S15 E49: Edan Yago on BitcoinOS, Permaware & Scaling Bitcoin with ZK Rollups

When Edan Yago asked if he could come back on the show, my first reaction was a polite double take. Didn't you already join? He did. We recorded S15 E5 in Buenos Aires at Labitconf, about nine months earlier, when he was the Sovryn contributor making the case for Bitcoin DeFi on the Rootstock sidechain. But a lot had happened in those nine months. In April he co-authored a paper with Ariel Futoransky and Gadi Guy. In July, while the rest of us were in Nashville for Bitcoin 2024, his team at BitcoinOS announced that a zero-knowledge proof had been verified on Bitcoin mainnet for the first time, with the final verification confirmed in block 853626.

So yes, he earned a second seat. Except he did not sit. This was the first interview in the history of the show where the guest stood for the entire livestream, gesturing like a professor at a whiteboard. "Gotta use your hands," he said. "It's a very important time for Bitcoin, so we've all got to get up and do our part."

What followed was 80 minutes of BitSNARK, Grail, covenants without a soft fork, rollups that make sidechains obsolete, a new trust assumption he calls the honest singleton, a 2014 conversation with the inventor of Lightning, and a man who calls himself a Bitcoin accelerationist while begging everyone to stop changing Bitcoin. He also managed to disagree with two of my sponsors on air, which I will get to.

An Operating System for Money

I started with the obvious one: what is BitcoinOS, in a nutshell? Edan went straight to first principles. All of computing is zeros and ones, and from zeros and ones we built the internet, software and AI. Bitcoin is a shared computing system too, "but it is extremely limited in what it can do." Today you mostly use it to move BTC from one holder to another.

BitcoinOS, in his words, is "the tools which turn Bitcoin into a shared computation system," a smart contract system where all kinds of computation can be executed and secured by Bitcoin. And for him the consequence goes far beyond features. "It means permissionless upgrades," he said. "It means developers can now do anything that they want with Bitcoin without having to ask permission from anyone else and without impacting the Bitcoin consensus code." Scalability, rollups, smart contracts, DeFi and, the part he knew I cared about, native privacy.

BitSNARK, Grail and a BitVM Built Like an ASIC

I assumed the Nashville transaction used BitVMX, given his history with the Rootstock crowd. "No, no, no," he corrected me. The paper he co-authored is called BitSNARK & Grail, and it describes two things that build on each other. BitSNARK is the ability to verify ZK proofs on Bitcoin. Grail is the ability to bridge BTC, ordinals and runes into other environments and back, and, more importantly, to let computation happening elsewhere "actually interact with and execute on layer one."

Since I had already hosted both Robin Linus on BitVM and Sergio Demian Lerner this season, I asked how BitSNARK differs from the rest of that family. Edan explained the shared idea first: inside a Taproot tree you can encode a huge number of potential transaction outcomes, turn them into zeros and ones, and effectively write a smart contract into a Bitcoin transaction.

The difference is ambition, or rather the lack of it. Instead of a general purpose computer, BitSNARK is "a little bit more like an ASIC." It is designed to run one specific program, ZK verification, and as a result he claimed it is "over a thousand times more efficient," much simpler, easier to audit and, "perhaps most importantly," possible to actually build. He noted that Robin had since moved on to BitVM2, having concluded the original BitVM would end up too large and complex. "We demonstrated that this original idea actually could work and implemented it on mainnet."

The demo itself was aimed at one of Bitcoin's longest-running arguments. Everyone has been debating covenants, OP_CTV or OP_CAT. "What we did at Nashville on mainnet is we showed how we can actually emulate conditional payments, covenants, without any changes to Bitcoin at all."

The Accelerationist Who Wants Bitcoin Frozen

None of this would exist without Taproot, and Edan thinks we have barely scratched it. For a long time after activation, Taproot "seemed like it was totally useless," until Casey Rodarmor introduced ordinals, the first real new use case that did not need a consensus change. "I think that was absolutely the simplest thing that we can do with Taproot," he said. "There's so much more to explore."

