S17 E50: Daira-Emma Hopwood on Zcash at 10, Halo and Private Money

We recorded this in Mexico, at an undisclosed location, on the weekend of Zcash's tenth anniversary. Somebody had booked a Halloween party into the same building, so people in Scooby-Doo costumes kept drifting past while we talked about trusted setups. On the table between us sat the keyboard, the discs and the blowtorched motherboard of the laptop Peter Todd carried through Canada in 2016, which I bought from him. Daira-Emma Hopwood picked up the burnt board and came away with black fingertips. "It's only carbon."

Daira-Emma has been with Zcash for eleven years, since before there was a Zcash to be on. Daira reviewed the code for the 2016 ceremony and designed the ceremony protocol itself, watching on a video link because travel was not possible. The cryptographer later co-authored the Halo paper with Sean Bowe and Jack Grigg, the work that led to Orchard and Halo 2 and removed the need for a trusted setup in Orchard. At the time of this interview, Daira's title is Head of Research and Assurance at ZODL, the Zcash Open Development Lab, which the entire staff of the Electric Coin Company founded the day after they handed in their notice.

That last sentence is why this conversation matters now. At its tenth anniversary, Zcash was confronting a grant controversy on X, the aftermath of the developers leaving ECC to found ZODL, and the security implications of AI-assisted bug discovery. Daira-Emma also argues that a coin-weighted poll derailed the ZSA upgrade. Daira disagreed with me at least four times.

The Zcash Ceremony Was Not the Bug

The most persistent misconception about Zcash is that the 2016 ceremony broke Sprout. It did not, and Daira-Emma is precise about where the fault sits. The Zerocash paper proposed using a proof system from another paper, BCTV14, itself adapted from an earlier construction that claimed security proofs. "When we looked back at it later, there was a bit of a hand wave," Daira told me, because adapting it had introduced a mistake in the setup.

The ceremony produced a transcript so that anyone could publicly verify what happened. "The flaw was that there were values included in the transcript" that came from the BCTV14 setup, were not necessary, and could have leaked what Zooko christened the toxic waste, the secret the ritual existed to destroy. The bug that sat in Sprout for two years was inherited from a proof system, not made on the day. The original security disclosure explains the mechanism more precisely: extra elements in the transcript let an attacker bypass a consistency check and create false proofs. This did not require demonstrating that a participant had kept the original secret. Destroying the ceremony hardware could not correct a flaw in the proof system.

Daira-Emma was not there. "I couldn't be at the launch," Daira said, despite having reviewed the ceremony code. The laptop produced a correction worth keeping. I pointed at a disc and suggested it might be the one that could have printed ZEC, because Peter Todd told me it might be disc D or F. The Zcash veteran would not confirm it. Daira said the memory came only from what I had said, "I hadn't checked that independently," and then: "That is not an independent source of truth." A fortnight of podcasting is not a chain of custody.

Zcash was the first cryptocurrency project Daira-Emma worked on. "I had very little interaction with Bitcoin," Daira said. "We were implementing a Bitcoin fork without really doing much about Bitcoin." The team learned Bitcoin and zero-knowledge proofs from scratch, then had to invent a multi-party computation ceremony, because nobody had run one for money. "It's actually really difficult in practice."

Then I got something wrong on air and was corrected. I had listed Daira-Emma with Zooko and Sean Bowe as dropouts, the folklore version of the story. Daira has a degree. "By the skin of my teeth," Daira said, and explained why: "I had significant mental health problems at university, because I didn't know that I was trans." Daira graduated anyway. Later, the cryptographer describes opposition to unfairness as a motivation for the work on private money.

Inheriting Bitcoin Core 0.11.2

Zcash launched as a code fork of Bitcoin, and that inheritance defined the engineering culture for a decade. Daira-Emma does not romanticise it. "There are plenty of reasons I wish Zcash hadn't inherited that codebase." In Daira's account, zcashd had been deprecated and did not follow the NU6.3 upgrade, so it was no longer a consensus node on the current network. Some of its code was still used optionally in Zebra and Zakura. Zebra is the Zcash Foundation's node, written from scratch in Rust, and the Zcash veteran calls it better factored and easier to maintain.

