Secure & Secret: Advancing Bitcoin Privacy as the Default

All right, everyone. Welcome. Thanks for joining us. I'm Satsie. I work on the Bitcoin Dev Project, and today we're going to be talking about the level of privacy that Bitcoin users currently have in the tools that they use, whether it's good or not, and how to make it better. If I could please have my panelists introduce themselves, starting with Seth.

​

Yeah, for sure. I'm Seth for Privacy, Chief Operating Officer of Cake Wallet. We're building Bitcoin privacy tools all the time: silent payments, Payjoin integrated, Bitcoin Lightning as well. I've been researching this stuff for a really long time. Excited.

​

I'm Fabian. I'm an open source developer. I'm funded by Brink, and I work on Bitcoin Core a lot of my time, but I also spend time researching privacy-related topics, in particular CISA, cross-input signature aggregation.

​

I'm Spacebear. I work on Payjoin, transaction batching protocol, and with the Payjoin Foundation.

​

Awesome. Let's start with: what is the current state of privacy for your average Bitcoin user? What do we get by default, and what do we not get by default?

​

I think the unfortunate thing is it's normally quite poor for the average Bitcoin user. Thankfully, the idea that we have anonymity in Bitcoin and that it's a useful privacy tool by default is gone. We all understand that's not true anymore, pretty much. But usually, at best, users just have fragile pseudonymity, where if they're buying their coins no-KYC, their identity isn't attached to the things they do on Bitcoin.

​

Most users are buying their Bitcoin on Coinbase, Kraken, you name it. So their identity is connected to their on-chain activity, and then they're not using any privacy tools. That exchange, and anyone who hacks that exchange, then knows everything that they do on Bitcoin from that point forward, which is not good.

​

I think the most positive thing I can say is that the privacy of a sender in Lightning is okay-ish, at least assuming you don't use a custodial solution to use Lightning. But otherwise, there are a ton of pitfalls even just for the self-sovereign people. It all requires education. It usually requires using tools that are more power user-oriented to actually get it right. So going toward privacy by default seems like a long way to go.

​

I would agree. The tools are out there. It's possible to use Bitcoin privately if you're motivated and you put in a lot of thought and effort, but the default situation is pretty bad.

​

Well, there is some good, though. Seth, you work on Cake Wallet, and it's really a wallet that's at the forefront of integrating some privacy technologies. What does Cake support right now? And are there any technologies that you're really excited about integrating in the future?

​

Right now, our primary focus has been: how do we bring actually practically usable privacy to on-chain Bitcoin? Lightning is a whole other can of worms, as Fabian mentioned, but on-chain, that looks like silent payments, which is basically a reusable stealth address. You can give out the same address. It looks longer than a Bitcoin address normally would, and anyone who pays you actually creates the address for you that you're going to receive funds to.

​

On-chain, it just looks like a regular Bitcoin payment to a Taproot address. Nothing special. No one can know it's to a silent payment address, much less to a specific silent payment. We launched that a couple years ago now, so that was quite a while back.

​

Then Payjoin V2, which we worked really closely on with the Payjoin Foundation. They've done fantastic work. That's where you actually work with the person you're paying, you both contribute inputs, and it helps to hide the sender, the receiver, and the amount in that transaction, or at least obfuscate them.

​

So that's been our focus. There is clear demand for privacy tools in Bitcoin. Everyone wants financial privacy, but for way too long it's felt like even if you want financial privacy, actually achieving it on Bitcoin is just not practical. We're trying to change that.

​

Nice. You mentioned Payjoin V2. I want to ask you, Spacebear, what's the state of adoption for Payjoin V2, and has this recent wave of vibe coding impacted how you approach integrations?

​

The current state is that we have two mobile wallets that actively implement Payjoin. There's Cake Wallet and there's Bull Bitcoin Mobile. We shipped those early last year and then used that to inform what we needed to do with the API to make it easier and cleaner for facilitating more integrations. Now there are quite a few integrations in flight and just in the home stretch to actually go live.

​

To your vibe coding point, I think it's immensely helpful. For example, if you're working in a foreign code base, it traditionally takes a very long time to go in and understand how everything works and how everything links. With an LLM, that can be done in 30 minutes. You have a pretty good idea of how the code maps.

​

It's also useful because we have all these language bindings for different languages that we need to target. Having an LLM port tests over between languages is something it's very good at. We're not yet at the stage where you can just say, implement Payjoin in my wallet, make no mistakes, and not have to worry about it, but that's definitely the goal.

