S16 E51: Sean Bowe on Bitcoin, Zcash & Tachyon

"I'm like the dumbest person in the room by far." That is how Sean Bowe, the man behind Halo and Halo 2, the Zcash inflation bug fix and the Project Tachyon design, described his place among other Zcashers. He also co-authored BIP 39, the seed phrase standard sitting under most Bitcoin wallets, so the competition in that room must be something.

We recorded on October 18, 2025, and the stream ran 3 hours and 39 minutes. I had promised the chat I would dance if Zcash touched $200, and Sean, who has watched this price go up and down for years, turned out to be the worst possible audience for that kind of excitement. He wanted to talk about proofs, ceremonies, wallets and what it would take to make a shielded transaction cheap enough that a node can forget it ever happened.

I came in as a skeptical Monero fan on purpose, because that is the seat that gets the best answers.

Pretty Shy About Celebrating

I opened with price, since Zcash had been moving. "Historically, I've been pretty shy about celebrating whenever the Zcash price is up," Sean said. His reason is symmetrical: "I don't like being discouraged when the price is down and I don't like being distracted when the price is up." He keeps working on the same thing either way.

Then I asked about the feature that makes Zcash unlike anything in Bitcoin land: the encrypted memo field. A viewer had sent 0.0001337 ZEC with an encrypted memo quoting Oscar Wilde, and I read it out on the stream, so it seemed a fair moment to ask whether memos are good design. Sean was lukewarm on the engineering and warm on the use. "I wouldn't say that it's better in the cryptographic sense, but it's really useful," he said. And the cost is real: "It irks me that we have these memos because they're so big and they take up resources."

Users keep asking him whether Tachyon will get rid of them. He has a reply ready, and it is the users' own: "Please don't get rid of it." As we got into later, the plan for Tachyon is to move that traffic somewhere else without removing the feature people like.

BIP 39 and a Groupie on the Zerocoin Subreddits

Sean never contributed significantly to Bitcoin development, which I found funny given the BIP 39 credit. His route into cryptography, as he told it, ran through forums. "I became a little groupie on the Zerocoin and Zerocash, like subreddits," he said. He followed the 2013 papers closely enough to be around when Zcash was assembled.

I pushed back on the idea that the Bitcoin world ignored this stuff. The privacy proposals of 2013 were serious, in my view, and people in the Bitcoin community did take them seriously. Sean's account of how he got into the Zcash codebase was far more modest than the story I was telling. "I just jumped in and sort of just cleaned up the documentation and just random stupid things," he said. And the path was open to someone like him: "You can be pretty much an amateur." Looking back, he called it luck: "It worked out really, really lucky."

I asked about Wasabi and CoinJoin from the same angle, since that was the practical Bitcoin answer to Zerocoin-style privacy. Sean's view is that the argument that Bitcoin is private does not hold up. He called it "just the biggest cope in the world," and said the framing is "such a silly reductionist way of thinking about privacy." Max Hillebrand made the case for Wasabi Wallet and privacy advocacy, and I pressed on whether optional privacy is a weakness for Zcash too.

His response was that this should not be the user's job. "We shouldn't rely on the users having to think about it. It should just be private." The caveat he gave is that today, "The privacy you get is up to your wallet." His pick is Zashi, which keeps transparent and shielded funds separate, and he said of it: "That's my favorite crypto wallet to use at all."

An IRC Spat Over "From Addresses"

One viewer moment, at 01:08:29, pulled out a story from Sean's earlier days. He had written a tool that implied "from addresses" in Bitcoin, and when he went to IRC for help, Luke Dashjr refused to assist him on those grounds. Greg Maxwell stepped in and intervened. I have talked to enough Bitcoin developers over the years, including Peter Todd, to recognize the genre: a technical objection that is also a worldview objection, delivered on IRC.

That led into the question of pace. Sean's view of the Bitcoin development process is blunt: "You can't even change a line of code in Bitcoin anymore without spending like years on it." I noted that some people think that is a feature. He did not argue it was nothing, and later in the show he gave Bitcoin real credit for being constrained. But on his own work, the time scale he wants is much shorter.

He also described the Zcash side of the story with a certain affection for the weirdness: Zerocoin-era Bitcoin proposals were, in his words, "a goofy protocol," and that is exactly what made the whole field feel hackable to someone like him.

