Quadrillions: Privacy or Perish | Eli Ben-Sasson, Shaul Kfir, & Eric Saraniecki

Now, I always said that getting privacy is easy. The hard part is integrity. So you can just take whatever transaction you want, like, you know, shield it or encrypt it or put it under a hash. But if you have this big, you know, wide network that anyone can participate in, how do we know that what you shielded, you know, was computed with integrity? How do we know you have the funds that you claim you have?

Quadrillions is a miniseries produced by Blockworks and is sponsored by Canton Network. Nothing on this show is a recommendation to buy or sell securities or tokens. It's for informational purposes only, and the views expressed by anyone on the show are solely their opinions, not financial advice or necessarily the views of Blockworks. Our hosts, guests, and the Blockworks team may hold positions in companies, funds, more projects discussed, including those related to Kanton Network. All right everyone, welcome back to Quadrillions. Very excited about this. This is episode 4. If you have not listened to episodes 1, 2, and 3, I would highly recommend. Really good episodes. Uh, this might— I don't want to, you know, get people too excited— this might be our best episode yet.

It's—

we are going to do an hour-long deep dive just on privacy. We have two of the privacy GOATs joining us. We've got Elie, Ben, Sasan, Um, hi. Yeah, a legend, computer scientist, um, very well known for his work on ZK proofs. Uh, also the co-founder and CEO of Starkware Industries. Uh, I think I'm gonna get it right that you're a founding scientist at Zcash.

Yes.

And, uh, we also have Shaul, uh, Kfir, uh, who's one of the founders of, uh, Digital Asset, software engineer, uh, co-authored Libsnark, I think in 2012, which kind of launched the whole ZKP movement. 2013, you guys were the first to introduce the idea of ZKP for crypto scaling and privacy. And we have Eric, who I've already introduced, but also a great guy.

So zero crypto ZK accolades.

Zero knowledge on crypto.

You missed my take at the beginning. I was Elie's research assistant.

You were Elie's research assistant?

Yes. So the work on Libsnark was actually Elie's work, and I was his research assistant.

Ah, okay. So my first question is, you know, Are you guys— is it friends or like frenemies here? Because you guys, you know, kind of compete with each other, but, you know, I didn't realize the personal connection. So is it— what's the relationship here?

Yeah, I guess friends and competitors. It can be both.

Wait, I got to tell you the origin story. So when I was a professor at Technion, one of the tasks that I got was to select 5 potential entrepreneurs a year for like an excellence in entrepreneurship program. And Shaul was one, and I actually did two cohorts. Shaul was one of the five that I selected in one of the cohorts. There was, so I selected overall over my tenure there, 10 entrepreneurs. I think probably at least 3 or 4 Shaul may know from his, uh, you know, year and the next, or I don't know if he was the second or the first, like There are quite a few unicorn, you know, founders from that 10 people. And then later on, I asked Shaul to join as a developer in, indeed, in Libsnark. And we had this whole Skipper Lab that ended up spinning up both Zcash and then StarkWare. So that's how we know. And certainly not frenemies, friends, though. Yeah, a little bit of competitors.

Nice.

I love that.

All right. Maybe we can start with just this idea of privacy, because I want to make this whole episode about privacy. I'm curious if you guys agree. You know, I was trying, trying to prep for this episode, and one of the tough things about this is there's like 20 different definitions of privacy. So I'd actually love to just start by defining privacy in the crypto sense of the world, of the word, and seeing even if you two agree on this idea. So maybe, Lee, I'd ask you to kick us off by just like, how do you think about what privacy means here?

Well, first of all, it's related to human dignity. It means that like the stuff you don't want to be seen is not seen by anyone who doesn't need to see it. It's probably just like your everyday definition of privacy. And just the only thing is that like everyone's familiar with privacy and financial applications, and it's somewhat of a mystery as why is this even an issue on crypto. But just privacy means, you know, people who shouldn't see your stuff don't get to see it.

Mm-hmm.

Shaul, how do you think about that?

Yeah, I agree. I mean, privacy isn't a, you know, a TradFi versus DeFi thing. It's just a normal people thing. You know, I don't want people seeing my stuff unless I choose to do business with you or if I choose to disclose certain information to you, then privacy means I get to choose, you know, who sees my stuff. And I think, you know, to Elie's point, I think in crypto, there was kind of, there was an original bug in crypto and Satoshi saw privacy as a feature, but he didn't really know how to implement it well. And he realized that even if you look at Bitcoin Talk, he was saying, hey, maybe zero-knowledge proofs, but I don't really know how to do that. And then over time, this bug of blockchain is that you didn't have privacy. People kind of turned that into a feature, said, oh, you know, Internet Computer, transparency is a feature. So I think it's kind of after the fact people trying to justify the lack of privacy. And that's why we have all these convoluted definitions of privacy. And now I'm really glad that in the last kind of year or two, people started coming back to that realization of, no, privacy is actually kind of a fundamental thing. It's a human right, it's a business need. And it's just something that we need in blockchain. So I think it's going to become much simpler from now on. And we won't have all these kind of convoluted definitions of privacy.

