S17 E49: Kris Nuttycombe (Zcash at Ten, Hard Forks, Dev Fund, Ossification)

Draft article, waiting for Vlad's review. It is not indexed by search engines yet.

The first time Kris Nuttycombe came on my show, he had more facial hair and Zcash was trading at $38. That was S15 E62, recorded together with Josh Swihart. Two years later we sat down on a hotel sofa at Zcon7 in Cancún, on the last day of the conference and right around Zcash's tenth birthday, with ZEC somewhere around $1,250 (my guess on air; I figured it had dipped because of the Binance hack that was unfolding as we spoke). I said five billion stolen. Kris corrected me in real time: the first number he saw was 2.7, then 5.7, "now 6.3."

Kris is a core protocol and wallet backend developer at the Zcash Open Development Lab (ZODL), the team behind the Zodl wallet. He has worked on Zcash full time since 2020, but his history with the project goes back much further, to the days when Zooko was still running Tahoe-LAFS and Kris was the guy who looked at Satoshi's code and declared it garbage. He also owns the CPU from Zooko's ceremony computer, dug out of the ashes with his own hands.

This one was recorded over two days. The first session ran long, and the second one got postponed by what I can only describe as deep state agents ("And by that I mean AI agents that were running in their deepest thinking mode, I guess"), plus a dead battery. What we ended up with covers almost everything: hard forks, the end of Sprout, stablecoins, AI money, the Dev Fund, proof of work as arbitrage, and a radical idea for testing protocol changes that I'm still arguing with in my head.

Money Is Not Money If It's Not Private

I started by praising the Zcash contributors for building through such a long bear market for ideological reasons, because they believed this was the best design for private internet money. Kris finished my sentence for me: "I don't think that something is money, if it's not private. I don't think that you can run an economy if every transaction can be traced." Then the punchline: "So, we're going to have internet money, it's it's going to be Zcash."

Then I shared what struck me about the conference itself. Bitcoin events run on mantras and catchphrases: everything is good for Bitcoin, Bitcoin fixes this. At Zcon7 I didn't hear anyone mention the price on stage, and the honesty and depth of the debates were astonishing.

Kris explained why the room felt different. Alongside the builders who stayed through the bear market, the conference had people for whom private internet money is "actually kind of a lifeline", including a refugee who can't transact freely except with cryptocurrency. The newcomers who arrived with the price pump bring friction, but Kris gives them credit: "the energy that some of those folks have brought, have made things go faster."

And fast it has been. This year Zcash shipped one network upgrade to fix a critical security bug, then another to introduce a formally verified shielded pool, and NU7, going live the week after we recorded, drops the block time from 75 seconds to 25 seconds (ZIP 218). "I think you're actually going to see more of that pace of development in Zcash," he said, with Tachyon next in line.

Zcash Is What Bitcoin Could Have Been

I gave the Bitcoiners in the audience my usual disclaimer, at full length. Zcash started from Bitcoin's code base, added the Zerocash protocol that was first offered to Bitcoin, and kept a transparent side that is basically Bitcoin without SegWit and Taproot. In my multiverse theory, there is a parallel universe where Bitcoin is what Zcash is today. If you want the long version of that story, I wrote it up in Zcash: The Privacy Moon Math Bitcoin Was Afraid to Include.

Kris was more generous to Bitcoin's developers than I was. "Bitcoin was the first thing that worked," he said, and Satoshi himself knew that a version hiding senders, receivers and amounts with zero-knowledge proofs would be better. But nobody had deployed that math in production, and by then Bitcoin was established enough that adding a shielded pool was a substantial risk. Early Zcash proofs took several minutes on a high-end machine, which "would not have been the kind of user experience that Bitcoin users were used to."

Then he made the case that still separates the two cultures: "the ability of the community to agree on hard forking upgrades is kind of a superpower." Zcash nodes have end-of-service halts, so operators are used to upgrading on a schedule. When an upgrade activates, everyone is already running the new software. As he put it, "play like you practice."

I pushed back with the classic Bitcoin argument: if a network can hard fork and 100% of it moves to the new chain without opposition, isn't that a sign of centralization? Kris didn't take the bait. "So it's always up to every participant of the network what software is run," and anyone is free to stay on the old chain. So far, the miners and node operators have simply agreed every time. Privacy, in his framing, serves something bigger: Zcash is a "fungible currency for the internet" and "if you can trace a coin, then you lose fungibility."

