S15 E57: Orkun Kilic on Citrea & ZK Rollups

In February 2024, Orkun Kılıç sat down with me to explain a project that most of Bitcoin Twitter had never heard of. Citrea, built by his team at Chainway Labs, announced itself as the first ZK rollup on Bitcoin, and our first conversation went out on the very day the brand came out of stealth. Some people in my audience told me I had rushed into it too fast and that it might be a scam. Seven months later, I can report that it was not a scam. Even former critics like Super Testnet and Robin Linus had started saying there was something legit about it.

So when we met again in the media room of the Proof of Work Summit in Frankfurt (thanks to Bob for organizing the event and letting us borrow the room), the mood was different. Citrea had just launched its testnet, Orkun had just given a talk on hyperbitcoinization, and he reminded me, with some pride, that "your podcast was the first one that we explained Citrea." In 33 minutes we went from the basics of rollups to ordinals, drivechains, StarkWare, ecash and the one change he would make to Bitcoin if he had a magic wand. He had also coached me on the proper pronunciation of his surname before we hit record, so any butchering that followed is entirely my fault.

Rollups vs. Sidechains, Explained Without Tears

I started with the question that every newcomer asks. What is a ZK rollup, and how is it different from a sidechain, which was the promised scaling solution for the longest time?

Orkun's history lesson was quick and clean. A sidechain, in the traditional definition, is just another independent blockchain, like Ethereum Classic or Litecoin, that happens to use bitcoin as its asset. The idea goes back to the Blockstream sidechains white paper of 2014, and in his view it "never taken off because there were a lot of problems with regards to their peg mechanism." A decade later, the peg is still the weak spot, because the sidechain remains "an independent blockchain" with its own miners or validators.

The rollup arrived in 2018, when Barry Whitehat of the Ethereum Foundation proposed using zero-knowledge proofs, which had been proven practical in Zcash and similar projects, to build something stranger. Instead of another chain, "you simply have a virtual blockchain" that executes transactions off-chain, produces a proof of execution and posts that data and the proof to the L1. The base layer does not have to repeat every transaction, and it finally knows what is happening on the L2, which opens the door to a trust-minimized two-way peg that "was previously impossible with sidechain idea."

His favorite detail is the security model. A rollup can run on a single computer that processes everything, but "that computer cannot steal money because there's a ZK proof protecting all the money." Pair that with Bitcoin, which he still calls "the most censorship resistance blockchain" despite some miner centralization, and you get the combo he is betting on: "you get cheap transactions, you get fast transactions and you still have censorship resistance." A sequencer with a cryptographic leash, in other words.

Why Bitcoin Needs a Rollup (Blame the Ordinals)

Rollups were born out of Ethereum's scaling crisis, so I asked him why Bitcoin needs one at all. Orkun's answer is that rollups are a generic technology, so much so that even Solana, which promised to do everything on a monolithic L1, now has them. As long as there is space on the base layer to post data, a rollup is "definitely more efficient than doing everything on the L1."

On Bitcoin, the trigger was inscriptions. Casey, the inventor of ordinals, found a way to put more data on the Bitcoin blockchain without changing it, and since a rollup is literally about posting data to the layer underneath, the conversation about whether you could build a ZK rollup on Bitcoin took off from there. Orkun was careful to credit the people who came before, including John Light, who had researched the topic earlier.

What surprised me is that Citrea's origin story is not about transactions per second. When the team started thinking about it, around February or March of 2023, "it came from scaling Bitcoin in terms of features." People were buying, selling, lending and borrowing ordinals directly on the L1, which he calls "extremely inefficient." It annoyed both camps.

The monetary maximalists watched their UTXO set get bloated with arbitrary data, and ordinals users suffered through three to five transactions just to make a trade. Citrea's pitch was to embed a generic EVM-style virtual machine into Bitcoin without changing Bitcoin, so that the ordinals crowd can do more powerful things off-chain, the UTXO set stays small and less data lands on the L1. Peace through compression. I like it.

Trust Minimized, Not Trustless

Here I asked the question that had followed Citrea since day one. If I understand correctly, it does not use BitVM the way some other ZK rollup builders planned to, so how does it actually work?

Orkun split the problem in two. The rollup itself is a generic machine that produces ZK proofs and sends them to the L1, so every full node of the rollup can look at Bitcoin and verify those proofs. Bitcoin Script does not need to verify anything for that part. The second problem is the bridge: Citrea wants people to use real bitcoin on the rollup, not some other asset.

That is where BitVM comes in, and Orkun was honest about the guarantees. BitVM makes the bridge "trust minimized not trustless," because it emulates a ZK verifier with a one-of-n trust assumption. With a covenant like OP_CAT, he said, "we can actually build a ZK verifier" directly in Script and have fully trustless ZK rollups on Bitcoin.