The timing was not a coincidence. From around March or April 2026 the rate of AI-assisted vulnerability discovery ramped up sharply, and a series of issues landed on zcashd, the Orchard bug among them. Maintaining an ageing C++ codebase stopped being a preference and became a liability. "It was just in time," Daira-Emma said, and you can hear the relief.

As a protocol, the transparent half still carries the fingerprints, at Bitcoin Core 0.11.2, seams and all. Where Bitcoin reaches for soft forks, Zcash has always been willing to hard fork, and Zcash wrote a protocol spec thick enough that people compliment Daira-Emma on it. "That is exactly how to have an AI check the implementation against the spec." Zcash started at 150 second blocks, halved that at Blossom, and NU7 proposes a cut to 25 seconds.

The Equihash Mistake

I asked what Daira-Emma would change before launch. Daira has thought about it a lot, and the answer is critical of the mining industry. "We got the parameters wrong, and it required less memory than it should have." Equihash was meant to be ASIC resistant. The chosen parameters meant a low-memory implementation was possible, and they found out shortly before launch, too late to change it.

The consequence was not immediate: the network stayed mostly GPUs for a while, then ASICs arrived sooner than they otherwise would have, and proposals to keep proof of work ASIC resistant landed in the middle of preparing Sapling, which also fixed a security vulnerability and could not wait. Sapling took priority and the network went to purpose-built hardware.

What Daira-Emma regrets is not the hardware. It is the people. "The issuance to users of GPUs was to a wider set of people that was probably more aligned with our original politics and goals than mining pools." Daira remembers the GPU hobbyists as enthusiastic and engaged with protocol developers. Daira knows how this lands: "I probably haven't made many friends with ASIC mining pools saying that, but it's okay, that's what I think." I pushed back on the economics of home mining in the sponsor discussion, arguing that renting hashrate can be cheaper than mining at home in Europe. But Daira's point is about governance, not hardware: the shape of the hardware decides who gets a say.

Crosslink, Finality, and Pools We Cannot See Into

Crosslink is the Shielded Labs proposal people summarise as proof of work plus proof of stake, and Daira-Emma corrected my mental model of it. It is not alternating blocks. Proof of work keeps producing the chain as it does now, with minor changes, and a Byzantine fault tolerant consensus layer sits alongside it to answer a question pure proof of work cannot answer cleanly: which block is final. The staking layer is "resistant to partitioning attacks" and gives "this objective way of deciding what is a finalized block". If you can split the miners, by attacking BGP or through an ordinary net split, miners on either side can extend different histories while the partition lasts. Proof of work still has a fork-choice rule based on accumulated work, but it does not provide the deterministic finality Daira is describing.

Then I pushed. I described Crosslink as a proposal from a period of concentrated mining and put roughly 30% of the hashrate with Foundry in the US and 30% with Chinese miners. Those were my on-air estimates, not independently established measurements. Isn't this a bear-market fix for a problem that partly solved itself? "I design things for the long term," Daira-Emma said. "The current distribution of hash power between mining pools is, I see that as a temporary situation that shouldn't be assumed in the long term." Then the sharper point: "You can't necessarily take at face value that every mining pool is controlled independently."

I argued that competition between jurisdictions buys resilience. Daira-Emma answered that two governments with opposite politics can converge and end up "trying to promote surveillance for themselves." Foundry in America and a Chinese pool are not a hedge if both capitals decide privacy coins are the problem. I also raised something I picked up at the conference, that Foundry KYC-checks its miners and pays rewards to transparent addresses, and asked Daira to confirm. The cryptographer would not. "I don't know," Daira said, twice. Take that one as my claim, not Daira's.

Making Zcash Private by Default

A recurring criticism of Zcash is that users can transact transparently rather than use its privacy features. Daira-Emma's answer is about where funds actually sit. Daira points to wallets that hold balances shielded, so sending to a transparent address for an exchange is a decision taken from a private base rather than a leak you cannot avoid. Daira also thinks the exchange problem is overstated as regulation and understated as engineering: exchanges built on Bitcoin, some run HSMs that cannot handle the cryptography. "It's not a regulatory problem," Daira said. "It has often been a technical problem."