Privacy at Rest, Spend Anywhere

When we switched roles and Kris started interviewing me about the conference, I admitted I expected a thousand attendees and found roughly 200, which turned out to be a feature: one stage, no schedule conflicts, and the people who built the thing standing in line for coffee. I even got to have breakfast with the Foundry team, which never happens at Bitcoin conferences. It reminded me of the early days, and of the moment Ian Miers presented Zerocoin in San Jose and Peter Todd stood up to object.

For Kris, the shift was in the topics. Past Zcons were deeply technical; this one was about adoption and governance, and about "how do we get this into the hands of a billion people?" His answer surprised me, because it doesn't require everyone to accept ZEC.

He walked me through the math with stablecoins. If you swap 123.45 USDC into ZEC and back out into exactly 123.45 USDC, you gain nothing, because the amount itself links the two ends. But if you deposit different amounts at different times, store the value shielded, and later spend through NEAR Intents, the recipient gets the USDC they wanted and nobody can see where it came from.

That's the idea behind CrossPay in Zodl: "storing your money shielded is the only way to truly obtain privacy," but you don't have to spend in ZEC. The next step, in his view, is doing the same with card networks, so you pay for dinner and the vendor receives Visa funds "that were only temporarily in existence from having been changed out of Shield and Zcash."

I said I hope that's temporary and that we replace Visa and MasterCard altogether. Kris told me about a couple of local vendors who had been onboarded with ZEC in a Zodl wallet plus a virtual card they could fund with USDC. They could cash out part of it for today's needs, but the ZEC they kept gives them an alternative to the banking system. But he doesn't expect a world with one money: "we are always going to live in a world of a pluralism of currencies." The difference is that none of those currencies are truly international. "Zcash can be the truly international currency, the currency of the internet, where there are no borders to it."

Unified Addresses Are a Two-Minute AI Prompt

During the Cake Wallet ad read, I bragged that I bought vlad.zec (and vlad.zcash) through Zcash Names, which Cake Wallet supports, so you can send me encrypted notes. I also mentioned that some swap services still only accept old Sapling or transparent addresses, and I named one: FixedFloat, which rejected my unified address as invalid.

That opened a small rant from Kris, and I enjoyed every second of it. "I'm going to complain for a moment about folks who don't support unified addresses," he started. There are parsers for unified addresses in every language, and if you only support Sapling, you can extract the Sapling part. "This isn't something that should be confusing. This is literally like a two minute AI prompt."

He also explained why Zodl doesn't expose Sapling-only addresses: unified addresses are evolving and will carry things like address expiry, and "When we add a post-quantum privacy, that will be something that involves a change in the unified address standard." So, FixedFloat, if you're listening: fix your system.

"This Code Is Garbage"

At the very top of the episode, while reading the sponsor list, I told my favorite piece of Zcash trivia. Braiins, which runs Hashpower, operates the first mining pool in Bitcoin's history, which launched in 2010 as Bitcoin.cz Mining on mining.bitcoin.cz before becoming Slush Pool and later Braiins Pool. As I tell it, Slush found out about Bitcoin from an email that Zooko sent to the people he was working with at the time. Kris laughed: "Actually, I didn't receive that email."

He did hear about it from Zooko, though, at around the same time Zooko wrote his first blog post about Bitcoin, in the days of Tahoe-LAFS. And then came the confession. Kris found the very early C++ implementation, looked at it, and decided it wasn't worth his time. "I was kind of a snob, right? I said, this code is garbage, the architecture of this is terrible, this is never going to go anywhere."

He regrets it, of course, but there's a twist. If he had jumped in that early, he might have become a maxi and been "blinded by that that early experience" to the flaws that make him think Zcash is the better solution.

That gave me the perfect opening to ask whether better C++ skills rule Zooko out as a Satoshi candidate. Kris had the best answer I've heard to that question: "If Zooko were Satoshi, then Bitcoin would have been written in Python." I still think Zooko is a more solid candidate than most of the names people throw around, given that he's been obsessed with digital cash since the 90s and was among the first to blog about Bitcoin. Kris, who has known him for a long time, isn't buying it: "He's definitely told me that he's not Satoshi, so I believe him, I think."