Can we double-click there? So, Charleaux, you would say that the transparency of a blockchain, even starting with Bitcoin, is a bug, not a feature?

Yeah, definitely. I mean, some people have built things on top of that transparency as a feature, but I don't think it's a fundamental feature or even a desired property of a blockchain. I mean, would you accept your payroll if it was completely public, or would you be able to do any kind of contracting for your business if it was all posted on Facebook? So no, I mean, humanity has been working for hundreds of years and thousands of years with this kind of fundamental expectation of privacy. And I definitely think it's a bug, and Satoshi thought it was a bug. He was very public about that. And we just didn't have the technical capability to do it until very recently when added to smart contracts.

Yeah, it's not a trad fi ideal. This is a CryptoPunk ideal too. I mean, how could you build borderless censorship-resistant money if you really believe in the original Bitcoin whitepaper? How can you do that if everyone can see everything that you're doing at all times? Even, even in kind of the extreme, you, you have the opportunity for someone to knock on your door and physically take the coins from you. And that all starts with knowing who has what and what they're doing with it and how they participate. So it's— I, I think it's a real mistake to say that this is something that TradFi is pushing. It's, it's as much an individual ideal as it is, uh, institutional requirement.

Joel, you mentioned it has— we haven't had the capability to do this. Maybe, Elia, I'd ask you, like, you know, you've been working on privacy for so long, like, why, if everyone wants this— the institutions want it, and the CryptoPunks, or the, you know, the cypherpunk movement wants it, everyone wants it— why hasn't it existed yet then?

Yeah, so, um, going back to, like, you know, we all pretty much have pretty good privacy when we work on, let's say, Venmo, or, you know, Robinhood, or Revolut. Um, so why is it even an issue on crypto? And let's unpack that. So with like Venmo, what happens is you have some trust relationship with Venmo, and then they basically— but you don't really own your assets. It's like, you know, Venmo, you custody it with Venmo. So then they open some encryption channel with you, like some secret channel. You tell them everything and you ask them to, you know, do whatever it is you want. Now the whole point of Bitcoin is that there is no trusted Venmo. It is this open, beautiful network where its security is pegged on everyone being able to participate. So because of that, you have this transparency so that everyone knows the integrity of the system, that the right thing is being done. Now, I always said that getting privacy is easy. The hard part is integrity. So you can just take whatever transaction you want, like, you know, shield it or encrypt it or put it under a hash. But if you have this big, you know, wide network that anyone can participate in, How do we know that what you shielded was computed with integrity? How do we know you have the funds that you claim you have? So the problem is one of integrity. Now, the solution for that is obviously ZK. That's what solves it. And the problem and why this hasn't been adopted is, first of all, it's a very gnarly technology to work with, but more so, it just leads to pretty shitty UX compared to just doing things transparently. So it's a bit harder to, you know, come in and out of exchanges. Most of the hardware wallets that we're all familiar with don't support it. All kinds of things that come from this being newer technology. So to answer your question, why is privacy an issue? Because it works very differently on decentralized blockchains, and the solutions to it lead to a UX that is, uh, not so much fun to work with.

Do they not support it because the technology is complicated and tough to deal with it or because of compliance reasons?

It's more the former than the latter. So, okay, and it's separated. A lot of exchanges, for instance, have a hard time listing Zcash or getting shielded Zcash payments, not because they can't support the technology, because of compliance. But if you ask like, you know, Ledger and Trezor and, you know, hardware wallets and so on, why aren't you supporting it? It's not because of compliance. It's because that generating some of these ZK proofs is just a really, it's another order of magnitude or 2 or 3 orders of magnitude more complicated than just generating a signature for a Bitcoin transaction.

Yeah.

So it's a bit of both. I completely agree with Elie that when privacy is easy, getting consensus with privacy is harder. And actually this technology has, you know, started working on these things very early. So, you know, Zcash launched in 2014. It still wasn't general-purpose smart contracts, but it was zero-knowledge proof for Bitcoin-like currency. Canton has been live since 2020. So that's, you know, 5 years ago. But then the next phase is how do you get a good user experience on top of these things? And how do you get it accepted within institutions? That takes time, getting good software ready for mass adoption is something that takes time. But the technologies were there. And I think now we're at that point of having kind of already, you know, dotted the i's and crossed the t's to a point where it's completely ready for mass adoption.

What do you think about in terms of the pain points that exist today? Like, you know, I'm thinking about a listener listening to this being like, honestly, things work fine. Like, I use I use both sexes and dexes. My life is good. I don't really care. Like, what is the pain point that you think we, we are facing today that it seems— I think Shaul and Eli, if I asked you guys like, what, what, what does the industry need to grow up? I think you would both say privacy. And I'm curious about the maybe the why behind that. Like, what's the customer demand that's actually driving that scale?