I asked whether Daira-Emma would go further and remove the transparent side, framing my question around Ironwood and supply auditability. "We're getting close to the point where we could do that." Daira identifies weaker multisig support in the shielded protocol as one technical blocker being addressed. The cryptographer's deeper regret is about addresses. Transparent addresses were close enough to Bitcoin addresses that software could be adapted cheaply, which is why so many wallets only ever supported transparent ones. "In hindsight, that might have been kind of too much of a compromise." Daira's preference now is every address carrying a shielded and a transparent component, so handing it to anyone gives them the ability to pay you privately. The other half was Electric Coin Company deciding early that it was not a wallet company.

The Job Daira-Emma Could Have Left

I asked the obvious question: you could have advised any of the zero-knowledge projects that raised real money and left. Why are you still here?

Daira-Emma's first answer demolished my premise. Sapling shipped in 2018, two years after launch, and solved the client-side performance problem I was describing. The primary motivations for Orchard were removing the trusted setup and changing viewing-key support, rather than solving the mobile-wallet performance problem. "Zcash did need me, I felt," is how Daira puts it, and the reasons are political as much as technical: a belief in people having access to private money, the knowledge that there were contributions to give, and a love of the job and the people. The Zcash veteran could have earned double elsewhere. Daira nearly ran out of money, which is why the possibility was live. Daira did not take it, and did not dress it up as a sacrifice.

Then the strangest corporate story of the year. Electric Coin Company was a for-profit owned by a non-profit, Bootstrap, and there was what Daira-Emma calls "an irreconcilable disagreement" between the staff and the Bootstrap directors. The staff handed in their notice, and the next day they started ZODL with exactly the same employees. "You can just walk out and start another company," Daira said, if the structure of the old one is holding you back. The news cycle that followed said the developers had abandoned Zcash and the VCs had dumped on retail. They had changed companies without leaving the project.

I attributed much of that criticism to Monero supporters and asked about the competing protocol. Daira-Emma thinks it is "politically an odd strategy to say that you're a coin for buying from dark markets", and prefers a different line: "Zcash is a coin for everybody." On technology Daira was specific rather than tribal. Ring signatures hide the real input among a small fixed set of prior outputs, a set visible on chain and expensive to enlarge, while the cryptographer contrasts that with a Zcash input whose possible source can range across the relevant shielded pool. Monero's full-chain membership proof proposal is, in Daira's assessment, technically good, and Zcash will have to keep up. Zcash moved away from trusted setups, which Monero used to call a weakness and which the Zcash veteran concedes was real. "I think that Zcash is in a very good competitive position relative to Monero." Some of the attacks around all this Daira called "inappropriate", the most English sentence in the episode.

Privacy Below the Chain

On-chain privacy does not by itself hide a transaction’s network origin. "I see network-level privacy and on-chain privacy as complementary." Zcash has lagged Monero here, which ships Dandelion++. Daira-Emma supports implementing Dandelion++ or Nym and Tor support made more robust.

Then a stretch with no cryptography. My girlfriend is from Iran, and I described what it looks like from outside: some Western VPNs simply do not work there, the ones that do keep working, and you start to wonder why. Daira-Emma was bleaker than me. "In some countries the authorities will go after you for using a network obfuscation protocol like Tor or Nym" on its own, whether or not any cryptocurrency is involved. The weak points are the entry and exit points, and the defence is operating system hardening plus making it expensive for an adversary to run nodes.

From there, hardware wallets, because the recent attacks had raised practical questions about self-custody. Daira-Emma admitted the hacks prompted a rethink of long-held assumptions. Daira's recommendation is blunt for someone who builds protocols: multisig by default, for everyone, two of three rather than two of two, because if one device dies a two-of-two is a brick. Not a server-held cosigner, which is what I assumed. Daira wants the phone holding part of the key and the hardware wallet the other part, which, Daira says, could potentially be implemented with existing devices and small firmware changes.

