S15 E59: David Burkett on MWEB & Litecoin Privacy

Some of the best conversations at a conference happen in the ten minutes before someone drags your guest away for a group photo. That is more or less how this one ended. I caught David Burkett at the Proof of Work Summit in Frankfurt, sat him down in a noisy corner, and asked him to explain the piece of cryptography he spent years of his life turning from a forum curiosity into live code on a top-20 coin.

The thing is MWEB, the MimbleWimble Extension Block. If you have followed the show, you have heard about it from the other side of the table: Charlie Lee pitched it here back in S11 E5, long before it activated on Litecoin in 2022. As I put it in my intro, the idea dates back to Andrew Poelstra in 2015 or 2016, "but it was just an idea. It was never coded. And this is the man who made it happen."

David is the Grin++ developer, the guy who wrote an entire MimbleWimble node in C++ for fun before Litecoin came knocking, and a co-author of the two Litecoin Improvement Proposals that define MWEB. He is also one of the most refreshingly modest privacy engineers I know, someone who flinches at the words "privacy coin" and openly admits he could screw up an implementation. Forty minutes was not a lot of time, but we covered Grin's rise and fall, stealth addresses, peg-out leaks, coin swaps, a multi-coin future and, inevitably, drivechains.

An Anonymous Drop, Refined by a Wizard

Before I could finish crediting Poelstra, David politely corrected the history. "It was actually even before Poelstra," he told me. "It was like an anonymous drop and then he refined it." That drop was the original MimbleWimble text, signed "Tom Elvis Jedusor" (Voldemort's French name, for the Harry Potter fans) and dated July 2016, which Andrew then polished into a proper paper. David also reminded me that Poelstra "also proposed the extension block" route for Bitcoin.

That stung a little, because I had interviewed Andrew earlier in the year for S15 E17, and he had told me roughly that it was cool to see Litecoin pull it off, but that MimbleWimble isn't very relevant for Bitcoin anymore in the post-Taproot era. I admitted to David that I was a bit disappointed. He shrugged it off with a line every Bitcoiner should tattoo somewhere discreet: "You know, fads that come and go for Bitcoiners. It was the greatest thing and then they moved."

He was careful not to call MWEB itself a fad, though. His hope is more humble and more interesting: "I hope that in 10 years from now we have really, really cool privacy tech and that maybe we'll be regretting our choice of MWEB, or maybe find a way to scale it."

How a Grin Developer Ended Up Working for Charlie Lee

The way I remembered the origin story, Charlie had been reading about confidential transactions created by Adam Back and Greg Maxwell at Blockstream, stumbled on MimbleWimble, and first tried to work with the team behind Beam. Only later did he find "this very smart Grin++ developer," which is Grin written in C++.

David confirmed the Beam part without any drama. "The Beam guys, I like them. They're smart people," he said. "They had so much they were trying to ship," and they simply did not have resources to dedicate to Litecoin. Meanwhile, David was looking for his next challenge. He had already done a lot with MimbleWimble, "but then we just had these small ecosystems" that "weren't really mature at all." What he wanted was to see the tech running in "a large, mature ecosystem, basically." Litecoin, with its exchanges, wallets and a decade of history, was the perfect lab.

MimbleWimble in Plain English

I asked him to break it down for people who have never heard of Grin. His explanation was one of the cleanest I have recorded. MimbleWimble, he said, is a clever combination of two ideas: confidential transactions, "which just means hidden amounts," and something like a CoinJoin mechanism that "combines all the transactions, all the inputs from one, from all of them, and the outputs from all of them into one big transaction to help eliminate the privacy leak that comes from transaction graphs."

Glue those together with "some clever proofs based off Pedersen commitments and just some really simple math, actually," and you get a chain where you can still verify that no coins were created out of thin air. Grin was the first implementation, built in a very cypherpunk way. "There were a lot of pseudonyms working on it," David recalled, and plenty of smart people from outside the Bitcoin community contributing. After almost three years, Grin was born.

Then it struggled. I reminded him how hyped Grin was at launch. In my memory, it was the most exciting grassroots privacy project since Monero, something purely driven by users. Then came a report claiming you could watch the network and surveil Grin transactions, and many people gave up on it. David's take on that moment is honest and a bit sad. Adoption was already slipping and big early supporters had left.

The report, in his words, "was sort of like stating the obvious," the equivalent of announcing that "if only one person is transacting a minute, I can tell only one person is transacting a minute." It was well written, but it "looked like a big hit piece," and for the people who were already struggling to stay interested, it was "the nail in the coffin."

I also passed along greetings from Marek Narozniak, the physicist who joined me in S15 E37 to talk MimbleWimble and quantum computing, and who very much looks up to David. Marek's one complaint was that David sometimes takes a month to reply to emails. David took it with a laugh: "I enjoy working with him. He's a very smart guy, too."