(For the curious: Chainway's BitVM-based bridge is open source under the name Clementine. Orkun did not name it in this episode, but it is the work he means when he says one of his teams is focused on ZK verification on Bitcoin.)

That distinction matters, and it is the kind of nuance that earned the project its grudging respect from people like Robin Linus, who invented BitVM and had been among the skeptics before he came around.

Seventy Layer 2s and Only One Real Rollup?

I reminded Orkun that, after Citrea's launch, a whole wave of self-described Bitcoin L2s appeared, Alpen Labs among them, and that I had heard surprisingly little from most of them since. He pointed me to Bitcoin Layers as the place to compare them, and offered a sobering count: around 70 or 80 projects claim to be Bitcoin L2s, probably half of them say they are rollups, "but if you look at the technology it's not a rollup."

His claim, which I am reporting rather than certifying: "if I'm not mistaken today we are the only real rollup" that is working, has an open source code base and runs on testnet. He was friendly about Alpen Labs, whose team members were at the same conference, but noted that their product was not live yet and, as far as he knew, not open source, so "I cannot verify whether they're building a rollup or not."

I also brought up Edan Yago of BitcoinOS, who had claimed that his team was the first to verify a zero-knowledge proof on Bitcoin. Orkun did not dispute the milestone. He said they may well have been the first to verify a ZK proof with their BitSNARK framework, but "building a ZK rollup and verifying a ZK proof is not very correlated." Inside Chainway, he explained, those are two separate teams, each with more than eight or nine people. Building the rollup is a lot of work. Verifying a proof is one piece of it.

What Does a HODLer Actually Do With Citrea?

This was my favorite question to ask, because most bitcoiners look at all this fancy tech and have no idea how they would use it. Orkun said I was the first podcaster to ask him which wallets people should use, and admitted that builders often assume everyone knows how to use EVM wallets. They don't. Most people at the summit, him included, were using Lightning and Bitcoin-native wallets.

So he compared Citrea with Lightning. On Citrea you get an address derived from your seed phrase, fully non-custodial, and "it's a really static address that you can share with anyone." Nobody has to create an invoice and wait, you can receive payments even when you are offline, and you never have to think about inbound or outbound liquidity. You just have an account with an address and a balance.

But payments are not the point. The real pitch is smart contracts, and Orkun's example is painfully familiar. You don't want to sell your bitcoin, but rent is due, so you hand your coins to a custodial lending desk and hope.

"Who knows whether you can get your Bitcoin back," he said. On Citrea, the lending, borrowing, stablecoin and even private payment applications can be smart contracts. I summarized it as BlockFi, the lender that went bankrupt, rebuilt as code you can audit instead of a company you must trust.

He agreed: "it's a code that everyone can see and everyone can audit." If the conditions are never met, "the Bitcoin never leaves that smart contract." His shopping list for the ecosystem: think BlockFi, think Coinbase, think perpetual DEXes, think prediction markets, all built in a non-custodial way on Bitcoin.

My Sponsors, His Competitors

Then came a slightly awkward moment that I had engineered on purpose. Two sponsors of my show at the time were, in their own ways, competing with Citrea, and I wanted Orkun to explain the difference on air.

The first was LayerTwo Labs, which is building drivechains to deliver sidechains close to what was promised in 2014 and 2015, one sidechain per use case. Functionally, Orkun conceded, the two approaches are not that different. Someone will build an EVM sidechain and get similar features. Security is another story. Drivechain assumes miners are honest about approving withdrawals, and that is independent from them being honest about mining Bitcoin. "It's a different trust assumption that I don't like," he said. Citrea, in contrast, sends all its data to the Bitcoin blockchain itself, not to some other chain.

He was also skeptical about drivechain's chances. It depends on a BIP, which means a soft fork, and "I'm very suspicious that it will ever get accepted." By his count the proposal has been around for six or eight years without significant support, compared with the attention OP_CAT and CTV get, and he mostly sees Paul Sztorc (and sometimes Robin) pushing it. Paul would certainly disagree, and he made his case on my show in S15 E16.

"I don't think that's going to work well," he said, because in case of a malicious fork on either chain, "you can just lose your assets." He also pointed out that Starknet uses its own VM, which, despite some creative applications, has not taken off after about three years live. The EVM, on the other hand, comes with documentation, videos, guides and hackathons.

His biggest argument was about timing. Citrea is live on testnet "even without" a covenant, so "we don't depend on any soft fork." First show bitcoiners that they can borrow against their bitcoin without losing custody, and then let them decide whether a soft fork to make it trustless is worth it. In his words, "first getting live and showing a use case to bitcoiners is important for social consensus."

