S15 E13: Robin Linus on BitVM & Permissionless Bitcoin Development

Late in 2023, Robin Linus dropped a paper with a title that sounded like clickbait and a mechanism that was not: BitVM: Compute Anything on Bitcoin. No soft fork. No Core PR. Off-chain computation, on-chain fraud proofs, and a path toward trust-minimized bridges into sidechains and ZK rollups. The timeline lost its mind. I booked him for Season 15 before the Christmas dump finished shipping.

Robin also builds under ZeroSync, the Swiss nonprofit pushing SNARKs onto Bitcoin so a chain-state proof can replace replaying every block yourself. He is the opposite of laser-eye Twitter: no price calls, no ETF cosplay, just scripts, stakes, and papers. Asking Peter Todd to study “Ethereum research” is a reliable way to get a lecture about not legitimizing a scam. Robin looked anyway, stole the useful cryptography, and wired it into Bitcoin Script as it already exists.

If you only remember BitVM from later seasons, start here. This is the first time I had him alone on the show, when the idea was still new and the hype was still raw. Years later he came back with Liam Eagen and Ying Tong Lai for {ideal} and Argo, but the permissionless itch starts in this conversation.

Why Bitcoin Needs a Virtual Machine It Does Not Run

I opened with the obvious question: why does Bitcoin need anything called BitVM?

Robin’s answer was not “smart contracts for DeFi cosplay.” It was currency. He wants Bitcoin usable by everyone as money. That is still not possible on the base layer alone. One path is a two-way peg into other systems (sidechains, ZK rollups) without trusting a federation. Liquid already proves the federated version. Robin wants better.

Zero-knowledge proofs enter as compression technology. Everybody verifying everybody else’s transactions is how Bitcoin stays decentralized, and also why it scales poorly. SNARKs (succinct non-interactive arguments of knowledge) can squash almost infinite computation into a constant-size proof. Originally invented for privacy, they turned out to be a scalability tool. At ZeroSync they run a Bitcoin node inside a proof system and hand you a receipt for the resulting state. Verify the proof, skip the recompute. Mobile wallets that currently lean on random Electrum servers suddenly look less cursed.

Robin does not hand-wave the Orthodox objection. Adding complex, young cryptography opens failure modes Bitcoin Core never had. He agrees it is not “just as secure” as classical verification. He also refuses to throw the tool away because Zcash or Ethereum funded the research. Shitcoins running real money are accidental bug bounties. The systems keep not breaking. That is data.

Turing Completeness Without the 2017 Hangover

I reminded him that “Turing complete” was a marketing tattoo in 2016 to 2018. Every altcoin claimed it. Now BitVM claims Bitcoin can verify arbitrary computation off-chain and dispute it on-chain. Why bother?

BitVM and the ZeroSync chain-state story are related but not the same. The endgame Robin cares about is verifying a ZKP (or similar claim) on the main layer so side systems can settle into BTC. Infinite practical scalability. Paying should feel like sending email or tapping a phone in a supermarket: trustless, cheap, boring.

The hard problem is the two-way peg. BitVM’s headline job is a trust-minimized or trustless bridge. Super Testnet (also in Season 15) had been joking about multisigs unlocked by off-chain Pokémon games. Robin smiled at the theory and narrowed the product. BitVM only works when someone can pay on-chain fees in the worst case. High-value bridges (think 100 BTC locked) create the incentive. Cute individual games probably do not survive a fee market that works.

He compared the value proposition to Drivechains. He likes Paul Sztorc’s work, admires the patience, and frames BitVM as a permissionless workaround: Drivechain-shaped two-way pegs without waiting for a fork. Permissionless is the whole brand. Same season energy as the Season 15 preview promised: BitVM, sovereign rollups, sidechains, and researchers who refuse to wait for a soft-fork committee.

Timing: Taproot Scripts, Optimistic Rollups, Not Ordinals

Why now? I floated the lazy theory that Ordinal inscriptions inspired him.

He pushed back. He had been collecting exotic Bitcoin scripts since around 2021, long before Ordinals. With Super Testnet he worked on efficient bitwise XOR tricks and a SHA-256 implementation in low-level Script. They talked publicly in sidechains Telegram channels about unbounded Taproot script trees. He suspects the inscription wave may have overheard those conversations, not the other way around. Inscribing rollup data does not give you a BTC bridge. Different problem.

What did help: Taproot and SegWit as the script surface, plus the Ethereum community’s optimistic versus validity-proof split. Optimistic rollups working (well enough) on Ethereum were an inspiration for BitVM’s challenge-response shape. I told him I was glad a newer generation of Bitcoin researchers will steal cryptography regardless of which foundation paid the PhD. Awkward silence. Then we moved on. That is fine. The work is the reply.

A Free Market of Sidechains, Lightning as Glue

Favorite use cases? He kept returning to one: bridge BTC into sidechains, then let a free market of sidechains compete on scalability, privacy, games, whatever. Bad offers die. Good offers grow. The main layer can ossify after two-way pegs are solved. Ossifying before pegs are solved, in his view, would be extremely stupid.

I played Lightning maximalist for a minute: sidechains as 56k modems while Lightning is broadband.

Robin was unimpressed. Lightning still needs each user to afford a mainchain UTXO. The Lightning paper itself already shows current block size cannot onboard the planet. Lightning shines as a settlement fabric between “Bitcoin banks” (ideally trust-minimized ones). Sidechains can encode state more efficiently than today’s main layer, so even “blockchains don’t scale” still leaves room for better-encoded chains that scale better than L1 as shipped.