​

I think it really paid off that we have the PDK model, where all the internal logic and privacy and security stuff is handled in a well-reviewed, audited library, and then the LLM or some dev can just implement that. I think that's really going to pay off in the age of AI.

​

Fabian, you mostly spend your time on cross-input signature aggregation, also known as CISA, and you were recently on Plan B's Cipher Tank, where a proposal was made for something called PISA, which is Payjoin plus CISA. Can you describe how that would work and how that would impact privacy by default, specifically around the user experience?

​

Specifically, the user experience shouldn't change at all. It should just cleanly integrate. This is really the goal of the default, right? Users ideally shouldn't even notice that their experience becomes more private. It should be as simple as possible while also being private.

​

This PISA project is basically the joining of CISA plus Payjoin. This was not just my own pitch. Dan from the Payjoin Foundation was there together with me. The idea is that we do a proof-of-concept implementation end to end that uses CISA together with Payjoin to make privacy-preserving transactions that are also a lot cheaper than using Bitcoin in the normal way and creating standard transactions.

​

To recap that briefly, CISA allows you to aggregate signatures within one transaction. That means if you have a transaction that is larger and has a lot of inputs, like a Payjoin transaction would typically be, then you can save a lot of space. Space on the blockchain also means you save a lot of fees. This way you can have more privacy while saving money at the same time.

​

This effort is ongoing. One downside of CISA is that it's a soft fork, first of all, that has to be done, and it also requires interactivity between the participants. Getting the soft fork done is a more long-term project, but we want to have the proof of concept to actually give the soft fork a chance of coming in the future.

​

Since Payjoin itself is an interactive protocol, hopefully the thing we will achieve is to show that the CISA interactivity can basically be done together with the Payjoin interactivity. That way, to what you asked initially, the experience will be exactly the same for the users.

​

That's awesome to hear. Bitcoin privacy can feel like an arms race at times, where you're trying to get ahead of whatever Chainalysis has recently come out with. Spacebear touched on how LLMs are helping privacy developers, but I wonder if that same technology has allowed for more advancements in the people who are actively working to deanonymize Bitcoin users. Do any of you have insight into how that works or what the status is?

​

I would actually push back a little bit on what you said. To me, it doesn't really feel like an arms race because we don't even know what they come out with. We have no insight into what they are developing and what their secret sauce is. That's what makes it really hard to actually even engage with the problem.

​

We saw in these privacy-related legal affairs that happened recently that Chainalysis or related companies were being used for data, and they basically just presented results. Those results were kind of taken for granted. It's almost impossible to challenge that when the court believes that this is correct, but you don't actually know what's going on, and they use their intellectual property as protection against disclosing what their algorithms are like.

​

I think that's something very interesting. We've seen a tool called Dakar, which is basically open source chain analysis software. There are probably other projects going in the same direction. On the surface, it seems like something we don't want. We don't want chain analysis to be out there for everyone to use. But actually, we do want it because we want to know what the heuristics are and how reliable they are. You can try to exploit them, and then from our side, break them again.

​

I think something to add on to that is that the lack of visibility we have into how Chainalysis, et cetera, actually work is especially terrifying with AI. If you've done a lot of work with AI or used it a lot, something that it's exceptionally gifted at is bullshitting you. AI is fantastically talented at making you think that what it's telling you is what you want to hear. It really just wants to hear you say, that's what I wanted.

​

When you're talking about your little vibe coding project, it's a problem, but that's not putting someone's life in danger. When we're talking about whether this guy will go to jail or not for having done this crime, and the only link we have is maybe some on-chain activity, and they go, hey ChatGPT, here's our data, tell me if this guy was the criminal, and they can just show the output and not show how they got the result, people could literally go to jail because an AI is bullshitting the operators at Chainalysis.

​

That is the terrifying part to me. Whether or not they're using it to build additional heuristics or anything like that is kind of an aside. I'm sure they're using it. Everyone is using AI at this point in some way. But the fact that they can use those findings in court and not have to show their sources or show how they got there is worrying. That needs to be pushed back on, and we need to be talking about it a lot and yelling at people a lot about it, because that has to change.

​

We tend to assume that these companies have super advanced on-chain capabilities and that that's what they rely on. But in truth, they have a lot of other tools that they rely on. KYC exchanges basically tell them exactly how many coins, your full name, your address, and all that. We don't actually know if they consider privacy technologies like Payjoin very much in their chain analysis.

​

That being said, I think it's still useful for us to build open source chain analysis tools, so we can actually have an idea of whether Payjoin works and measure the privacy gains of these technologies. That's a place where I think LLMs can be very useful.