As for the CPU: Kris wasn't part of the 2016 ceremony, but he was there for the destruction of the compute node. "After the fire had died down in which the motherboard of the computer was burned I rooted around in the ashes" and pulled out the chip. I held up my own relic from that week, Peter Todd's ceremony laptop, which I bought from him in 2022 and which he recently unboxed on camera, and noticed that ten years later "you can smell the privacy." Kris confirmed: "Mine still smells that way too."

Closing the Sprout Pool

The smell led us to Sprout, the pool those ceremonies created. NU7 removes the transaction format that Sprout depends on, which means the pool gets frozen for good. Kris explained why it couldn't simply be made exit-only, the way the Orchard pool was handled after this year's bug: there, they changed the rules so you can only spend out of Orchard and across the turnstiles into Ironwood, Sapling or transparent. Sprout doesn't allow that. "And so this is the first step of the final of Sprout."

About 26,000 ZEC remain there. I asked whether those coins should simply vanish from the 21 million supply or eventually be recycled into mining rewards. Kris doesn't hold a strong opinion, since it's a small fraction, but quantum computing changes the calculation. If Q-Day arrives, "I do think it might make sense to recycle those into the network security mechanism at some point," because no Sprout redemption circuit could exist after that.

I repeated something I learned from Sean Bowe and Peter Todd: one specific ceremony disk could have been used to print unlimited ZEC in Sprout, if you had physical access and knew about the bug. Kris offered the best argument that it never happened. Nothing can leave Sprout beyond what went in, and anyone who had exploited the bug would have quietly withdrawn a chunk before the freeze. "I don't see a rational attacker that wouldn't have done something like that."

The new pool is a different story. Kris explained that AI has "really changed the game with respect to formal verification", and the Ironwood circuit is proven sound, so "there are not bugs that can be used to mint." He had also just heard about a new node implementation that is supposedly fully formally verified. On day two he had the name: Zebend, written in the Bend programming language, which produces proofs of correctness as it goes. "I've been watching Bend with interest and now I have two of my interests coming together." (The other new node I tried to name on air is Zakura, a Zebra fork led by Sean Bowe and Dev Ojha.)

Not a Zero-Sum Thinker

I brought up the eCash hard fork of Bitcoin that launched during Zcon with a Zcash-style sidechain, and said it was a vindication of Zcash's tech over ring signatures, Dandelion++ and Bulletproofs. Kris stopped me there. Dandelion++ is "absolutely something I want to see on the Zcash network", just like Monero is adopting Zcash ideas with full-chain membership proofs. "I am not a zero-sum thinker," he said, and zero-sum thinking "is just incredibly short-sighted and foolish."

We moved on to Bitcoin dominance, which used to be over 90% and is now around 60% ("I just noticed earlier today"), and to stablecoins taking over the use cases we promised for Bitcoin in Latin America and Africa. Kris would rather see Bitcoin hold that dominance than stablecoins, which he thinks are misnamed: "I think they should be called like, wrapped fiat." People don't actually want stablecoins, in his view. "I think people want stability."

This is what blew my mind earlier that day, when someone pitched him a stablecoin on Zcash and he said he cared about stability instead. Stability, for Kris, comes from liquidity. The dollar keeps getting debased, but prices people pay day to day barely move because there is so much liquidity behind it. Compared to the peso in Argentina (where ZODL developer Pacu is from), "today's Bitcoin looks like positively a stable coin." His bar: "if you are more stable than the fiat currency in the market that you're serving, then you're a stable coin."

Crosslink Is Not the End of Mining

After my ad read for eCash and Braiins Hashpower (rent hashrate without KYC and mine yourself some pristine coins), I asked about the miners. A few of them told me after the consensus panel that they were worried about being phased out.

Kris was clear: "I would not say that there are plans to move away from proof-of-work." What exists is a proposal by Shielded Labs for a hybrid system called Crosslink, where proof-of-work mining continues and a staking layer adds finality. To roll back the chain, an attacker would need both a 51% attack and enough stake to control finalization. "There is definitely nothing like universal approval or a plan for deployment of this," he said, and it's "not the next thing that Zcash is doing, at very least."

