for Handshake
01:01:04 – Focus on Spaces
01:01:09 – Following Spaces Updates
01:02:55 – Personal Branding and Friendster
01:03:06 – Domain Name Industry Insights
01:04:49 – Bringing Back Friendster
01:06:00 – Friendster's Historical Context
01:07:15 – Nostalgia for MySpace and Hi5
01:08:04 – Onboarding Users to Bitcoin
01:09:41 – Final Thoughts and Encouragement