Then he laid out the two ideas that most people consider contradictory, and that he holds at the same time. On one hand, "I'm a Bitcoin accelerationist." He wants Bitcoin to back stablecoins and to host a full financial system for trading, borrowing, lending and earning yield, without intermediaries. On the other hand, he does not want anyone to change Bitcoin, because what makes it special is that it is permaware: not software, not hardware, but something that does not change.

His comparison with Ethereum was savage. A "council of wise philosophers" decides which EIPs to add and how to tweak the monetary system, and the result is "like Windows 95," a "massive spaghetti code that no single person in the world fully understands." You know Ethereum will look different in six months, so it cannot be the stable ground for global consensus. His fear is that as accelerationists get louder in Bitcoin culture, they will push for more BIPs, and that is "a very big risk to the fundamental philosophy" of the network.

Scaling Without Bigger Blocks

Bigger blocks are not the answer for him, and neither are soft forks. Shoving more things into layer one "is an absolute mistake." Scalability comes from moving activity off mainnet and using mainnet as a settlement layer. Because BitcoinOS can verify succinct proofs, thousands of transactions can be aggregated into a single proof, and one Bitcoin transaction can do "the final sort of netting out" and redistribute the coins. Rollups go further by adding rule sets, so you could have environments compatible with Ethereum or Solana, high frequency trading or BTC lending, with computation off-chain and the final transactions on Bitcoin.

For listeners new to the jargon, he gave the classic nightclub example of a zero-knowledge proof. You scan your ID at the door and get a green or red light. Green means you are old enough to drink, but nobody learns your birthday, name or address. That compression is the point, and he described it beautifully: ZK "gives Bitcoin eyes for the first time," a way to see what happens outside the chain. "But its eyesight isn't amazing, so we need to be able to provide it with highly precise and compressed information."

What Actually Happened in Nashville

I wanted to know what the mainnet demo really proved, because "first ZK proof on Bitcoin" is the kind of headline that makes people roll their eyes. Edan broke it into three firsts. The coins were locked in a UTXO with no owners: "It wasn't a multisig. It was a UTXO that was basically owned by the proof." Second, the coins were sent to an arbitrary address that was not known in advance, something even a DLC cannot do. Third, the spend was triggered by a mathematical proof of computation that happened off-chain.

The next step, which he said would come over the following months, is a whole environment that is "like a child of Bitcoin," EVM-compatible, using BTC instead of ether and able to work with runes and ordinals. All state changes get aggregated "once every 10 minutes into a Bitcoin transaction."

MEV, Block Space and the NASDAQ Analogy

Anything that makes Bitcoin more expressive triggers the MEV objection: miners might start reordering or leaving transactions in the mempool based on what they can extract. I asked if base layer privacy would help. His answer was a clean no, because he does not think the problem exists on mainnet in the first place. Front running and sandwich attacks could happen inside a rollup where people agree to participate. On mainnet, transactions go through or they don't, based on "a very, very simple rule, which is who's paying the most."

What will change, he said, is the value of block space. "I suspect that in two years we'll be talking about Bitcoin block space," only four megabytes every 10 minutes, "as the single most rare, scarce, valuable digital asset, digital real estate in the world." BTC becomes easier to explain as the only currency that buys it.

How does DeFi survive 10-minute blocks? "You don't actually wait 10 minutes for confirmation, you wait 10 minutes for settlement, which is a totally different thing." He compared it to the NASDAQ: you trade instantly, but settlement between brokers and prime banks takes about three days. With Bitcoin as the settlement layer, call it an hour for six blocks. In the common rollup design, a big, replaceable sequencer orders transactions transparently, which gives speed and low cost, and then writes everything to Bitcoin.

Rollups vs Sidechains, and a Punch at My Sponsors

For years the scaling dream was sidechains. Now everyone talks about rollups, especially ZK rollups, and Edan did not hedge. "I think in many ways rollups make sidechains obsolete." Every sidechain that actually shipped has its own consensus, whether Stacks with STX staking or Rootstock with merge mining. They are less secure than Bitcoin, they do not settle to Bitcoin, and they lack trustless movement of BTC. A sidechain is "more like a really good friend for Bitcoin," while a rollup is "an actual extension of Bitcoin."

I asked whether better sidechains, like drivechains, would also produce cheaper rollups. He said he was "a huge supporter" of BIP 300 and called Paul Sztorc "a warrior," but felt "that fight should be over now," because what Paul was asking permission to do, "I think we can now do permissionless and even better with rollups."