​

One example is wallet fingerprinting. There has been some work in the past on wallet fingerprints, and it was manual, where you compare all these wallets and compare the code. That was six years ago, and no one's really done more research on that. With LLMs, I see a world where you could have a wallet fingerprints dashboard. Because all these wallets are open source, you could have LLMs constantly scouring for specific fingerprints and then kind of naming and shaming.

​

It is a hard problem because some wallet fingerprints are not necessarily bugs. There are some features you might want to offer that just inherently leave a fingerprint. But it's at least a step forward that we could take and start actually measuring.

​

For sure. I did see that Payjoin recently came out with some analysis on those fingerprints, and it's very helpful to see. Fabian, I want to follow up with you on Dakar. Is it unusual that that's an open source chain analysis tool? I guess that's not normal.

​

I think there was some visualization stuff in the past, but that shut down. Aside from the fact that, on the surface level, it doesn't look like something we would want to have, open source developers are time constrained anyway. We're lacking resources left and right. Motivating yourself to do something that is kind of an adversarial software project is maybe something people had a hard time with.

​

Becoming much more productive through AI can help get over the hurdle and have people consider doing such a project, working on it, and maintaining it over a long period of time, which apparently wasn't the case so far.

​

Interesting. I really want to dive into this next question. Are there any other projects that really excite you about the future of Bitcoin privacy, whether projects that are just starting or are pretty close to implementation? Conversely, is there anything you were excited about and, upon further investigation, were less enthused?

​

I'll jump into the second one first, honestly, because it kind of answers both questions. We've had this Renaissance, slightly, in new layer twos on Bitcoin, specifically Ark and Spark. Both had a lot of promise in terms of privacy. When Ark was first announced by Burak three years ago now, he introduced it as a scaling and privacy tool. The goal was that it would solve for both at the same time and be an extremely useful tool for privacy.

​

In reality, we didn't get that. We did get the scaling side. We did get some of the functionality for payments, but Ark doesn't provide any user privacy right now. Essentially, the Ark operator knows everything about your transactions and can choose whether or not they publish that. We'll see what they choose to do.

​

Spark, very similarly: we had a state chain solution called Mercury Layer over the years. They were a blinded state chain solution, so they couldn't see anything about the transactions that they signed, but they could know that they were legitimate transactions. They could sign them, but they didn't have to actually know anything about the users within the state chain, which was great.

​

Spark is built on very similar state chain technology and could do blind signing. As someone who implements Spark and uses it and recommends it, it's still very frustrating to me that they don't have blind signing today and that they do know the data about what their users do on-chain. Obviously, they don't have any connection to KYC. They're not an on-ramp or anything, so they don't know who you are necessarily, but they have visibility into your transactions.

​

Both showed a lot of promise, and they still could become very good privacy tools. Both have a very clear path to becoming very good privacy tools, but we'll see if that actually pans out.

​

I'm pretty excited about Shielded CSV. There was already a session on it yesterday, so if you want the full details, I would recommend watching that. In a very brief summary, it's basically a way to off-chain accumulate the transfers of transactions and then put what's called a nullifier on-chain.

​

The idea is that instead of everyone validating the chain of transactions, only the person who receives the transaction would validate the history of the coin they've received. They would check on-chain that this is correctly attested for with a nullifier, but otherwise this is just something between the sender and the receiver. That is obviously a lot more private than having the full transaction history and the full graph on-chain.

​

This is a topic that is being worked on quite actively. I can't really say when exactly it will be ready because I'm not part of that project, but it's a very exciting concept. I think it has a very high potential of pushing the boundaries of making privacy much more attainable for the average user.

​

Shielded CSV is really cool because you can basically bridge Bitcoin into Zcash-level privacy, but with better scaling. It's still conceptual, like you mentioned. It's not actually something you can use today, but it is very promising in terms of what privacy can be achieved, with really good scaling at the same time.

​

At the end of the day, if we want to make more privacy the default, I think it's more a UX challenge than which specific technology it's going to end up being. If a user has to choose between Ark, ecash, Shielded CSV, or Lightning, then we're not talking about the default experience. They should be able to go into the wallet, start receiving and paying in a way that's private. They don't need to know about address reuse. They don't need to know about UTXO management. So I think it's a UX challenge, and there's a lot of work ahead of us.

​

I do want to dig into that. There's only so much you can do from a technical perspective, and there is a lot of friction. Do you think part of the UX challenge is because people need to be knowledgeable about what they're doing? Or is there something we can do where you actually don't need to know that much and you get a lot of privacy?