I mean, like, anyone's willing to do something openly and transparently over a few hundred bucks. I don't think anyone's willing to buy their house, like, with all the money that they need to move and everything else along those lines to do so. It, it's a scale thing. We keep bumping up into this artificial low ceiling on the adoption of these networks because the wholesale capital markets are not willing to adopt it. People are not willing to adopt these things for the backends, you know, the, the treasury side of what they do. Like, even look at something like Circle. They are massively on-chain around the world. But only for USDC, not for how they manage their treasury, not for how they manage their reserves, not for how they manage the backend of their product. And that's not because blockchains aren't good at that. In fact, I mean, we've proven quite well that they're very good for those types of things. It's just that there is some stuff that when you operate at scale or you do sensitive workflows, you don't, it's not additive to be public information.

Yeah, I want to share with you a story from my company. So I run Starkware. We have 200 employees, one of the larger, you know, decentralized blockchain infrastructure teams in the world. And recently we decided to offer our employees to receive part of their salaries over Starknet, okay, in stablecoins. And, you know, everyone's doing that. So my CFO came to me and said, hey, look, this is a problem, right? Because like you can on a browser start clicking and seeing how much others are getting, what is the size of the payroll, stuff like that. So This is an example of, so we found ways around it, but like, and we are adding a whole bunch of privacy features to Starknet to exactly address these things. But this is an example of, you know, a company needing to do more business on a blockchain and then realizing that privacy is really needed. And that example happens to be us. So like, I know this from firsthand, but yeah, for myself, maybe as I'm degenning or aping into whatever the latest, you know, shitcoin or something. Yeah, maybe I'm fine with not having it private.

Yeah, privacy is the missing feature. I think there's this misconception also that a lot of these, you know, ZK rollups sell privacy, and they don't. So privacy is actually a feature that we have not had until recently. An L1 smart contract blockchain that has privacy, that is the unlock.

I want to pull up a, um, a tweet by Tushar at Multicoin where he said, um, He said privacy is a feature, not a product. Curious if you would agree or disagree with that.

I find it so ironic how, uh, how aggressive the Solana ecosystem is against privacy because I always use Solana as a great example of an ecosystem getting built around a feature that everybody knew that they needed and was a first principle. Like the way, the way I tell the story, I don't, I don't know if it's the way they would tell it, but I always say, okay, the whole world was like, yeah, yeah, yeah. Fast and cheap, fast and cheap, fast and cheap. We need it. And a lot of people didn't take it seriously. They had these white papers that were like, well, theoretically, here's how we would do it. And they didn't have a deep enough respect for the problem. And Solana showed up holistically different than other people, and they actually were fast and cheap. And then there was a whole ecosystem that got built around that and a whole community that got built around that. Now it's table stakes, fast and cheap, but they're still winning because because it was a first principle and they were the first to really get there and do it really well. And now that there's another feature like that that is just missing from the stack, it's like they've completely forgotten the exact thing that put them in the strong position that they're in today, that approach of this is a very serious problem, we're going to take it seriously from first principles. It requires a holistically different approach. I can't just bolt it on after the fact. It is one of those fundamental changes. You know, Elie mentioned UX. UX with privacy is a whole different world. Like when you— when I can't just hit any block explorer and see every bit of information that I want, just that even that architectural design is different, even if you want to create a similar experience. So to pretend like this is not a first principles thing is a little bit, I think, talking own book and then ignoring the history that got them where they were. And let's not forget that, you know, they ran into their own issue with trying to bolt this on around the, the confidential transaction issue that they found in production.

And I'm not—

I don't point fingers or laugh at anyone because everyone is doing these things and they're working very, very hard. So this is not me trying to, you know, stand on a soapbox and say, told you, told you, told you. It's more— it's because they didn't take it as seriously as I think they needed to. They ran into that, and then they are very quick to just pretend like, oh well, we'll just try harder next time, or something along those lines. I think it is one of those— one of those core, core principles you have to start with from scratch.

I actually love the response here on the tweet that you have on the screen. So I see Tom Howard. So I don't know who Tom Howard is, but I just had an exchange a few weeks ago with him and he is awesome because he is a Zcash maxi and he was really in good faith engaging to try to understand how Kiantan does things, what assumptions we made for which we're doing things differently from zero-knowledge proofs and Zcash. So again, I just kind of came to know him and he's awesome, but his answer here is great because he's saying, Often to have true privacy, you need a big— every architecture decision of the L1, which often breaks existing L1s. It's not something you can bolt on. Eric always gives this example of if you try to build a skyscraper on top of the foundations of a single-family house, you're not going to be able to do that. That's kind of trying to bolt on privacy onto something that wasn't designed for it. And it's both the cultural change, the political barriers, but also all of the foundational architecture, the design of the data model, of the consensus, everything, you can't just add that after the fact. And I think Elie, me, people who came out of that, out of the Skipper Labs who came from kind of a privacy-first mindset, we built these things with kind of the non-negotiable feature from day one was things need to be private. And then you build on top of that and you say, okay, now how do I get to this when things are private?