Which was awkward, because this episode was sponsored by LayerTwo Labs. I read the ad anyway: zSide, an Ethereum sidechain, an assets sidechain and a prediction market sidechain, all testable on signet. Earlier I had also read the Starknet spot about OP_CAT. Edan noticed. "It feels like you've brought me on to take a punch at every single one of your sponsors," he laughed. Later he said he would happily debate Paul. I am holding him to that.

The Honest Singleton

There is a trade-off, and Edan named it unprompted. Since BitcoinOS does not use an opcode, miners are not verifying the ZK proof directly. Instead, a set of operators watches, and if one tries to push a false transaction, any other operator can challenge it. "The person who's challenging it will always, always win," because it is mathematically guaranteed, and they get paid for it. But somebody has to show up.

That creates what he calls a new trust assumption for Bitcoin: "the honest singleton." A federation like Liquid needs an honest majority of its signers. Here you need one of n. "If there are a thousand different operators and just one of them is honest, that could be you, then the whole system cryptographically maintains its integrity."

A listener on Twitter wanted him to admit this is optimistic verification, not real ZK verification. Edan agreed with the first half. If nobody challenges, the transaction "sails through," fast and cheap. If someone does, "you actually go through the computation of verifying the ZK proof directly, and that is absolutely a verification."

Network Effects and the One Chain Thesis

His team's outreach person had sent me a list of questions, and I used one: will rollup activity dramatically change mining economics? "Much, much, much bigger," Edan said. He claimed Ethereum stakers, rollups and sequencers together earn "probably 2x" what Bitcoin miners make in dollars, from a smaller ecosystem.

But would Ethereum developers really rebuild everything? He said they would not have to. Within about three months, through Sovryn, they planned to demonstrate porting smart contracts directly from Ethereum to Bitcoin: "All I need to do is take my deployment script and run it on Bitcoin." Ethereum thinks of itself as the network, he argued, but the real network effect is Solidity and the EVM, which can now come back home.

Every new industry fragments and then consolidates, he said: cars into GM and Ford, oil into Standard Oil, a thousand networks into the internet. "10 years from now, we're all going to be talking about one chain, and that's going to be Bitcoin."

I pushed back with Eric Voskuil's view that Bitcoin scales through its forks, Monero as Bitcoin with privacy, Litecoin as the faster one. Maybe the world gets priced in 21 million bitcoin plus 84 million litecoins and some Monero. Edan granted that alternatives will exist, as mesh nets coexist with the internet, but each altcoin answered one question: what can Bitcoin not do? "If the answer to that question becomes nothing," the monetary network effect wins.

Native Privacy on Bitcoin

This is where he got the most animated. "The number one thing that you can do with ZK technology, the primary reason it was invented, was to create privacy." You lock BTC in an address owned by no one, many people deposit, perform secret transactions and redistribute to new addresses. Everything needed for it already exists on Bitcoin, he said, and it would be "a more powerful form of privacy than we can get with mixers."

He went further and predicted that within a year he would help bring private addresses on a privacy-focused Bitcoin rollup, a UTXO system where you trade on DEXs, vote in DAOs and swap tokens, and observers "can see the activity but they don't know who's doing it." I thought it sounded like Ethereum's account model; he corrected me that they would use UTXOs.

I gave Counterparty its due, a 2014 meta-protocol that hid data in OP_RETURN outputs. On costs, Edan said settlement transactions in their tests cost about $150. If that went up 10x to $1,500, it would still be spread over thousands of transactions, so users should pay "a few cents."

Citrea, Alpen and BOB

What about the other teams building Bitcoin rollups, like Citrea and Alpen Labs? Edan said BitcoinOS can give them the technology to become real rollups and make them interoperable. "Right now, the only way that you can actually prove ZK on Bitcoin and actually build a rollup on Bitcoin is utilizing the BitcoinOS system." Should they switch? "Yes." He understands that founders want to own their ecosystem, but that risks fragmenting Bitcoin more than it needs to be, and he said some of them already planned to build on BitcoinOS.