I told him he had dodged the question, but he had also given me the next one: what does he actually work on? Two things. Non-cryptographic protocol design, and wallets, because the wallet "is where the rubber meets the road" for privacy. This summer that meant a lot of incident response, plus ZIP 318, the standard for migrating funds from Orchard to Ironwood without leaking balances. Next year, the giant thing is Project Tachyon, which will change how wallets back up keys, read history and talk to services: "it's going to be a paradigm shift."

The Price Didn't Go Up, But the Promise Did

I asked him why he never left. He could have taken a CTO job at some Ethereum privacy project that raised a lot of money and bought a nicer house with a pool. His first answer was that the price didn't go up after 2020, "but the promise did." Sprout was the first deployment of zero-knowledge proofs, Sapling ran on phones, Orchard and Halo 2 removed the trusted setup, and now Tachyon aims to be the first scalable private payment protocol. He gets to do all of that "in the service of human freedom."

Then the big question: can Zcash end up like Bitcoin, stalling every upgrade because ETF money cares about price, not privacy? "It would be fundamentally short-sighted for Zcash to ever ossify," Kris said. Asking when Zcash will be done is like asking when Amazon or Apple will be done. "Software is only complete if nobody's using it." And he didn't spare Bitcoin: if a project ossifies, someone else comes along and eats its lunch. "Like the maximalism has failed right."

I call myself a post-maximalist, so I didn't argue. Kris then raised a topic I hadn't planned for: "what is going to be the currency of AI?" Agents might trade in compute seconds, which aren't inflation proof. I argued that AI money needs instant sync and little storage, which is why Mimblewimble-style pruning appeals to me, while shielded Zcash is the obvious fit when an agent needs to buy something like a VPN privately. Kris thinks we should "imagine more aggressively" what agents actually need, and that a protocol willing to hard fork can add whatever pool those needs require. In his words, "ossification is death, right?"

I ranted about Michael Saylor tweeting against covenants and reminded everyone that Bitcoin will have to hard fork at least once for its timestamp problem. Kris closed day one on a more generous note. In his pluralist view, there is a role for the coin that never changes. Just as privacy is Zcash's North Star, "Bitcoin never changing anything can be a North Star", the place you park value for 80 years and forget about it.

Day Two: Proof of Work Is Arbitrage

When we came back, the first item was the Dev Fund, which Kris had debated on stage. 20% of the block subsidy goes to development, and he believes it does what Satoshi intended mining to do: distribute coins widely. Equihash was supposed to let anyone with a GPU take part, but a bug in the choice of parameters made ASICs possible. The community's rule on contentious changes is that "the default is no change," so ASICs took over. "It was like almost an extinction level event."

Today, getting ZEC through mining means a $5,000 Bitmain machine, a serious power connection, noise and heat. Kris describes miners as doing "almost a form of arbitrage": they take on risk, obtain ZEC below market price, and security is almost a side effect. Security isn't a real market either, because nobody can measure how much is enough until an exploit happens. Grantees paid in ZEC, on the other hand, become constituents who expand the economy. The same logic makes him defend outreach to the most commonly debanked people, from sex workers to legal marijuana businesses, even when it's socially controversial: "That makes the pie bigger."

I disagreed. Miners are the ones producing the blocks that fund the 20% in the first place, and I think a better security metric is the distribution of hashrate. For a long time one pool, ViaBTC if I remember right, had more than 60%. Foundry, and Cypherpunk Technologies (backed by the Winklevoss twins), have since brought hashrate to the US and made Zcash more geopolitically resilient.

Kris didn't budge on the value question. The idea that thermodynamic expenditure is what gives a coin value? "It's kind of Marxist. It's kind of the labor theory of value." I replied that sacrificing a resource to create something is not the same as digging a hole and charging $10 for it. He granted that hashrate serves a purpose in Nakamoto consensus by limiting reorg depth: "It's really just a finality gadget." And on spending, he thinks like a startup founder, not a foundation: Dev Fund money should be spent "as fast as we can to achieve as much as we can to capture this moment" while people are recognizing the value of privacy.