I added that the coolest part about both sponsors is that they let me criticize them in interviews. Orkun's verdict on the competition was generous: "better options, better competition, better products and that's that's good for Bitcoin."

The Road to Mainnet

Asked about the future, Orkun warned me it is a long-term goal with a lot of work ahead. After mainnet, Citrea plans to introduce decentralized sequencers to reduce the trust in the sequencer and raise censorship resistance. Then comes native account abstraction, which lets you program your own account cheaply, for example to block yourself from spending more than 0.01 bitcoin per day, "and that's all in your control." Finally, a volition model would offer even cheaper transactions by skipping Bitcoin for data availability and relying on Citrea's peer-to-peer network instead. That adds a trust assumption, but it is optional.

None of that matters without users, and he said so himself: "if you build all this stuff and we don't have any use case then it means nothing." The end goal is to have applications ready for bitcoiners, with various trust assumptions, but always non-custodial.

As for what changed since our February chat, the answer was a lot. "Six months ago Citrea was merely a design and proof of concept code base," as he put it. Since then the team announced a fundraise, open sourced its code on GitHub, started accepting outside pull requests ("we accept PRs"), contributed to the BitVM repos, funded research grants at local universities and shipped a devnet followed by the testnet. The testnet, which shows exactly how much Bitcoin block space Citrea uses and what fees will look like, is "probably the biggest milestone that we had so far." Mainnet was next on the list.

A High Five Against Ecash

Orkun had just presented on hyperbitcoinization at the summit, framed around bringing bitcoin back into the economy without custodial shortcuts. Next on his tour were Hackers Congress in Prague and Bitcoin++, and along the way he planned a presentation on why ecash is so bad and ZK is better. He expected "a very interesting crowd," and I believe him.

I asked if I could high five him for that part, and I did. His argument: ecash "was a great experimentation 40 years ago but not anymore," because "we have Bitcoin which is better digital money," and now people are turning it back into a custodial solution with excuses like using small mints for small payments. He sees the same custodial gravity in Lightning's requirements, and blames it on the lack of primitives to build directly on Bitcoin.

On privacy, he kept it modest. Citrea is a public ledger, much like Bitcoin, but with a full VM people can build private systems on top, such as dark pools, private payments or something like Tornado Cash. "I'm not promoting" any of it, he said, but "privacy is needed for the future," and Citrea's job is to be generic infrastructure that "doesn't promote like or demote anything."

If He Could Change One Thing About Bitcoin

My closing question is always the same: if you could add any BIP, soft fork or hard fork to Bitcoin, what would it be? Orkun warned me up front, "I have a lot of bias on this," and then said that ZK proofs should have been discussed much earlier, because Bitcoin has problems with privacy, verifiability and small block space.

He reminded me that zero-knowledge proofs were introduced in 1985, older than Bitcoin itself, and dated the first practical implementation to Zerocash (he said 2012, though the Zerocash paper came out in 2014). His wish is a ZK covenant or a "pay to ZK address" type in Bitcoin, "because it can solve a lot of problems with privacy and scalability." Then he laughed it off: "that's my biased answer."

He also had a softer wish. He likes Bitcoin's culture of overwhelming consensus discussion, but "I wish like people just listen each other more carefully," and he would prefer upgrades to come every two years or so instead of taking this long.

Looking back, this interview captures Citrea right at the moment it stopped being a promise and became a testnet you could actually poke. Two years later, the Chainway crew is still on my show: Ekrem Bal of Citrea stopped by my TABConf 8 livestream in S17 E47 to explain the project's pivot to privacy. If you want the origin story first, start with S15 E18, and then come back here to see how the people who called it a scam ended up eating their words.

Listen to Orkun Kilic on Spotify, Apple Podcasts, YouTube, and More

Watch on YouTube

Time stamps:

00:02:02 – Rollups vs. Sidechains
00:04:18 – The Need for Rollups in Bitcoin
00:06:29 – Citrea's Unique Approach
00:08:08 – Building a Generic Virtual Machine
00:09:10 – Citrea as the First ZK Rollup on Bitcoin
00:09:56 – Comparison with Other Projects
00:12:08 – Use Cases for Average Users
00:14:44 – Citrea & Non-Custodial Financial Services
00:16:30 – Citrea vs Drivechains
00:17:05 – Differences in Trust Assumptions
00:18:14 – Drivechain Proposal History
00:19:13 – StarkWare and Zero Knowledge Proofs
00:19:35 – Technical Limitations of Starknet
00:20:24 – Building Non-Custodial Solutions
00:24:05 – Future of Citrea and Decentralization
00:26:14 – Progress Since Last Interview
00:28:03 – Presentation on Hyperbitcoinization
00:29:37 – Privacy Benefits of Citrea
00:30:49 – Potential Changes to Bitcoin