Months Recovering DVDs and a Navy SEAL Copypasta

The Sprout ceremony is where Sean has the best stories. He coordinated it, and at one point he accidentally posted a Navy SEAL copypasta in a chat that included Edward Snowden. "I posted it in a chat with Edward Snowden," he told me, and I will leave you to imagine the silence in the room. Despite the embarrassment, he is sure the involvement mattered: "I think it was valuable that he was part of it."

The more serious part came later, when the Sprout inflation bug was found and he had to fix it. The ceremony artifacts lived on DVDs, and recovering them took months. "I spent months trying to think about how to solve that problem," he said. If the bug had been exploited, he explained, "Everyone would know that more money came out of sprout than went in." Because the bug was never exploited, the numbers could be checked, and the pool still held roughly 20,000 ZEC in the pool for years. He put it plainly: "Well, 20,000 ZEC was counterfeit." That figure is the amount in play, not a loss that was realized.

I asked how it felt to have fixed something that could have wrecked the project. Sean's answer was about the work: the Halo line of research started elsewhere. "Everything I've ever done that's been technically interesting or novel in the Zcash project has all been scale related." Halo, in particular, "was motivated entirely by performance at first." Getting rid of the trusted setup was a side effect of making recursion work, which is the opposite of how most people tell the story.

SNARKtember, Halo 2 and the Trusted Setup Question

Sean described the early Halo efforts with a few pieces of vocabulary I will not forget. The recursive proving system was, in his words, "like SNARKs and steroids, basically." The sprint that produced it was called "SNARKtember," and he said it with the grin of someone who had to live through it.

The ceremony question came back, as it always does. I asked whether the community would have kept the trusted setups around if they had been convenient. Sean said no: "We were willing to throw them out the second that we didn't need them, for sure." And he was firm that the privacy of Zcash never rested on them. "The privacy in Zcash doesn't depend on a trusted setup. And it doesn't depend on... It never has." The trusted setup was a soundness issue, not a privacy one, which is the correction I owed the chat.

He did concede that earlier timing cost something. Halo-style ideas arrived early in the history of the field, and "we did it so early that it didn't perform that well." The performance caught up later.

Abdel was on the show to talk about ZK STARKs and Bitcoin maximalism. Sean is a fan, but with a ledger attached: "I think STARKs are awesome." The catch is size: "STARK proofs are much larger." For a chain where every byte is multiplied across every validator, that matters.

A Monero Fan Walks Into a Zcash Stream

This was the part I had been looking forward to, because I get to play the skeptical Monero fan. I leaned on ring signatures, anonymity set size and the fact that Zcash privacy is optional. Sean's answer starts with the structure of the proofs: "The security guarantees of the transactions in it are separate from how many people are using it." On Monero, by contrast, ring signatures are vulnerable to set intersection attacks, and the system "dies to set intersection attacks trivially."

I came back at him about the transparent side of Zcash, which is where the optional-privacy criticism lives. His reframe was that transparent funds should be thought of as a different thing entirely: "You might as well just think of them as t-addrs and transparent transactions as just being bridged tokens on a non-transparent blockchain." When I raised a related objection, the claim that people only use shielded pools when they have something to hide, he waved that off too: "another disingenuous argument."

He was careful not to turn this into a fight. "Not that I actually really consider Monero the true final boss of privacy," he said, and the threat model he actually cares about is "an oppressive state that's trying to deprive us of our rights to financial privacy." On the criminal angle, he said the thinking that comes out of that world is the wrong frame for the technology: "downstream of criminal enterprise and that sort of antisocial thinking about risk is zero-sum thinking. I mean, criminals engage in zero-sum thinking all the time."

I added my own aside here, about how the greedy side of people shows up first and the idealists show up later, and Sean let me say it: "First you attract the greedy side of people and then they will stick around and say, well, I think this makes humanity much better." That is my line, not his, and I include it because it is where we ended up agreeing on something about how these networks grow.

One more point on the quantum angle: he made the case that a shielded design holds up there too, since "the transaction graph is totally opaque, even to a quantum adversary."

Project Tachyon, Explained Slowly

This was the heart of the technical hour. Sean's pitch is that the current Zcash protocol cannot scale as it is built: "the core protocol definitely cannot scale and never will be able to scale if it has ciphertext attached to the transactions the way it is now." Tachyon is his answer.