Testnet Forks of Mainnet

The second topic was the idea Kris told me about the night before, and it's the one I keep thinking about. "What is really the difference between mainnet and testnet?" Same software. The difference is that everyone agrees the testnet coins are worthless. So why not use that social consensus deliberately? Instead of a separate Crosslink or ZSA testnet that only geeks will try, he wants "testnet forks of mainnet", where everyone who holds ZEC can try staking their coins on a fork that, by agreement, has no value.

"Zcash has value because people believe it has value," he said, and the same goes for the dollar. He pointed to the peso, which was 20 to the dollar the last time he was in Mexico and 16 this time. And if a market decided the test chain was worth something after all, he sees that as a signal, not a disaster.

I reminded him of the "death by a thousand forks" argument from the Bitcoin wars. Kris asked what the dominant thing of the last couple of years was: "It was meme coins, right? How's that any different?" There I drew a line. "I'm not going to insult all meme coins equally," I said, and then I insulted them all. A fork that ships years of research, the way Zcash shipped Zerocash on a Bitcoin code base, has merit on its own. Kris agreed he had mashed two ideas together, and then asked the question that stuck with me: "What would have happened if, in 2015, Zcash had launched as a chain fork of Bitcoin instead of a code fork?"

A Billion Users and No Steel Plates

For my last question, I asked what's next for Kris and what the next ten years look like for Zcash. "My answer to both is actually the same." The next first, after a decade of firsts, is a user experience that is useful "way outside of the crypto community." Scalability, even Tachyon, is only a means to that end.

And self-custody has to stop looking like homework. "If I tell someone that they need to, stamp their seed phrase into a steel plate because that's part of self-custody, then I've totally failed, right?" I pointed out that Sean Bowe, who was supposed to be at Zcon, co-authored BIP39, the seed phrase standard we all use, so maybe he owes us the fix.

Kris left me with one more thought before he ran for his flight. "The last six months, our capabilities have multiplied thanks to the use of AI, and now the important thing is the ideas, because software has become cheap."

If you want the rest of the Zcash story, start with S16 E29 with Zooko, then S16 E51 with Sean Bowe on Tachyon and scaling privacy, and S17 E28 with Josh Swihart on the Orchard bug and ZODL. For the mining side of today's sponsor story, there's S17 E14 with Kristian Csepcsar of Braiins, and for Cake Wallet's long road to adding Zcash, S17 E41 with Vik Sharma.

This episode is sponsored by Cake Wallet (shielded Zcash and Zcash Names support), SideShift (swap your stablecoins for something nobody can freeze), Orange Rock (trade Zcash long or short, and please don't gamble), LayerTwo Labs (claim or mine eCash at ecash.com) and Braiins Hashpower (rent hashrate with no KYC). Thanks to all the sponsors for making this possible.

Follow Kris on X at @nuttycom and on GitHub, and download Zodl if you want to try shielded Zcash yourself.

Listen to Kris Nuttycombe on Spotify, Apple Podcasts, YouTube, and More

Time stamps:

00:00:00 – Intro

00:00:46 – Intro & sponsors: SideShift, Orange Rock, eCash, Braiins Hashpower

00:01:17 – Braiins, bitcoinmining.cz (Bitcoin.cz Mining), Slush & Zooko's email

00:02:09 – Cake Wallet & Kris Nuttycombe's second appearance

00:02:51 – ZEC from $38 to $1,250 & the Binance hack

00:03:25 – "Not money if it's not private"

00:03:57 – What makes Zcon different from Bitcoin conferences

00:06:29 – Privacy as a lifeline for refugees

00:07:42 – Three network upgrades in a year: NU7 & 25-second blocks

00:09:04 – Why Zcash matters to Bitcoiners

00:10:22 – Zcash is what Bitcoin could have been

00:12:12 – Satoshi, zero-knowledge proofs & Bitcoin's caution

00:13:57 – Hard forks as a superpower

00:16:10 – Are hard forks centralizing?