I love that tweet, because like you can expand it to all of crypto. The price action on almost any— sorry, on every asset I've seen so far, the price action is first and foremost attached to some memetic value that captures something for which it is, you know, first or best known or something like that. So Bitcoin, right? Money. Well, look, Bitcoin is not used as a medium of exchange today. It is, you know, doesn't have the scale, doesn't have other things. But nevertheless, it's right, the expectation that someday, you know, layer will be built on it that will allow it, that drives its value, which is great. I love it, right? Ethereum, you know, the world computer. It is not the world computer. It is not today the place where all financial transactions happen, but the expectation that it may be the basis for that is, you know, is what drives its price. Solana, decentralized NASDAQ. NASDAQ is not running on it, probably never will, but the expectation that this will be whatever the fast consumer da da da. So now that Zcash which had this thing about like privacy is normal or Bitcoin with privacy from the start, the world is now attaching or like finding or discovering this even though we said it many years ago. It's very funny to see how the others who benefited from the same sort of action, Solana and others are now, oh no, these guys, you guys, this cannot happen in this case. It only applies in our case. But it's funny because it will apply time and again, right? Hyperliquid, you know, Pump.fund, prediction markets, they are— their value often is sort of based on the expectations of what the world will look if they become the infrastructure for everything. But none of them yet is right.

Right. I'm going to ask a really dumb question that will out me as not understanding some of this. Eric said that you can't bolt this on. Um, the thing that came into my head is, well, I see people trying to bolt it on. Um, there was an announcement with, um, that I'll pull up here. It was, uh, Optimism and Succinct, and there was a blog post that said, uh, now we can seamlessly upgrade any existing OP stack chain to ZKPs in just 1 hour. Or there's another thing, it was like Arbitrum rolled out Arbitrum ZK proofs. So this is me not fully understanding this. Why can't— like, can Solana just wake up one day and be like, I really need privacy? And they start to— I don't know. Yeah. Like, I mean, Eric said you can't do it, but why can't they just bolt it on? Because it looks like, you know, Optimism's bolting on privacy with succinct here. But tell me why I'm not understanding.

This is hitting on one of the most common misconceptions about zero-knowledge proof. So zero-knowledge proofs can give you two features. They can give you privacy. and they can give you integrity. And what all of these folks are doing, they're improving scalability by using zero-knowledge proofs to prove things faster, to do the consensus faster. What they're not doing is adding privacy on top of these chains. So these are not actually announcements about the addition of privacy to these chains. It's just about using zero-knowledge proofs to achieve higher scale. So I don't know if you noticed there, but it actually talked about scalability in the headline. And this is where a lot of people get these two mixed up. And there's a lot of sleight of hand. I think a lot of the marketing is done on purpose using kind of the term zero-knowledge proofs and emphasizing the zero-knowledge while they're always very careful not to talk about it as a privacy feature, but about it as a scalability feature.

Yeah, I wanna say that for a very long time, I tried to fight this windmill, right? Like Don Quixote fighting. I said, guys, don't call these things ZK rollup. Call them validity rollups because most of them, well, there are some counterexamples. For instance, Aztec actually has ZK. Aztec and Noir have ZK. So, some of these actually go with ZK, but like, I sort of gave, well, I didn't quite give up, but I realized even from the start that it would be impossible. So, what happened was that people called things ZK rollup even though they don't have ZK. And now, because ZK actually talks about the privacy aspect, sort of this whole thing gets bungled up. So yeah, just adding proof technology to a chain doesn't mean that it offers privacy. And I'll say even more than that, even if you do add true and honest ZK proofs to something, that by itself doesn't make the whole thing private because you have to architecture a lot of the underlying system, you know, as we did in Zcash and then as others have emulated it with Tornado Cash and stuff like that, so that you use the zk-proofs in a way that gives you privacy. So, just slapping zk-proofs, let's say tomorrow, on Bitcoin or on Ethereum or on any L2 doesn't give you privacy. It may give you, as Shaul said, integrity and scalability, but not privacy. So, it's just like But it's okay. Like, you know, everyone's like—

Ali, I found a tweet from yours 4 years ago. You said ZK rollup is the term everyone's using. That's wrong. ZK rollup. I know. And actually—

Vitalik also tried to fight this. Yes.

I found, and then Shaul, you, a tweet from you a year later. You said ZK rollups are not zero knowledge. Can you explain this like I'm a 5-year-old to me so that I can understand it a little better?

Yeah. Yeah. I'll try. I have a 5-year-old. I'm not sure he would follow. But I'll— I feel like your 5-year-old probably gets this more than me, Shaul.

I'll try.

Well, actually, where is it? I do have the—

ZK for babies or something?

Zero-knowledge proof for 5-year-olds here. But so the fundamental thing about SNARKs, and I won't say ZK-SNARKs on purpose, and I feel kind of, I feel bad talking about SNARKs when Eli, you know, Eli is here, the guy who taught me about them. But Smart contracts are really about, I want to prove something very quickly about something that happened. So let's say, you know, I computed the validity of the whole blockchain and it took me hours and days and years to compute that. But hey, I want to send you some proof and you can verify that very quickly in milliseconds. A really nice property that you kind of get for free is the zero-knowledge aspect, which means, you know, I can also add some, private inputs that you don't know and prove claims about those private inputs. But that's, that's optional. And the thing with ZK rollups is that they're not using that optional thing. They're actually taking all of the chain that, all the data that exists in the public. And they're using that property of being able to, you can think about it as compressed computation. They're really just saying, hey, instead of all of the computers on the network trying to check the validity of all transactions, one computer is going to check the validity of all transactions and prove that very quickly to all other computers. So one does the heavy lifting and everyone else does the verification, but it's still doing it on completely public data. So the underlying technology, the zk-SNARK, knows how to receive private information and to do proofs about that. But that feature is not being used in zk-rollups. So people are kind of getting this feature that they're not even using as if they're doing something for privacy, with privacy.