​

One example from the internet is HTTP. It was not private at all, and HTTPS came out, and now everyone uses HTTPS. Can the average person explain the difference? Probably not. They don't know why. They probably don't even know they are using HTTPS, but it's just a default thing that everyone now uses, and browsers actually enforced that better, more private experience.

​

I think that's the path: to have standards like that, whether it's Payjoin, CISA, or any of these L2 proposals, where wallets can come to a standard and the default path is to use these private, cheaper, more scalable methods of transacting.

​

The hard part is that, as a wallet company, we can't just roll our own privacy solution and call it a day, because then we're limiting not only the anonymity set of the privacy tool itself to our users, but we're also not actually helping Bitcoin become more private. I don't want you to have to use Cake Wallet to gain privacy. Would that be good for Cake Wallet as a company? Sure. But it wouldn't be good for Bitcoin as a whole or for people's individual freedom, because not everyone will be a Cake Wallet user.

​

The goal really should be that, like you said, we coalesce on standards, something like Payjoin. We figure out how to make it really easy to implement, which I think has already been done, and then wallet devs just do it.

​

It is always tricky because you need the tools to be good enough for you to actually build good UX on top of them. Lightning, for instance, the old way to do self-custodial Lightning was running a channel, running a node, managing liquidity. There was only so much UX paint you could put on top of that to make it something people can actually do.

​

But I think Payjoin is a really good example where it's good enough today. It should be the default in every wallet. It is in Cake Wallet, and it's frustrating that other wallets are not pushing as hard on that. They really need to. That's a combined failure. If you're a wallet dev, go implement Payjoin. Go do it.

​

You don't need a soft fork. You don't need any change to Bitcoin. You can just do it today. Immediately you have compatibility with Cake Wallet and Bull Bitcoin, and with others as more come online.

​

If you're just a user and you don't use something like Cake Wallet that provides these tools, go talk to the wallet company. Go talk to the devs. Say, hey, there's this really cool privacy tool. I know it works today. I want to see this implemented. They can and should do it. Oftentimes companies will just do whatever the demands from their users are. Now that you know about privacy tools like Payjoin, go harass your local dev and force them to implement it so that you can actually have good privacy in your favorite wallet as well.

​

That's awesome. I love hearing that. Builders usually listen to their users, so definitely communicate that. We have a couple minutes to close it out. Do you have any privacy tips, not even Bitcoin-specific, that the audience can walk away with from this panel?

​

Throw out your laptop.

​

Throw out your laptop?

​

Yeah. Burn it. Go live in the woods. That will solve a lot of problems, for sure. Computers were a mistake.

​

There are so many different angles you could take there. I think the simplest one with Bitcoin, and the one that you've probably heard about before but maybe felt is too daunting to do, is just stop buying Bitcoin on KYC exchanges. Stop connecting your ID to what you do on-chain.

​

Even if you do nothing else, even if you don't use Payjoin, silent payments, whatever, but you just get your Bitcoin from Bisq, RoboSats, Hodl Hodl, or any of the good peer-to-peer places to get it, you'll have drastically better privacy than the vast majority of Bitcoiners. That's the starting place for a lot of people. It feels a little daunting at first, but once you actually try it and buy some, it's really straightforward. It's not that complex, and it's an absolutely vital first step for privacy.

​

Don't do what I did and be here with your full name. Rather use a nym.

​

Spacebear, you didn't come here with your full name. You got any tips?

​

I showed my face, though. I have to do the Shinobi thing.

​

One thing I can add is maybe to share some paranoia. I've seen a lot of podcasts that I'm invited to. They try to be on YouTube, of course, and they try to record your face. I'm just not a big fan of that. I listen to podcasts only in audio, so I don't really see why anybody wants to look at my face for an hour while I just talk.

​

I usually refuse to get that recorded because I think it's great training data for AI to generate a face of me that then calls my grandmother and tells her that she needs to transfer all her Bitcoin somewhere. So that's my paranoia tip.

​

The phishing attacks are getting a lot more sophisticated, so stay safe out there. We're just about at time. Any final words?

​

The tools are actually getting there. It's time that we actually build around those, that we build good UX, and that people actually achieve the privacy they want. This time of saying nobody wants privacy, or I have nothing to hide, is simply not reality anymore. It's exciting that we're kind of in the cypherpunk future, and people just need to take advantage of the tools.

​

Implement Payjoin, and then let CISA follow. Privacy cheaper than the alternative. That would be my way forward here.

​

Nice. Well, thanks, everyone. Thank you.