00:19:32 – Fungible currency for the internet

00:20:52 – Blockchain analysis, AI & traceable coins

00:21:56 – Zcon7 impressions: Foundry, 200 people, one stage

00:23:45 – Ian Miers, Peter Todd & Zerocoin

00:24:27 – ZEC flips Dogecoin

00:25:26 – From technology to adoption & governance

00:27:37 – NEAR Intents & privacy at rest

00:28:47 – Why swapping in and out doesn't give you privacy

00:30:33 – Paying Visa merchants from shielded ZEC

00:31:39 – Onboarding local vendors to ZEC

00:33:43 – A pluralism of currencies

00:34:19 – Cake Wallet, Vik Sharma & Zcash Names (vlad.zec)

00:36:39 – Kris's rant on unified addresses

00:37:39 – FixedFloat & Sapling addresses

00:39:23 – SideShift & stablecoin freezes

00:40:51 – Orange Rock (orangerock.com)

00:41:35 – The ceremony laptop & Zooko's CPU

00:42:06 – Kris's Bitcoin story: Zooko & Tahoe-LAFS

00:43:29 – "This code is garbage"

00:44:22 – Is Zooko Satoshi? "Bitcoin would have been written in Python"

00:46:45 – Digging the CPU out of the ashes

00:47:57 – Peter Todd, art & the smell of privacy

00:48:59 – Sprout and the inflation bug

00:49:51 – Freezing the Sprout pool in NU7

00:53:38 – What happens to 26,000 unclaimed ZEC?

00:55:38 – Q-Day & recycling lost coins

00:56:49 – The disk that could print ZEC

00:58:22 – Why nobody exploited the bug

00:59:21 – Ironwood & formal verification with AI

01:01:47 – A node implementation as a weekend project

01:03:06 – New Zcash nodes (Zakura)

01:03:31 – The eCash hard fork & its Zcash sidechain

01:04:14 – Dandelion++ & not being a zero-sum thinker

01:07:04 – Bitcoin dominance at 60%

01:09:10 – Stablecoins are wrapped fiat

01:09:55 – People want stability, not stablecoins

01:12:44 – Stability through liquidity & Argentina

01:13:58 – eCash & Braiins Hashpower

01:15:45 – Are Zcash miners being phased out?

01:16:27 – Crosslink: hybrid proof of work & proof of stake

01:20:23 – What Kris works on at ZODL

01:22:25 – ZIP 318: Orchard to Ironwood migration

01:23:26 – Tachyon & wallets

01:25:26 – Why Kris stayed with Zcash

01:27:32 – "The price didn't go up, but the promise did"

01:29:39 – Can Zcash ossify like Bitcoin?

01:30:50 – "When is Amazon going to be done?"

01:32:52 – Post-maximalism & many currencies

01:33:59 – What will be the currency of AI?

01:35:50 – AI money: instant sync, Mimblewimble & Zcash

01:38:13 – AI agents buying VPNs privately

01:39:09 – Imagining what AI agents need

01:40:23 – Bitcoin layer 2s & their trade-offs

01:42:10 – Ossification is death

01:43:36 – Saylor, covenants & Bitcoin's 2106 timestamp hard fork

01:45:20 – Bitcoin's North Star: never changing

01:46:57 – Day two: Zebend, a Zcash node written in Bend

01:48:11 – The Bitcoin forks magazine

01:49:15 – Zcash Community Grants & the Dev Fund

01:50:16 – How Satoshi meant to distribute coins

01:50:52 – The Equihash ASIC "extinction level event"

01:53:17 – Mining as arbitrage

01:54:00 – Security is not a market

01:55:04 – Grantees as constituents

01:56:19 – Reaching the debanked

01:58:12 – Hashrate distribution: ViaBTC, Foundry & Cypherpunk

02:00:10 – Do miners fund the Dev Fund?

02:00:33 – Proof of work & the labor theory of value

02:01:52 – Spend the Dev Fund like a startup

02:03:00 – Vlad defends proof of work

02:04:54 – Hashrate as a finality gadget

02:06:25 – Friendly forks

02:07:04 – What's the difference between mainnet and testnet?

02:08:01 – Testnet forks of mainnet: Crosslink & ZSAs

02:09:53 – All value is social: pesos & dollars

02:12:31 – Death by a thousand forks?

02:13:07 – Forks vs meme coins

02:17:12 – What if Zcash had been a chain fork of Bitcoin?

02:19:13 – What's next for Kris & Zcash's next 10 years

02:20:47 – Usability is the giant challenge

02:21:44 – No more steel plates for seed phrases

02:22:25 – Sean Bowe & BIP39

02:23:14 – AI made software cheap