Got it.

If I may, yeah, I want to give another, like, I agree with everything Shaul said. I just want to like, give you an example on Ethereum, like why you wouldn't get privacy. Okay. First of all, the ZK property means that, I mean, the proof is a string of bits. And the ZK property basically says that if you look at the strings of this string of bits, you learn nothing about it. It looks like whatever. It looks like noise. It looks like some garbage. The only thing you can do with it is sort of It tells you one thing only, that a certain statement is correct. Now, let's apply this. Let's say, so let's suppose that Jano, you're going to pay 1 ETH to Eric. In Ethereum, what does the transaction look like? Or what is the statement? The statement, let's suppose you have 10 ETH in your account and he has 10 ETH. So, the statement will say something, go to Jano's account, let's say it's 1234, subtract 1 from that. Go to Eric's account, let's say it's 5678, add 1 to that. That is, so the statement, and then there are signatures, you know, you actually own the funds, da da da. Okay, so now let's suppose I provided a proof for the integrity of this computation, that I saw your signature, you know, you actually have the funds. What is the statement I'm going to prove? The statement I'm going to prove is, hey, please subtract 1 from account 1234 and please add 1 to account 5678. This is what I'm submitting to Ethereum. Now, just by looking at this statement, both of your privacies have been sort of compromised because I understand now that like, oh, you know, whatever, this account paid that account.

So in order—

forget about the ZK part, right? Even if the proof doesn't reveal any information, which it doesn't, you didn't get any privacy. In order to get you guys to have privacy, first of all, we have to move to something like some sort of weird UTXO model, but it's even worse than a UTXO model because no two transactions can ever be connected. So, a large part of what we did with Zcash is invent this new model where there are things like commitment sets and nullifier sets that takes care of all of this stuff. So, that's why just having ZK— so, think about Optimism or Arbitrum. They're pretty much just the Ethereum blockchain, right? Now you add a ZK proof to that. The statements, the transactions are still revealing everything that's being done. So you get no privacy even if it has ZK.

Yeah, maybe this goes very to like a fundamental thing, which I think people don't realize, which again, ZK-SNARKs, FHE, MPC, all these fancy crypto names. They're methods to achieve consensus on private data. But the fundamental thing that any privacy blockchain needs is— and whether it's something like KANTON proof-of-authority-based or, you know, something that's zero-knowledge proof-based, it doesn't matter. The data itself is sent encrypted only to whoever is allowed to see it. And again, the difference is not in how they achieve privacy, it's how they achieve consensus when not all data is public. But it's still fundamentally the same that you need this data distribution mechanism and you need this way to model your smart contracts in a way that's privacy aware, that is aware of the fact that not everyone has all the data. And that's where it becomes really impossible to build it on. Because if you don't have that fundamental kind of beginning of, hey, I have a data model that is aware of the fact that not everyone has the same data and I have I have a data distribution mechanism, and this is like the software that passes the data encrypted that knows that each piece of data only has a very small strict subset of the network that sees that data, then it doesn't matter. No tool will help you add privacy on top of that. And then once you have that, then you can start arguing about the nuances of, hey, should you do it like Cantor with proof of authority? Should you do it like Zcash with zero-knowledge proofs? And the likes. But really, there are very, very, very few projects that are actually dealing with that problem of data distribution and having kind of this principle of least authority. Only a very small subset of network participants should see each piece of data. Yeah.

And then think about— they're talking about just at the network level right now, right? Everything they've been talking about is just completely contained at the core protocol itself. But now go to where Elly was talking earlier about the complements, the integrated services, the wallets, the oracles, the exchanges. They now all have to adopt that model and they have to understand what it means for them. So like an oversimplistic example, like we were talking about Solana before, how they built a community around fast and cheap. Oracles were not fast and cheap at that time. And then you had a whole ecosystem of people that built low-latency oracles to be able to support that. So you can't even bolt on the existing community because the feature is new. Forget the tech being new, right? There's nothing that exists around the concept of I'm a data oracle that has partial information about the network, or I'm an exchange that has partial visibility about collateral, or I am an ecosystem that has partial information about transfers. You don't have any of the tooling and the complements and the integrated assets. So even if I went to a deeply robust community, that already exists like Ethereum or Solana, they are starting from scratch around building those capabilities. So it's not just about the protocol adopting and it's about the community integrating it and expressing the feature in a way that makes sense and is accretive to the overall ecosystem. So it's even if, even if technologically you could bolt it on, it's no different than starting from scratch from your community perspective because they have to think about how to incorporate the feature into what they do.

