S16 E2: Liam Eagen on Crypto(graphy) Research & Innovation

Liam Eagen is one of those cryptographers whose name shows up in places that rarely talk to each other. He co-authored Bulletproofs++ while at Blockstream. Monero people love him at MoneroTopia for his work related to full-chain membership proofs. He consults for Aztec on Ethereum. And when we spoke in January 2025 he was working at Alpen Labs on a ZK rollup for Bitcoin.

The last time he was on my show, it was with Robin Linus and Jonas Nick to explain Shielded Client-Side Validation. This time I had him alone, live on a Monday with bitcoin trading above $100,000, and I wanted to push past the paper. Will anyone actually build it? Is OP_CAT a covenant? What is the real difference between a rollup and a sidechain? And what do you say to the bitcoiner who calls all of this shitcoin tech?

His answers were patient, careful and occasionally very funny. He also told me the most persuasive reason I have heard for why privacy belongs on Bitcoin specifically.

Shielded CSV, Still Waiting for a Builder

I opened with the obvious question. Had anything happened with Shielded CSV since our last conversation? "I don't think there's any major updates," he said. He had talked with Robin and Jonas about implementing it, but as far as he knew nobody had started. He did not think the lift was huge. One missing feature in many SNARK libraries was the main obstacle.

The headline of the protocol is still striking: "64 bytes of on-chain data for every transaction regardless of its size and structure." It works as a private metaprotocol on top of Bitcoin, and its appeal for Liam is that, except for the bridge, it does not require changing Bitcoin at all. "It's just inscribing this data into Bitcoin."

I told him about David Burkett's theory that bitcoiners get fascinated by a technology and move on before it ships, which is why Mimblewimble never came to Bitcoin. Liam was more hopeful. "I think there's a pretty good chance that something will be implemented."

OP_CAT, Big Integers and Verifying SNARKs

Is OP_CAT a covenant? Liam answered like a mathematician. "It is a matter of fact that one can do covenants with CAT, so in that sense it's a covenant."

He was honest about his bias. He works on privacy and scalability, so what he wants is SNARK verification on Bitcoin, and anything that gets there appeals to him. "For me this, like, unlocks sort of everything," because SNARKs are recursive and can verify arbitrarily large computations once you have the first step. CAT would be cleaner than the BitVM approach, which has to work around Script's limits with optimistic games.

Then he taught me something I had not heard discussed on the show before: big integer arithmetic. Today Bitcoin Script supports 32-bit integer addition and not much else, because Satoshi disabled the multiplication, division and bitwise opcodes early on. Extending arithmetic to 256-bit integers would make a Groth16 verifier in Script plausible. Right now, he said, one 256-bit field multiplication costs "on the order of 10 to 100,000 opcodes." With native big-integer opcodes it could be "three opcodes or even one." He also pointed out the catch: 256-bit arithmetic would probably enable covenants in a similar way to CAT, because multiplying by a power of two and adding is a way to concatenate bytes.

Strata and the Optimistically Verified ZK Rollup

At Alpen, Liam was working on Strata, a rollup for Bitcoin, as part of the BitVM Alliance alongside Citrea and Robin Linus. The goal was to implement BitVM2 and a Groth16 verifier in Bitcoin Script, then build a bridge. "The really core component that's missing is the bridge," he said, and once you have it with a SNARK verifier, other execution environments become possible too.

He was precise about terminology. What BitVM enables is not quite a ZK rollup, because BitVM itself is optimistic. It is "an optimistically verified ZK rollup." I admitted I did not know the difference, so he walked me through it.

Optimistic rollups like Arbitrum and Optimism assume the operator is honest unless someone submits a fraud proof. That fails if the operator withholds the data, because without the data you cannot prove fraud. "Data availability faults lead to safety violations for optimistic rollups." A ZK rollup proves correctness up front, so withheld data becomes a liveness problem instead of a theft problem. The BitVM version verifies the small ZK proof optimistically rather than the whole rollup state, which matters because making data legible to BitVM requires Lamport signatures that multiply its size.

He quoted a line he could not attribute: "SNARKs turn everything into a data availability problem." Earlier in Season 15 I had heard the Citrea side of this from Orkun Kilic, and a few days later John Light of Alpen came on to talk about the same stack.

Answering the Maximalist

I gave him a scenario. You finish a talk about SNARKs, bridges and data availability, and someone tells you that you are bringing shitcoin tech to Satoshi's holy chain. What do you say?

He said that had never happened to him in real life, "so that's nice." Then he answered sincerely. He remembers when Bitcoin felt like the dream of decentralized, permissionless internet money. "I want to be able to do payments and, like, be private and have cash on the internet." He does not think Bitcoin lives up to that today, and he sees SNARK verification as the only robust way to get there. Some people simply want something different from Bitcoin, and he would "probably politely try to disengage."

I raised the usual alternatives, Liquid and Lightning. Liam worked at Blockstream and knows Liquid well. It has confidential transactions, but "it is also a federation and a sidechain, so it's not trustless," and anyone who must cooperate for a bridge to work is vulnerable to repressive governments. On Lightning he was careful not to overstep, but said Shielded CSV offers stronger privacy: no leakage of amounts, senders or receivers beyond what the network itself reveals.

Rollups, Sidechains and the Miners Who Can Steal

My sponsors that day included both Citrea and LayerTwo Labs, so I asked the awkward question: sidechains or rollups?

For Liam, a rollup gives stronger guarantees because it puts its data on Bitcoin and cannot reorg unless Bitcoin reorgs. "You inherit Bitcoin's probably most, like, powerful feature, which is finality." A sidechain with its own consensus cannot offer that. The trade-off is scale. A rollup that inscribes everything into Bitcoin will hit the block space limit, "maybe you can 100x the number of transactions on Bitcoin," while sidechains scale much further. Validiums and volitions sit between the two.