I told him about Nashville, where Alexei Zamyatin sent me about $10 on BOB, an email-based wallet with no seed words, which I used to buy merch with wrapped BTC. Would BitcoinOS make it obsolete? Not at all. He wants to plug BOB in and use it "as this massive magnet," a conduit for the Ethereum ecosystem. At this point I confessed I was trying very hard to make him say something controversial and he was "just so nice and cheerful and optimistic about everything."

OP_CAT and the Corrosion of Soft Forks

So I tried covenants again. Would OP_CAT make BitcoinOS more powerful? Yes, he admitted, it would make what they do "much easier." And yet: "I am not convinced that I want OP_CAT," because "with each soft fork, we get a corrosive element to the culture of Bitcoin." His test for any soft fork is simple: "Does it bring us closer to the day that we never have to do that again?"

He praised the Taproot Wizards and their Quantum Cats as "a clever way of explaining a complicated concept," but said the debate was "pretty shallow." "If you're not talking about the trade-offs, you're not really having a conversation, you're just taking a position."

When I asked for a concrete attack using OP_CAT, given that it already lives on Liquid and BCH, he admitted he did not know one. But nobody foresaw what Taproot would enable either, and now ordinals and rollups terrify people. "I'm the one attacking Bitcoin, right?" he joked. His real concern is cultural: he wants Bitcoin's culture "to harden, to ossify as much as possible," knowing he is in the minority even among accelerationists. "I wouldn't be me if I didn't disagree with everyone on everything."

On availability, he said some code was out, with the ability to create your own proofs coming soon, and he put "80% confidence" on a user-friendly release by year end, "certainly by mid-January." For the record, BitcoinOS open-sourced BitSNARK v0.1 in September 2024.

Sovryn Isn't Going Anywhere

I suspected he was pivoting away from Sovryn. "Not at all. I am more excited about Sovryn than ever before." Sovryn is the largest DeFi ecosystem for Bitcoin, he said, but it holds only wrapped bitcoin on a sidechain. "There will be a Sovryn rollup," with Bitcoin-backed stablecoins, trading and yield "in the most trust minimized way." Chat users asked whether the SOV token would migrate. He said it would be among the first use cases.

Decentralization Is an Onion

A viewer asked whether it is better to freeze the code or change it to preserve Bitcoin's revolutionary properties. Edan's answer was the philosophical core of the episode. "The most important property is that it doesn't change." Then: "Decentralization is not a goal, it's a tool," and the tool exists to build a system nobody controls or censors. Every change requires a soft, touchy-feely consensus, which creates a group able to change Bitcoin.

So he wants more layers of decentralization, beyond miners and nodes: more users, more rollups, less Bitcoin parked on exchanges. Each rollup makes Bitcoin "harder to change, harder to manipulate." He compared it to "an onion," layers added "not because decentralization is the goal, but because censorship resistance" and permaware are.

A Lightning Skeptic Since 2014

Covenant advocates often say they need covenants to scale Lightning, so I noticed Lightning was missing from his story. "I am a bit of a Lightning skeptic and have been for almost 10 years now." Then he told me something new. According to Edan, Tadge Dryja started working on Lightning while at a company Edan was running, one of the first remittance businesses to use Bitcoin, and he showed Edan the channel idea.

"I told him that I didn't think it would work," because pre-funding channels would be too expensive. Ten years later he credited Tadge and the ecosystem with "a magnificent job," but said "I don't think it works, for exactly the reason that I didn't think it would work 10 years ago." He still sees value for large, well-connected nodes with lots of two-way flow, a small niche.

We agreed on custodial Lightning. With Fedi launching and Cashu mints spreading with Jack Dorsey's support, I called it giving up on the mission. "I really hate that we've been moving more and more in this direction of innovation on Bitcoin which is custodial," Edan said. If it were a gateway drug toward self-custody he would cheer, but he sees "dead ends." He floated replacing Fedi's multisig with a ZK smart contract and invited someone to fork Fedi with BitcoinOS.

Cold Storage, Nodes and a Token

Unlike Lightning, BitcoinOS wallets will not need you online, and hardware wallets should be fine. "It will feel and behave just like Bitcoin," he said. "You're not changing it, you're expanding its scalability." Anyone will be able to run a full node: a Bitcoin node plus the node of whichever rollup you use.