Why Boring Math Still Matters

So why is MimbleWimble still relevant in a world of fancy zero-knowledge rollups? Because it is boring, in the best possible way. It provides practical privacy "in a very scalable manner without introducing any kind of complex new primitives," David explained. "There's no like crazy SNARKs or anything like that."

That simplicity is a security argument. MimbleWimble is "very simple to audit, simple to understand for anyone with any kind of crypto background," whereas Zcash runs on "really fancy stuff" that requires putting a lot of faith in a small group of people. He acknowledged that ZK proofs have become more approachable lately, but "still there's nothing so simple," because MWEB is based entirely on the same cryptographic primitives that Bitcoin and Litecoin already use for everything else. No drastic security adjustment required.

Stealth Addresses and the Interactivity Problem

Here is where MWEB parts ways with Grin. In its purist form, MimbleWimble has no on-chain addresses at all. "One of the hurdles with pure MimbleWimble is that you can't just send to someone offline," David said. "You have to actually communicate with the person you're sending to, there's a back and forth protocol." Grin's addresses are really meeting points: the wallets first try to talk over a Tor onion address, and if that fails, you encrypt a packet, hand it over manually, and wait for the recipient to sign it and give it back. That interactivity "led to a lot of issues with adoption for Grin."

Litecoin could not live with that. Exchanges and wallets expect to send instantly to a static address. So MWEB adopted stealth addresses, "based off the stealth address technologies used in Monero and some other coins," where the sender generates fresh one-time addresses from a couple of public keys, so there is no address reuse. David admitted he had "serious concerns early on" about whether this would work with the existing ecosystem. It did, but not without homework: "We worked with some academics on it. We worked with some auditors," and in the end, "we were able to fortunately find a very good solution, I think."

The other half of the job was user experience. In Litecoin Core, he said, the focus was on making sure "first off it works seamlessly," so ordinary users don't need to know what happens under the hood, while also "choosing private defaults. Because if you just send whichever, whatever, you can lose the privacy benefits."

Counting the Kinds of Privacy

I tried to get him to grade MWEB on four kinds of privacy: sender, receiver, amounts and network level.

Network level was the quickest answer. MWEB doesn't "do anything particularly new there." You can run your node over Tor, use a VPN, and follow the same practices as with normal transactions.

Receiver privacy goes back to Satoshi. The whitepaper already says that a new address for every payment gets you pretty far, until you combine multiple inputs and give chain analysts a clue about who owns what. MWEB doesn't make input linking vanish completely, but it gets "much closer to Satoshi's vision for what good privacy would be."

Sender privacy, David said, is really about input selection, and it "would rely strictly on the sender making smart choices, which we always try to do the best we can for you." Litecoin Core leans on the research into coin selection algorithms, but "if you're an advanced user and you understand UTXO management," you'll do even better.

Amounts are the strong suit. "Yes, it's very good at that," David said, then added the caveat that makes him trustworthy: it is not perfect "because of the peg-in, peg-out mechanism." If you peg in and right back out, someone may be able to put a range on your amount. "But if you're using good practices and you're keeping your coins on the MWEB side," you end up with perfect amount privacy.

The Weak Link Is the Exit

I mentioned that Charlie once suggested CoinJoining into MWEB and CoinJoining back out. David said a peg-in already behaves a little like a CoinJoin, but whether it adds a real advantage "gets a little complicated." His advice is simpler: "The weak link there is the peg-in, peg-out mechanism," because you have to interact with the transparent chain, which doesn't have the automatic CoinJoin. "So the key to improving your privacy is always going to be limit main chain use."

I also asked a nerdy question I had never tested myself: can one transaction spend an MWEB input together with a regular chain input? It can, and it works nicely. You peg in and the MWEB transaction pegs out all in one go, so observers "don't even see the link from peg-in to peg-out."

When I brought up Wasabi Wallet's then-new feature that lets you pay directly from a CoinJoin, David got visibly excited. He mentioned that a coin swap service, where you hand over "a dirty UTXO" and get "a clean one that's mixed with lots of other users," could one day include a send to someone else at the same time. "There's a lot of interesting research into this."

Please Don't Call It a Privacy Coin

Naturally, I asked whether Litecoin is now the most liquid and most listed privacy coin. David squirmed. "I'm very hesitant to label anything privacy," he said, and pointed out that you can still screw it up. MWEB "has good privacy against many attacks," especially the practical ones everyday people worry about, but that does not mean you can do whatever you want. It's best, as he put it, "to understand what its capabilities are and what its limitations are if you want to really preserve your privacy." If you want to go deeper on that mindset, my essay On The Limitations of Bitcoin Privacy lands in the same place.