Daira-Emma's supply chain point matters as much as the choice of device. Security does not come from the device alone. If you buy an iPhone at an Apple store you are in a building Apple pays a lot of rent for, which is doing more for you than most people realise. On Ledger Daira said several people had reported that the devices are easy to open and that opening one does not wipe the secure element. I said on air that an attack had inserted a chip with an eSIM; that is my claim, not something the cryptographer verified. Daira's conclusion was narrower: if a vendor has to reassure you that a second-hand device is safe, that is itself the problem.

Zcash Community Grants: The 8% and the Whales

Before saying anything about the Dev Fund, Daira-Emma declares an interest, and I want it on the record in those words. The Zcash veteran was one of the founders, received part of the original founders reward, calls it a contractual obligation and payment for the work, and says so before making the argument rather than after. Daira's case is not abstract. "I think it's been extremely well spent," Daira said, and then the part that surprised me: even with that money the team was underfunded, did not have enough staff, and that held Zcash back for years.

The dispute at the anniversary gathering was about the 8% slice that goes to Zcash Community Grants rather than core development. Daira-Emma's argument is structural. Coin-weighted polls are dominated by whales, so if whales decide everything, the grant slice exists to be a counterweight, funding grassroots projects the largest holders might not approve of. "The whole point of this grant slice, which is 8%, not 20%," Daira said, is to expand the pie rather than concentrate the decision. On the grant that started the storm the cryptographer was unambiguous: "I think some of this criticism is bullshit." Daira added that the people involved are good people, that they are trans, and that a lot of the opposition is transphobia while not all of it is. The issue here is equitable access to outreach funding, rather than the identities of the individuals involved.

The frame Daira-Emma put around all of it is the part I did not expect from a cryptographer. "Sex workers were a constituency that I was explicitly thinking of when I decided to become involved with Zcash." Daira's reasoning is that crypto has a credibility problem with the left, and that the people who most need private money are often the people banking already excluded. I brought up Chris DeRose interviewing sex workers in Miami a decade ago, buying bitcoin from ATMs because they had no alternative. That is product market fit. The Zcash veteran had a criticism for crypto's own side too. If the complaint is that ZCG has not spent its money, make that complaint specifically. "Don't try and take away the money."

The Haters and the Rock

The harassment section is short and ugly, and Daira-Emma does not soften it. A previous interview went up on X with replies open, and Daira described what came back. Daira does not think it is a coincidence that trans sex workers were targeted. And Daira rejects the idea that X is the right venue for the argument: "it is a toxic place for us," Daira said, and called the notion that the debate belongs there bullshit. Then Daira addressed the people directly. "They can't win, because we need financial privacy." The same people attacking Daira need the very thing being built, whether or not they know it, and refusing a privacy coin because of who develops it is shooting yourself in the foot. To the ones posting hate under those interviews: "fuck off."

I offered Daira-Emma Camus, badly, because that is what I do. The Myth of Sisyphus, the rock, the choice to be happy inside the punishment. Daira had read it and forgotten it, which is the correct response to being lectured about Camus by a podcaster. What ZODL's head of research said instead was better than my analogy: "We are very productive." The anger goes into the work, and Daira is not pretending it is absent. The cryptographer's answer to harassment is not that the anger has stopped. It is that the anger has not stopped the work.

Two Years of ZSA Work and a Coin-Weighted Poll

Zcash Shielded Assets were meant to let Zcash hold other assets inside the same anonymity set as ZEC, rather than only swap between assets on separate chains. The initial proposal was a building block, and a further idea, Zcash Shielded Asset Swaps, would have allowed atomic swaps between assets. The work was slow, pre-AI slow, and slipped more than once.

Then came the sentiment poll, and this is where Daira-Emma's frustration is sharpest. The community has several caucuses where one person gets one vote, and a coin-weighted poll alongside them. In Daira's account, all the one-person-one-vote caucuses from the protocol side supported activating ZSAs and the coin-weighted poll did not. That poll had a very small number of participants, visible from the vote count and analysed on the forum afterwards, and its opinion was treated as outweighing a much larger part of the community. "It derailed a development process that had been going on for two years," Daira said. That is Daira's criticism of the process: a small coin-weighted electorate effectively vetoed a much longer development effort.