Users would rarely touch the BitVM bridge. Liquidity providers peg large amounts. Average users atomic-swap and pay Lightning invoices. Same UX whether the counterparty sits on L1 or another sidechain. The bridge is the exit hatch when a sidechain dies and people need BTC back on the main chain. He is a fan of Ark as a scaling idea, and of the people behind it, but he does not think Ark alone reaches billions of users. Any L2 that must settle on L1 inherits a minimum economically rational balance that rises with fees. Sidechains (and related designs) are how you stop forcing poor users in unstable-currency countries to hold five hundred dollars of “channel collateral” just to exist.

Rough planetary math from Robin: on the order of a hundred more-compact sidechains might be enough. I roasted him as Bill Gates predicting 640K of RAM. He laughed, then noted markets will cluster users onto fewer popular chains because cross-chain traffic is overhead. Local proximity matters. Not a million sidechains. Not one either.

Bitcoin-Backed Proof of Stake (Yes, He Said the Words)

Peter Todd’s critique of two-way peg complexity and miner incentives came up. Robin separated BIP 300 (the peg) from BIP 301 (merge-mined consensus). He is not a fan of BIP 301. He prefers his own design: a Bitcoin-backed proof-of-stake algorithm. Stake BTC on the main chain. That stake makes you a validator on the sidechain. Join, leave, and slash on L1, which is anchored in proof of work. Ordinary PoS that secures itself with itself he calls absurd. PoS anchored into Bitcoin’s PoW is a different animal: fast settlement finality, high block rates without diluting merge-mined work hardness, slashable finality.

I warned him the phrase “proof of stake” will get him canceled by people who never read past the title. He already gets that mail. His stakechains paper opens with Andrew Poelstra’s classic arguments about why naive PoS fails, then shows how anchoring into PoW answers them. If Twitter still screams “shitcoin,” he shrugs and wants to build. Marketing departments would ban the words. He is not a marketing department. (For the covenant-flavored half of the soft-fork conversation that Season 15 also chased, see Andrew Poelstra on OP_CAT vs OP_CTV.)

Same week energy as Sergio Demian Lerner talking Rootstock, BitVM-shaped Drivechains, and making sidechains less federated. Different accents, same itch: peg BTC without begging for a soft fork first.

zkCoins, Client-Side Validation, Lamport Glue

I brought up David Cohen’s Edge Wallet comparison: confidential transactions on Liquid are roughly twenty times fatter than a vanilla SegWit spend, which is why Bitcoin never ate them. Zcash’s Halo 2 world claims shielded txs under ~200 bytes. Soft-fork Zcash tech into Bitcoin?

Robin steered to zkCoins, his client-side validation plus validity proofs design. RGB and related CSV protocols already treat Bitcoin as a timestamping and double-spend-prevention layer while histories travel off-chain. Without validity proofs, coin histories grow like trees and explode. With SNARK-style proofs, a coin becomes its own compressed history. Recipients verify subjectively. The chain only needs commitments that look like noise to everyone else. Privacy becomes a byproduct of minimizing on-chain footprint: better than confidential amounts alone, closer to full graph obfuscation.

Permissionless deployment is the cultural punchline. Like OpenTimestamps, BitVM is something you can run without asking. Salvatore Ingala’s “Merkleize all the things,” Ethereum’s optimistic rollup literature, and Jeremy Rubin’s work on Lamport signatures in Script all sit in the references. Lamport signatures are how BitVM carries state across otherwise-stateless scripts: values travel from one script and transaction to another. I joked that a marketing director would scrub Jeremy Rubin’s name (BIP 119 PTSD) and scrub “proof of stake” and scrub “BitVM” because it sounds like EVM. Robin cares about truth more than optics. That is why I like him.

I piled on the red flags for comedy: BitVM sounds like EVM, ZK from Zcash, PoS language, no laser eyes. “Are you even a bitcoiner?” He said yes, then noted the BitVM brand accidentally recruited people who secretly miss Ethereum’s buzz and wanted an “Ethereum killer” narrative. Marketing accident. Technical reality: computation stays mostly off-chain. Ethereum’s always-on-chain model scales worse than Bitcoin’s already-poor base layer, which is why they pour billions into research. Amusing theoretical point from Robin: even with ancient cryptography and a tiny research budget relative to Ethereum, nothing has dethroned Bitcoin. Designing something ten times better might be doable. A thousand times better with a billion-dollar research budget still looks hard.

Hampus of Blitz Wallet called BitVM the biggest discovery in Bitcoin history in a tweet reply. Overstatement? Maybe. Useful signal from someone Robin respects. David Bailey name-dropped Robin and Super Testnet as the new generation he is proud of. I told Robin to squeeze Bailey for grants. Robin said ZeroSync and BitVM run on research grants. Upside: culture filter. Nobody is there for the salary. Downside: slower than a venture-funded machine. He has ICO trauma from earlier shitcoin-world work. Getting paid before the work is done warps judgment. Bitcoin still lets you ship code, prove usefulness, then take donations. He prefers that filter.

Supra Cycle, Then He Had to Run

I tried to reward ourselves with the Supra Cycle meme. He thought I meant the endless “supercycle” bull market. I shared the screen: failed narratives on the left, a silly linear model to 100K on the right, Toyota Supra as 90 percent of the Lambo fantasy at 10 percent of the price, one girlfriend, stop HODLing for no purpose. He called it good advice and bolted for another appointment. I never got the deep ZeroSync dive. He had already smuggled chain-state proofs and zkCoins into the BitVM story. Another time. That later time arrived as Shielded CSV, then as {ideal}.

BitVM’s promise in this episode is still the same promise that keeps me bullish years later: permissionless development that does not wait for a soft-fork calendar. Steal the math. Keep the base layer boring. Let side systems compete. Punish cheaters on-chain only when someone lies. Build like an engineer who already learned what ICOs do to your heart.