Eric, can you— can we maybe shift into like customer conversations that you guys are having? And I'd even love to walk through like a sample, like a sample transaction or a sample. I don't know, like Citadel makes a trade that's fully private. I can't see that. But, you know, because it is TradFi, they do have to share that. Someone has to see that, right? There's like KYC, AML. There's— they have to send the trades to a compliance department like How do you balance the privacy with, you know, this is TradFi and there's still a lot of regulators, there's still compliance teams like, yeah, how did you guys think through that?

I think that it's easy to make this harder than it needs to be and it sounds really abstract and confusing, but it's actually the model we're accustomed to already today. So if you say, okay, the most successful public permissionless network is the internet, it's not Bitcoin or Ethereum, that we have this bigger case study in front of us. How does it work today? Well, just because I have a browser doesn't mean I get to see everybody's bank account at chase.com. Just because I have an account at Chase doesn't mean I get to see everyone else's bank information at chase.com. Chase knows everything about chase.com. They don't know anything about Bank of America. Right. So this sort of overlapping asymmetric view of the world is really what we're already accustomed to. That's really the way things have worked for a long, long time. And If you accept that that is a really well-functioning way of thinking about things, now you're saying, how do I add composability? How do I add interoperability? How do I add velocity to that structure, that market structure? And I think that too many of the conversations that are being had in crypto is the same sort of false dichotomy that we have with everything else, public versus private, permissionless versus permissioned. And here it's not that black and white. It's not everyone sees everything or everybody sees nothing, which is where too many of these arguments are going, especially as they pertain to ZK. It's much more, okay, what is the right combination of entities? Some must know, they need the ability to disclose, some must know a limited set of that. And then it's not just at rest, it's in transit. It's not just in transit, it's in composition. So how do I compose a treasury with a dollar or just swap two assets that have different visibility sets? How do I maintain privacy? You don't want your doctor to know how much money is in your bank account if you pay them, and you don't want your bank to know why you went to the doctor if they facilitate the payment. So it's just kind of accepting the reality of these complicated asymmetric views and then building the tooling and the protocol for it. And again, it's why it's a first principles thing. It's not something I can just kind of slap onto a fully replicated system.

Yeah, and the tooling then becomes easy, honestly. This is where if you've built that data distribution mechanism, if you want to say, hey, you know, this regulator, this auditor, this other entity needs to see something, it's really, really easy to go and add them once you have that kind of fundamental infrastructure in place already. Hmm.

Elie, one question I had for you is it seems like Canton is very much positioning themselves as kind of like the institutional chain. Got a lot of TradFi people investing. How do you think about almost Starkware's like your go-to-market and your customers and Who needs this outside of just— I mean, I'm sure you guys will go after the TradFi people too, but friendly competition here. But who else is your customer?

So our mission is to expand the Bitcoin economy and expand Bitcoin GDP. And if you think about people who have Bitcoin, so first of all, you know, 99% of Bitcoin right now is static. Less than 1% is being financialized. But it is the best form of collateral. And, um, I strongly believe that if you provide Bitcoiners with a financialization layer, an execution layer that is true to the Bitcoin standard, which really means you own your life, no one else does, right? So it has to be fully decentralized, and then it has to be, you know, safe, mature, have good UX, a whole bunch of things, you know, be dirt cheap, Then a lot of Bitcoiners will slowly realize that they can actually, you know, borrow against this supreme form of collateral in a safe way, generate yield on it, you know, invest, let's say, stablecoins that they borrow against it and whatever it is, and also support this growing economy that is true to Bitcoin's vision, which is decentralized. You know, everyone is invited to operate. Based on all of these beautiful principles so that you own your life. So that is Starknet's mission, right? To give Bitcoiners and the Bitcoin economy this opportunity. And this opportunity, I think, is immense. I have 100% conviction that a Bitcoin financialization layer will emerge, and it will be huge. There's a huge opportunity there once the right tools are given in DEX form to Bitcoiners. Now, we announced this very ambitious plan just like one month ago. There were like zero Bitcoin, close to zero Bitcoin at the time on top of Starknet. Now, I believe there's over 1,000 that came in over the past month, and the number is rising quickly with people who are basically generating yield, you know, borrowing against their Bitcoin and believing in this financialization layer. So our mission is to expand the Bitcoin economy in a way that is compatible with Bitcoin vision. I think TradFi will be interested in some of that at some point, and that's fine. But I don't see ourselves as like, you know, I have— okay, I'm the kind of— I'm like sort of a blockchain maxi in the sense that I think it's really great that we have a lot of different teams working a lot of different stuff. So I think Canton is great. I think Solana is great. I think Ethereum is great. All the L2s are great. You know, and I think that very few of the respectable teams I know are, you know, scammers or shitcoiners or whatnot. There are some of those, but like I have a lot of respect for everyone who's like, you know, dedicating their life to this stuff. We are going after expanding the Bitcoin economy. We are very much in the decentralized regime. Everything is so that you own your life. So, but, and I think TradFi may want some of that, and we're open to that as well, but we're not going directly after TradFi in a similar way that to what Canton is very successfully doing.