The design, as he described it, uses an oblivious synchronization service. The service helps wallets find what is theirs without learning who they are: "It doesn't learn about anything about your wallet." That is what allows the chain to be lean, because "Validators can completely prune the state continuously." He summed up the privacy outcome this way: "This gets the privacy perfectly right."

The second piece is moving the secrets and memos out of the chain. The mechanism he described has the parties already holding a channel: "the sender and the receiver have a channel open already, and the sender can send a payment to the recipient on chain and can send all the secrets over their existing communication channel." In practice that means Signal, NFC or a QR code. I raised the obvious worry that this puts privacy at the mercy of an out-of-band channel. He took it seriously but argued the alternative is worse: "We're putting ourselves in the same position that non-private chains are," meaning chains that cannot scale the data they carry.

On pool design, Tachyon is meant to be a separate pool from Orchard. "It's just simpler that it be its own pool," Sean said. His general attitude to the ambition is the line he gave about the whole project: "If privacy can't now, then nothing can, is the way I think about it." And on whether the team can pull it off: "I think we'll nail it. We'll figure it out."

I asked who is actually building it. "It's just been me so far," he said, and then he gave the timeline: "My ETA is to get this in the protocol next year." That is 2026 for protocol integration, which I flagged to the chat because it is the most specific date of the night. When I asked about edge cases he was not going to hand me the answer for free: "I'm not gonna make it that easy."

Burned Fees, Hashrate and Who Pays the Bills

A viewer moment at 01:23:44 got Sean explaining how fee burning, in the style of EIP-1559, could work for Zcash, with the goal of preventing base fee manipulation. It was a short digression and I will not pretend I could replay the whole mechanism, but the point was that the base fee gets burned so nobody profits from gaming it.

On mining, he did not dodge. "There's a very serious one in Zcash as well, that needs to be fixed," he said of mining centralization. I asked what stops a pool from doing something nasty. His answer was that shielded transactions are indistinguishable from each other, "So you can't really target certain users of shielded transactions while not targeting all of them" and that a pool that tried to censor would be "nuking their hardware." The scope of that is limited: it speaks to censorship, not to every attack.

The funding question was where I got corrected. I had assumed the protocol dev fund carried the work. Sean walked me through the other half of it: "They're long privacy and they're long Zcash too." Private donors who hold ZEC pay for a lot of the development, and that, he said, is not a bad thing: "I don't know why there's this cultural problem in the Bitcoin world about donation." On governance, there is no one in charge: "There's no benevolent dictator of Zcash currently and probably there won't be anytime soon." When forks are needed, "We call it friendly forks."

Bitcoin's Superpower and Crossing Lightning With ZEC

I asked whether he envied Bitcoin's rigidity. He gave it credit: "Bitcoin does have a superpower, which is that it's extremely constrained," and added "constraints breed creativity." Then, without much pause, he said why he is still where he is: "That's why I work on Zcash."

At 02:47:37 he floated something I had not expected: extending Zashi's CrossPay so that it could settle Bitcoin Lightning invoices through shielded ZEC swaps. The pitch for the user is that the payment "keeps your entire transaction history private and detached from the economic activity that you're engaged in." Peter Todd's episode was S15 E46 on Bitcoin covenants, tail emission, OpenTimestamps and why Lightning rocks.

On the other end of the stage, there is the matter of what he wants to leave behind. At 03:24:24 he recalled that Polkadot cryptographers told him they entered the field after studying his code. He framed it as a goal more than a boast: "I'm hoping I'm actually contributing more to the next generation of really smart people that work on crypto tech and privacy tech. And encouraging them and motivating them and setting them up for success."

Back in the first minutes he had admitted something that fits that goal: "You got to get the cringe out really early, because I actually hate doing talks and things like that, because I really don't want to screw up." He then did a three-and-a-half-hour stream with me.

We wrapped with an off-topic moment that I liked more than anything on the technical agenda. At 03:28:09 Sean turned his camera to the wall and showed an original ASICMiner Block Erupter Blade hanging there, the sort of relic you would expect in a Bitcoin museum rather than a Zcash cryptographer's workspace. I asked whether he was keeping an eye on Zcash price for my dance, and he told the chat, with the last words of the show, "be on the lookout for that."