Daira-Emma is not arguing sunk cost. "I think it was a good idea, I think it was technically sound, it was overtaken by events." The events being quantum. Daira's answer to the "nobody knows if there is any market" objection is the best line in the episode: "If we'd applied that argument to Zcash itself, then we would never have launched Zcash." Conventional wisdom in 2015 said nobody cared about privacy. It was wrong, and the surveillance state has since added an AI layer that can analyse what the three-letter agencies used to drown in. Daira also refuses the argument that multiple assets confuse users, since users already hold multiple tokens. ZEC, in Daira's framing, is a means to an end, and the end is private digital money as the standard rather than the niche.

Quantum is what Daira-Emma spends much time on now. Daira thinks the timeline has moved forward, partly because AI is helping solve the engineering problems of building quantum computers, and the extended Church-Turing thesis appears false. The cryptographer says moving Zcash to a post-quantum protocol is under active consideration and requires substantial cryptographic engineering. The ZSA design as specified is pre-quantum, which does not make ZSAs impossible, only something that would need redesigning.

Move Fast and Break Things Carefully

I came into this section with a thesis and Daira-Emma took it apart. My claim was that Zcash had an edge because it got a frontier model months before anyone else, which is why it found its inflation bug and patched it while other privacy chains were drained. Daira corrected the facts. The Orchard vulnerability was found by a person using a publicly released model, not through privileged access, and ZODL's access to a stronger model came well after general availability.

"It is human expertise, both in finding bugs and in knowing what to tell the AI to look for." That is the sentence I would put on a slide. What made the difference was institutional memory, and having run incident response enough times that the process is muscle.

The comparison Daira-Emma drew is the one I keep thinking about. Daira remembers the response to the BCTV14 flaw as taking the better part of a year. The contemporaneous disclosure gives the exact chronology: Ariel Gabizon found it on March 1, 2018; Sapling removed the vulnerability on October 28, 2018; the public announcement followed on February 5, 2019. Four people knew. The Zcash veteran was not one of them, and they held it quiet until Sapling shipped. Orchard: found on 31 May, switched off on 2 June, so 48 hours, and back on a day later after Daira spent a whole night integrating the fix into zcashd. "It's dedication and experience."

Daira-Emma's conclusion is not triumphal: two potential balance-violation bugs in a decade is two too many. Daira says there is no evidence that either was exploited. "I don't think that we need to do upgrades every few months. I think that's completely unnecessary." Daira sees pressure inside the community to ship faster and thinks it is a burnout machine and a vulnerability machine at once. Hence Daira's emphasis on Ironwood's formalization, and the argument that assurance should be the default for future pools rather than one pool's luxury. The cryptographer also insists both bugs were oversights rather than deep wizardry, which is worse, because oversights are what review catches. I mentioned what I had read about other privacy chains and their inflation bugs; those were my claims on air, not Daira's.

Research and Assurance: Why Humans Must Understand the Code

I asked about the title, because Head of Research and Assurance is a strange thing to be at a company that began as a protest. Daira-Emma was in management before, admits to not being very good at it, and is glad others do it better. What Daira has instead is extreme attention to detail accumulated over fifteen or twenty years, and a job that uses it: tell Claude to do some cryptography, watch it make mistakes, fix them. And training a machine is not training a person. "Understanding the artifacts that we produce is essential, it's not optional." If the systems are understandable only by AI, we have built something that will not serve us, and the Zcash veteran worries about "teaching it to do my job and how to replace me".

The biography is not the one people assume. Before cryptography Daira-Emma was a control engineer, building automation for factories, conveyor belts, motion control. That work taught Boolean logic and safety in the literal sense that a mistake in a motion control system can take an arm off. Daira saw shortcuts taken there and left partly because of it, and the refusal to take shortcuts that hurt people is the straight line from there to here. Daira's papers are few and load bearing: one on Mixnet reputation systems with Roger Dingledine's group, and Halo, described by Daira as having spawned a wide range of other zero-knowledge protocols. The cryptographer is not a prolific author. Daira is the person you want reviewing the thing that cannot fail.