He did concede that among coins with serious privacy features, Litecoin would be the most liquid. Later, after the formal goodbye, he also gave me the sharpest distinction of the interview: privacy is less about liquidity than about the anonymity set. "The most important part of any privacy system is the anonymity set," he said, because if you are trying to hide by yourself, it's no good.

Swaps and a Multi-Coin Future

Would we see swaps between MWEB Litecoin and Monero? "Absolutely. There's already efforts to do that," David said, though he wasn't sure a successful swap had happened yet. He praised the Monero crowd for being "pretty good at swaps" and expected at least one wallet to offer swaps into Monero. (Cake Wallet, for what it's worth, shipped MWEB support not long after we recorded.)

I said that, as fun as it would be to have Bitcoin do everything, it seems unlikely at this point. David agreed: "As far as I can tell, it's always going to be a multi-coin future." His dream is that people won't have to think about which coin they hold. "You store your coins in whatever you're comfortable in," and when you pay, the wallet swaps it under the hood "in a decentralized and maybe not instantaneous, but relatively quick way. That's the goal."

Drivechains: Not Anti, Just Unconvinced

Full disclosure, which I also gave on air: LayerTwo Labs sponsored the episode, and they were trying to bring drivechains to Litecoin. I knew David wasn't a big fan, so I asked him to lay out his arguments.

He started by refusing the villain role. "I'm not the anti-drivechain guy." He has some concerns with the design, calling it "one of the hackier protocols I've seen," but says those could be solved. His real objection is about motivation: "My concern is that everybody just wants drivechains because they want drivechains." He has seen nobody say, "wow, this will help me do XYZ, I have this business idea."

Compare that with MWEB, where "the clear goal was privacy," or fungibility. Charlie didn't marry a technology either. He started with confidential transactions, then found MimbleWimble was even better and moved on. "Just going from finding a solution without a problem just seems like the wrong way to approach it."

The risk side is personal for him, since he would presumably be the one implementing it. "I don't have 100% faith in everything I do, so I could screw up the implementation and cause an issue." On a network this large and valuable, touching consensus code "without a clear benefit from it is an unnecessary risk." He has nothing against layer twos in principle and mentioned conversations with another team about adding a ZK proof verification opcode. What matters most is "having people ready and really wanting to do these things," and a community that sees a real benefit. "You can always experiment in lower value coins."

For the other side of the argument, Paul Sztorc made his case on the show in S15 E16, and Charlie Lee talked Lightning and payment coins in S15 E30.

Virtual Private Money?

My last question was a marketing one. Some in the community wanted to rebrand MWEB as VPM, Virtual Private Money. David's answer was perfectly on brand for a developer: "I'm not a marketing guy, so I'm gonna just keep writing code and let the community adopt whatever terminology they see fits best." He did find it a bit odd, since the addresses already carry an MWEB prefix and renaming would cause "another mess." And frankly, he likes the original name: "I've grown to like it over the years, so it seems odd to change it now without a good reason."

Then someone called him for the group photo, and that was it. If you want to keep up with his work, he says the best place is his X account, @DavidBurkett38, with the caveat that he is "very far behind on everything in life right now." The specs themselves live in LIP-0002 and LIP-0003, and the code in the Litecoin repository. It's a strange thing to say about a privacy engineer, but the most reassuring part of this interview was how often he admitted what his own protocol can't do.

Listen to David Burkett on Spotify, Apple Podcasts, YouTube, and More

Watch on YouTube

Time stamps:

00:00:55 – Introduction to MWEB and David Burkett
00:01:40 – Origins of MWEB
00:02:07 – Comparing MWEB to Bitcoin's Taproot
00:02:32 – Community Trends in Bitcoin
00:03:23 – Historical Context of Litecoin's Privacy Features
00:04:09 – Challenges in Development
00:05:03 – Explanation of Grin and MWEB
00:09:01 – Grin's Adoption Issues
00:10:06 – Marek Narozniak's Insights
00:10:48 – Relevance of MWEB Today
00:12:13 – MWEB vs Grin
00:14:23 – Technical Challenges of MWEB Implementation
00:16:28 – User Experience in MWEB
00:18:03 – Types of Privacy in MWEB
00:18:18 – Network Level Privacy
00:19:16 – Satoshi's Vision on Privacy
00:20:05 – Limitations of MWEB
00:21:07 – Sender Privacy Considerations
00:22:04 – Combining MWEB and Clear Chain Inputs
00:22:05 – Understanding MWEB Pegging
00:23:02 – Privacy Considerations in Transactions
00:24:45 – CoinJoin and MWEB Integration
00:26:46 – Liquidity of Privacy Coins
00:29:24 – Future of Swaps Between Coins
00:31:57 – Drivechains
00:35:02 – Risks of Consensus Changes
00:37:16 – Rebranding MWEB as VPM
00:38:37 – Anonymity vs. Liquidity