Yeah, if I could add to that, I think, you know, definitely Bitcoin is an asset class, and that's something that TradFi is interested in. You know, any asset class, that is something that their customers are interested in. I do think TradFi has, you know, TradFi has different requirements and different trust assumptions than you have in something like Bitcoin, where, you know, Bitcoin does not accept any type of authority, any type of institutional, you know, there's a political ideology behind Bitcoin maxis. which is complete separation between, you know, money and state, money and institutions. So you need different solutions for different problems. And that is a very different problem statement than, you know, from the one that TradFi are trying to solve, you know, when they're building, when they're building, frankly, services, you know, institutional services for others.

How do you guys think about the— we've talked about like a lot about the chain layer and like the actual network. How do you guys think about the application layer? And one, again, many dumb questions by me in this podcast. I'm curious if you can just go get Can you just go tell Uniswap and Hyperliquid and Aave, hey, deploy on my chain, which is— and now the transactions on Uniswap are private, or do you need to build these applications from start to be privacy first?

Yeah, I think lift and shift, there are things that definitely can lift and shift. They're more like the building block stuff. So the stablecoins, the asset classes themselves, the way that that works for the issuer. On Canton is very straightforward. So if you're Circle issuing USDC on Canton, USDC looks the same to you as it does on Ethereum. You see every account, every holding, every transfer. You know, for you, your life is the same. So that's a very straightforward process. And we have a number of assets rotating into the network to get that benefit. For the holder, they see what's happening in their wallet, in their transactions, and everybody else is not privy to that information. So you get that immediate benefit of being able to do private transfers and private, you know, basic transactions. And that's very much a near lift and shift sort of process. When you start to think about what does it mean to build an on-chain exchange, there you have some opportunities to make some new decisions. It's not straightforward that you would do it exactly the same way that you've done it before. Just like, again, to go back to the Solana example, they didn't just copy AMMs exactly the same as they were on ETH because they had features that afforded things to do much more clob-like activity. So coming to Canton, if you're running lending pools, trading, DEXs, perps, etc., it gives you the opportunity to think about what should be public information or what benefits from being public, what benefits from being private, how would I consider doing that? And you have a lot of opportunity to think about that. The more obvious thing to me when you start to think about the Perp DEXs or anything else that are trading-oriented being on Canton is that the really sensitive information is where people have their position from and what their leverage and their stop-out level is. So being able to protect the information about someone's collateral and the amount of risk on their account seems like an obvious, straightforward place to start. Hiding the orders may save you in some MEV scenarios, but also may not necessarily be the worst thing to keep public. So it kind of depends on how you want to think about the trust assumptions of the exchange. So we tend to focus more on what should you protect from the collateral perspective and what you have at risk from trading, not necessarily the trading, although you could mix and match and do whatever you want. But most importantly, you have a design decision to make.

So can I ask you about— there was Danny Ryan from Etherealize, because, you know, I bring up Etherealize because they're also going after this institutional market. And they said, Canton relies on honesty assumptions, trust that counterparties will delete sensitive data. That's smoke and mirrors privacy. I'd love to just give you the chance to— again, this is me not being smart enough to know what's wrong here. So you tell me, like, what's wrong with this statement?

Yeah, I mean, there's a bit of the bullshit asymmetry problem. I actually don't know what he meant. Like, there is no trusting in the honesty. And anyone who's looked at, you know, how Canton is built, would know that. So it's kind of hard to reply other than my reply, which was like, you don't understand how Canton works because there are no ICAs.

I asked people for some like some FUD on Canton and StarkWare going into this. And this is people, people send me, well, I think Etherealize said that they're smoke and mirrors. So that's really all I got.

I don't know. He may be a great guy. I just don't know what he meant because there is no Again, I'm trying to see. Yeah, there are no honesty assumptions. It is completely Byzantine fault tolerant, minimizes who has what data.

So my expectation, I mean, this is me reading between the lines again. I don't really know what they're saying, but there's this common conflation of privacy and anonymity. So if you're saying, well, you know, in my example I just gave before about, well, Circle knows what you did. Well, yes, we've actually designed specifically for that. Requirement. So it's not that Circle is going to delete your data after the fact and pretend like they don't know what you did with USDC. In fact, they're explicitly supposed to know what you've done with USDC. So I think maybe if you are— if your assumption is that privacy means anonymity, then I guess I understand what they're coming from. Like, I guess as a holder, you're relying on Circle to pretend they didn't see it. But that's just not what we're solving for at all. We're solving for that asymmetric view like we talked about before, where Circle knows everything going on with USDC at any given time. It's not about anonymity. It's more like Chase.com and the internet. So that, that maybe that's where that comes from, but I'm not sure.

That is a good point. I mean, in Canton applications, you typically assume that the, the service provider that is giving you some service is kind of similar to a Web2 service provider. They see the data that is, that pertains to the service that you're using. And again, that's not something we did not try to solve for, like, hey, I can move money in my Chase bank account without Chase seeing that. It's just not like, if we wanted to solve that, maybe we would add zero-knowledge proofs, maybe we would add something else. Again, the native distribution mechanism and everything is really built for that, but it's not a real problem. It's an imagined problem. So, or at least for our users, it's an imagined problem. Again, I don't know if that's what he meant, but, you know.