Private Money as Successful as Cash

Ten more years, and Daira-Emma will not predict without first telling me about a prediction, made in 2000, that computers would not pass Turing tests until 2050. What Daira will say is that the protocol goes fully post-quantum, that it scales, and that the perception of crypto on the left gets fixed. The industry is seen as a hive of scams and gambling, and the Zcash veteran thinks that is a failure of the people building it, not of the people watching. "We want to be as successful as cash." Then, having disclaimed predictions, Daira said it again: "We'll be as successful as cash."

Two small things to close. I asked whether Ironwood was named after Hopwood. It was not. The upgrades have a plant-themed naming tradition, including Heartwood, Canopy and Sapling, and Daira-Emma thinks the collision is a coincidence. And when I mentioned Amber O'Hearn at the anniversary party and the fact that Zcash's colour is amber, Daira remembered the palette was chosen partly so it would not look like an anarcho-capitalist flag.

The reason Daira-Emma gives for doing this work reaches beyond cryptography. Daira has been driven since childhood by trying to fix unfairness, and the people who most need surveillance-free money are the ones society has already decided to attack: trans people, sex workers, homeless people, who may have nothing to put in a wallet today. Eleven years of maths so that someone with no bank and no permission can still be paid. The rock is still there. Daira keeps pushing it, without asking anyone for sympathy.

This episode is sponsored by Cake Wallet, SideShift, Orange Rock, eCash (ECX) and Braiins Hashpower. The eCash sponsor here is the Bitcoin fork with Drivechains discussed in the ad read, not the separate XEC project.

For another perspective from the anniversary gathering, listen to S17 E49 with Kris Nuttycombe. For the rest of the Zcash story on this feed, start with S16 E29 with Zooko, then S17 E28 with Josh Swihart on the Orchard bug and the founding of ZODL. If you want the long version of why Bitcoin never shipped this technology, I wrote it in Zcash: The Privacy Moon Math Bitcoin Was Afraid to Include, and to see the laptop from our table opened on camera, there is Peter Todd unboxing his Zcash ceremony laptop. Daira-Emma's code is at github.com/daira, the Halo paper is on the IACR ePrint archive, the protocol spec is the Zcash protocol specification, and the wallet built by Daira's team is at zodl.com.

Time stamps

0:00:00 Intro

0:00:45 Zcash at ten in Mexico

0:01:34 The 2016 ceremony

0:02:31 Sprout and BCTV14

0:03:29 Halo and the trusted setup

0:04:31 Correcting the dropout story

0:05:32 The destroyed ceremony laptop

0:07:57 Designing the MPC ceremony

0:10:35 Bitcoin Core and zcashd

0:12:15 Zebra, Rust and the protocol

0:14:35 Block times and NU7

0:16:56 Sponsors: Cake Wallet, SideShift, Orange Rock

0:18:24 Equihash and ASIC resistance

0:21:15 Crosslink and finality

0:25:33 Mining pools and jurisdictions

0:27:06 Sponsors: eCash (ECX), Braiins Hashpower

0:29:00 Why stay with Zcash?

0:32:42 Zcash technology beyond Zcash

0:36:38 Private-by-default addresses

0:39:22 ECC staff leave to form ZODL

0:45:11 Tor, Nym and Dandelion++

0:47:57 VPNs and censorship

0:49:30 Hardware wallets and multisig

0:54:21 Slush, Trezor and Zooko

0:55:11 Financial trade-offs

0:55:35 Zcash Community Grants

1:05:27 Harassment and financial privacy

1:09:37 Ironwood and plant names

1:10:57 ZSAs and coin-weighted polls

1:23:20 Could Bitcoin adopt Zcash privacy?

1:25:17 Security and formalization

1:27:44 Why the developers keep building

1:30:50 The next ten years

1:32:43 Cryptography and control engineering

1:39:42 What motivates Daira-Emma

1:41:31 AI, accessibility and burnout

1:46:47 AI and the Orchard vulnerability

1:55:11 Research and assurance at ZODL

1:57:15 AI does not replace teaching

1:59:35 Science fiction and trees

2:01:08 Why Zcash is amber

2:01:58 What we covered

2:03:48 Thank you and goodbye