On Drivechains, his summary was blunt but fair. Miners vote on outcomes, so "the disadvantage is that miners can steal." He gave Paul Sztorc's team credit for having working software, then said SNARK-based designs can deliver stronger guarantees as proving keeps getting faster.

Asked how Alpen and Citrea differ, he described them as competitors who cooperate a lot inside the BitVM Alliance. When a viewer in the chat called Citrea's rollup a centralized database, he called that reductive. Many rollups have a centralized sequencer, which can censor, but users can still have forced inclusion and the ability to withdraw if the sequencer disappears. Decentralizing sequencing, for instance with miners in a "based sequencing" model, brings its own MEV problems for Bitcoin.

Why Privacy Belongs on Bitcoin

This was the moment I clipped. I asked why Bitcoin needs privacy at all, given that someone on a podcast the week before had told me it is already perfect money. Liam's answer started with a jab, "I don't know that BlackRock liking it is the criteria by which we should judge the perfection of our money," and then turned into a political argument.

Privacy already exists in Zcash and Monero, he said. The reason to add it to Bitcoin is durability. "If we can add privacy to Bitcoin, then we won't make privacy illegal, because there is enough vested economic interest in keeping Bitcoin around." Monero is marginal. "It's not owned by your grandma in her IRA or whatever, but Bitcoin might be." The political capital required to ban Bitcoin may simply be more than anyone can muster.

I read him a 2018 slide by a well-known Italian maximalist listing "four universal truths," including that every attempt at changing Bitcoin is a scam. How did Liam feel about being called a scammer by that crowd? He pointed out that BitVM and Shielded CSV do not require changing Bitcoin, then made a sharper philosophical point. "The idea that Bitcoin should never change is itself a change to what Bitcoin is," if you count the beliefs of its users as part of Bitcoin. He still called resistance to change "healthy" up to a point.

How Long Is Long Enough to Test OP_CAT?

I asked whether there is a reasonable testing period after which a soft fork like CAT is safe. Liam separated two questions people often muddle. One is unknown unknowns, which research can reduce. For CAT, "a few years of, like, intensive research probably will be sufficient." The other is known trade-offs. If you oppose covenants or SNARK verification on principle, "it's not, like, a research question, it's a political question."

He added that people underweight risks from outside the protocol. A metaprotocol like inscriptions or Runes could distort miner incentives without any soft fork at all. And further out, indistinguishability obfuscation, still "a very theoretical and not practical thing," could give you smart contracts and trustless bridges "without changing Bitcoin at all." I mentioned that the ColliderScript team had already found a way to get covenants without CAT, at the cost of specialized hash-collision hardware Liam estimated at around a hundred million dollars.

Bulletproofs++ and Full-Chain Membership Proofs

Then we went deep into his papers. Bulletproofs++, written with Jonas Nick, Tim Ruffing and Sanket Kanjalkar, and accepted at Eurocrypt, hides the amounts and asset types in a transaction without a trusted setup. Its main contribution is what he called the reciprocal argument, related to the technique now widely known as LogUp: commit to two sequences, pick a random value, and check that the sums of the reciprocals match. He used it to check that digits fall in an allowed range and to balance multi-asset transactions. The proofs, he said, are around 300-something bytes and much faster to prove and verify than earlier Bulletproofs. He also mentioned that it does not hide transaction relationships, which is the job of something like full-chain membership proofs. (The Zano developers I interviewed in Season 15 use it for confidential assets, which explained why they praised him.)

He was modest about full-chain membership proofs for Monero. "I'm also not an expert on exactly how full chain membership proofs work," he said, then explained them clearly anyway: every output goes into a big Merkle tree, each input proves membership in that tree, and a deterministic nullifier prevents double spends without revealing which output was spent. His contribution, as he understood it, was a paper on proving elliptic curve operations inside a circuit.

Could Bitcoin get FCMPs natively? "Short answer, probably no." It is "pretty far outside of the Overton window" when even CAT is considered too speculative, and enshrining a proof system in consensus would be very hard. His preferred path is Shielded CSV plus a bridge.

On hidden inflation, he was frank. If amounts are hidden, a proof-system bug can inflate supply, and Zcash had such a bug in an old version. His mitigation for Bitcoin is an opt-in shielded pool, so any hidden inflation can only drain the pool and only hurts those who chose it. A bug in transparent Bitcoin, like CVE-2018-17144, is detectable and in principle recoverable. In a privacy system, "it's not recoverable."

Block Size, Proof of Stake and 2034

A viewer asked whether Bitcoin should raise its block size. Liam said yes, eventually, but reframed the question. "Bitcoin block validation time matters more than the block size." If validation gets faster, for example by rolling signatures into a STARK, larger blocks could come without hurting decentralization. I teased him that he clearly no longer works at Blockstream.

Another viewer asked about proof of stake. He did not think Bitcoin would switch. Proof of work has "a nice kind of simplicity," and changing Bitcoin's consensus is a much bigger deal than adding SNARK verification.

His ten-year view was tied to his job. He joined Alpen because he thinks Bitcoin Layer 2s have a real chance, and if they work, private payments could make "the original spirit" of Bitcoin come back. He also warned that many people who now own a lot of bitcoin "are not interested in privacy and in fact are strongly opposed to it," and that conflict will play out. On CAT, his prediction was simple: "I don't see many worlds where CAT takes 20 years to activate."

We ended with a running joke from the chat. People say Liam looks like Andrew Poelstra, and Liam confirmed he has heard it a few times. He also said that wanting SNARKs on Bitcoin for privacy is the only agenda he has, and I believe him.