Yeah, fair enough. Guys, as we think about wrapping up, I want to paint a picture of the future a little bit. It feels like what happens in crypto is we move— things are slowly— what's the quote? Slowly, then suddenly and all at once or something like that. Right. And it does feel like that's how crypto progresses. And DeFi, nothing was happening. Nothing was happening. Nothing was happening. Boom. DeFi summer. DeFi is a thing like On-chain perps, nothing, a little bit, little bit, boom, hyper liquid. On-chain perps is a big thing. Feels like we're kind of on the precipice of that moment for privacy. How do you guys think, like, what is the big driver there? What is the thing that's going to make it go boom, basically, or make it go 10x or 100x? I'd love to just kind of start painting a vision of the future here.

Yeah, I would flip it. It's not the big moment for privacy. I think it's a big moment for real world assets. And the thing that unlocks that is privacy. So I do think we're going to see in the next few years a huge boom of real RWAs at the scale that we're used to seeing in the financial world coming on-chain. And the unlock for that is that you can actually now do consensus with privacy.

Elie, how do you think about that?

So as I said before, with blockchain, sort of the mimetic value capture often sort of comes first. Well, in this case, you know, as a Zcash co-founder, you can't say that the memetic value capture came first. It came after a very long time. And very surprisingly, like, I didn't expect this. I think many of my other Zcash co-founders didn't expect it.

But we're—

I'm very happy that sort of, you know, the collective mindshare now is actually going after or interested in something that actually is a very important basic human value related to human dignity and to true sovereignty of people and empowerment of individuals. So how will it play out? Well, there will be this memetic value capture and a lot of teams are going to add a whole bunch of privacy features and products to what they're offering. So as part of our, you know, mission to expand Bitcoin GDP. Of course, privacy, as I mentioned, especially for small and mid-sized companies, is start being— it starts being important. If you want to, you know, transact within this Bitcoin economy, you're going to need privacy. So we're going to add a whole bunch of privacy features. And of course, as a Zcash co-founder and Starkware CEO, I'm very happy that, you know, that finally I can justify and explain why we're working on privacy. I was waiting for a very long time for the markets to also appreciate it. So, okay, next, first comes the memetic value capture. Right now everyone's talking about it, which is great because it's really important. It's better than meme coins, more valuable, more important to society. A lot of teams are going to be adding meaningful features. I mean, you'll see some smoke and mirrors and some, you know, bullshit as usual and some claims that aren't founded by anything. But you will see like real serious work by serious teams. The true real unlock will be when there is decent UX that makes it easy enough to operate with it on things people, in this case probably more companies who care about crypto, are going to start using. And I would say that, you know, the direction we're heading with our privacy efforts are exactly towards that. We want things that small companies and people who are— who understand privacy, uh, individuals like retail and power users, um, and then small companies want to operate on crypto like my own company. You'll give them just the right kind of privacy with a good UX to do as much as they can. There will be some UX cost, like it's always easier to do things fully transparently, so there's going to be some trade-off or a bunch of different trade-offs and We plan to explore a lot of them. So I think the true next unlock for privacy is decent UX, privacy with decent UX. That's the big thing.

I don't know, I'm a little bit, I'll talk my own book a little bit more. I think it's very, very similar to what took place with Solana 5 or 6 years ago. It's a topic that everyone has spoken about, but very few had the gumption to show up and be sufficiently different to achieve. And having rails that actually deliver on the thing that people want at scale, reliably and safely means that— I'm not a big like build it and they will come sort of person, but we saw that that really played out for them. There was a lot of demand for a feature that a lot of people like to push off and say, no, that's a futuristic problem. We have enough block space today. And it just really shaped the way people thought about what they were going to do on-chain. Combined with what Charles said before, there is a big, big wave of institutional demand to use these systems and they are very aware of how important this data permissioning is to them. There are a lot of people talking about, you know, trillions of dollars of TVL of stablecoins coming for things like international remittances and FX markets and payroll. And I always say, yeah, absolutely, it is going to happen, but there's only one place eligible for it to happen at scale. So you're right, it's coming, but you guys, you know, generally speaking, these other ecosystems don't have the features necessary to really adopt it. And you're taking so much existential risk to use ZK and FHE for RWAs today. It's well worth it when you're talking about the crypto ideals that Elly was talking about before, it's worth the risk. But if you're a stablecoin issuer, The types of risks that you're taking in the tech, I think, are very, very hard to justify and explain to your regulators, to your investors, to your holders. So it really is about making it possible to actually deliver this feature at scale is one of the big unlocks.

Yeah, guys, that's all the time we have. Eli, Shoal, Eric, I appreciate you guys. Thanks everyone for listening. Episode 4. Hope you guys enjoyed it. We have Episode 5 coming out soon. Thanks, everybody.

Thank you.

Thank you.

Thank you.