Then came the question every livestream gets: will there be a token? "I think it will." A decentralized system needs uptime, liveness and motivated operators, basically "a service level agreement for a decentralized system." He also has a philosophical reason. "One of the most poisonous ideas in Bitcoin is that we should only ever use BTC." A currency needs an economy, which means other assets. I noted that ordinals gave people a reason to run full nodes for the first time, and he agreed node operators could earn rewards, likely in the Sovryn token.

Bitcoin Gets Its Mojo Back

At the end, after more than an hour on his feet, I asked what I had missed. Forget Trump, ETFs and regulation, he said. "The most exciting thing happening in Bitcoin right now is that Bitcoin is getting back its mojo." Permissionless innovation had returned, and with it the smartest people and the sense of adventure of the early days. His prediction: "2025 is going to be the most exciting year for Bitcoin since 2008."

No price target, though. "I bought my first bitcoin in 2011, and I haven't sold a single bitcoin since." He plans to live on yield from lending and pass the rest "to my children and my grandchildren."

You can follow him at @EdanYago, BitcoinOS at @BTC_OS and Sovryn at sovryn.com. For the backstory, go back to our Buenos Aires conversation about Sovryn, and for the drivechain side of the argument, my talk with Paul Sztorc on scaling. Paul, Edan, the debate invitation stands.

Listen to Edan Yago on Spotify, Apple Podcasts, YouTube, and More

Time stamps:

00:00:45 – Introducing Edan Yago... again in season 15!
00:02:36 – BitcoinOS, The Shared Computation & Smart Contract System for Bitcoin
00:05:55 – Introduction of BitSNARK
00:06:13 – Emulation of Conditional Payments Without a Covenant Soft Fork
00:06:51 – BitSNARK vs. BitVM
00:09:37 – Taproot's Untapped Role
00:13:14 – Scalability of Bitcoin
00:15:39 – Understanding ZK Proofs & Rollups
00:17:35 – Defining Zero Knowledge Proofs
00:20:13 – Potential of ZK in BitcoinOS
00:20:41 – Bitcoin's Unique UTXOs with ZK Proofs
00:21:45 – Future of Bitcoin Transactions
00:22:58 – Scalability and Bitcoin Transactions
00:23:15 – Concerns About Miners' Incentives
00:25:29 – Value of Bitcoin Block Space
00:26:48 – DeFi and Bitcoin Settlement Time
00:29:04 – Rollups vs. Sidechains
00:31:30 – Permissionless Innovations
00:35:22 – Trust Assumptions in BitcoinOS
00:36:34 – Optimistic Verification Explained
00:39:09 – Economic Shift in Bitcoin Mining
00:40:42 – Importing Smart Contracts
00:41:08 – Fragmentation and Consolidation
00:44:46 – Bitcoin's Monetary Network Effect
00:45:45 – Native Privacy in Bitcoin
00:47:10 – Creating Private Addresses
00:48:37 – Counterparty and Historical Context
00:49:45 – Transaction Costs in BitcoinOS
00:51:07 – Interoperability with Existing Projects
00:53:55 – Value of Existing Systems
00:55:10 – Covenants and Soft Forks
00:57:37 – Trade-offs of Soft Forks
00:59:25 – Concerns about Unintended Consequences
01:00:12 – Cultural Hardening of Bitcoin
01:01:04 – Testing Zcash Transactions
01:01:19 – User-Friendly Software Implementation
01:04:01 – Excitement for Sovryn & Rollups
01:05:28 – Philosophical Debate on Bitcoin Code Changes
01:06:56 – Decentralization as a Tool
01:08:14 – Role of the Lightning Network
01:11:44 – Custodial Solutions vs. Self-Custody
01:15:12 – Cold Storage Capabilities in BitcoinOS
01:15:47 – Running a BitcoinOS Node
01:16:14 – Token Necessity for BitcoinOS
01:18:02 – Encouraging Node Operation with Tokens
01:19:47 – Bitcoin's Resurgence
01:20:47 – Long-term Commitment
01:21:09 – Living Off Bitcoin
01:21:32 – Following Yago and Projects
01:22:29 – Conclusion