The news is out! Couldn't be more excited to announce that I'm back in the ring as a builder. Coming on as a co-founder to @0xMiden with our $25M seed fundraise being co-led by @a16zcrypto , @1kxnetwork , and @hack_vc .
I spoke to what must have been over a 100 projects in the past few months, but nothing came close to being nearly as exciting as what this team is building.
My co-founder @bobbinth is genuinely the most impressive person I've met in Web3 in the 13 years I've spent in this space. And this is no exaggeration. Brilliant, humble, and hustles like no other.
Vitalik brought him into Web3 and got him working at the EF years ago on zk, then he went to Meta where he led the zk team, and is a Polygon cofounder as well. When I say the most impressive, I mean it.
Privacy, scalability, and decentralization, with the ability to offer compliance. That's what separates Miden from just another blockchain. And we're going to be bringing institutions on chain with this.
If you're a builder in this space, I'd love to hear from you. My DMs are open.
RT @LxKus: Privacy you don’t have to ask for.
@0xMiden’s partner mainnet is live, and I tested it on @joinbread on day one with real money. Every payment is private by default. No settings, no extra steps. Thanks to @azeemk for the invite.
My first look at private payments ↓
RT @arlery: While a lot of teams try to target "institutional" clients, learning how to behave professionally should be part of required learning by teams especially as they try to act grown up.
Recently had a terrible interaction with a team where we're a paying user, and yet their marketing exec was super passive aggressive and unprofessional. It's okay to not want to collaborate on things, but to talk down to paying customers in a rude way was not something I was expecting.
If you run an org in this industry, especially with paying customers, teach your teams that they are a representation of the org. And, maybe invest in customer experience as part of leveling up orgs. The bar is literally in hell lol.
Dressing up and hosting events every conference isn't what counts as "institutional".
How you actually work, who you work with, and grow your revenue is...
RT @0xEpochProtocol: First on @0xMiden 👀
Epoch is building the intent based action bridge to Miden from day one.
→ Bridge: Ethereum and other chains to Miden via Epoch
→ Earn: deposit once, we manage your lending vault positions, including on EVM chains.
Practical privacy now has a live network, and we’re one of the first teams on it.
RT @ConcreteXYZ: @0xMiden Partner Mainnet is live.
Proud to be among the first teams. @ConcreteXYZ is bringing institutional-grade vault infrastructure to Miden.
Excited for what we're building together and what comes next for privacy-preserving on-chain finance.
The Predicate team with @pumpernikhil@khushii_w and so on are one of the best teams I’ve had the pleasure of doing business with in this industry.
Couldn’t be happier or less surprised to hear the best investors in the space see it makes sense to invest in them.
Excited to see what we cook up together with Miden and overall what they end up doing too.
Share
Copied
Predicate@0xPredicate
We are thrilled to announce our $8M Series A to connect regulated markets to onchain finance.
Predicate enables digital assets to reach every market compliantly. We do this by embedding compliance controls directly into digital assets to block high-risk and sanctioned activity at every transaction.
To date, Predicate has:
- Screened $1B+ in transaction volume
- Evaluated 6M+ transactions against custom compliance policies
- Blocked 100K+ non-compliant transactions
The round was led by @bcap with participation from @Paxos, @1kxnetwork and @tribecap.
We are thrilled to announce our $8M Series A to connect regulated markets to onchain finance.
Predicate enables digital assets to reach every market compliantly. We do this by embedding compliance controls directly into digital assets to block high-risk and sanctioned activity at every transaction.
To date, Predicate has:
- Screened $1B+ in transaction volume
- Evaluated 6M+ transactions against custom compliance policies
- Blocked 100K+ non-compliant transactions
The round was led by @bcap with participation from @Paxos, @1kxnetwork and @tribecap.
Miden's partner mainnet is now live!!
Privacy has become one of the biggest conversations in tech, especially in crypto. But something that doesn't get discussed nearly enough is just how difficult it is to actually build and launch something that works.
For years, this industry has struggled with poor UI, bad UX, and products that are simply too complicated for everyday users. Adding privacy to the equation makes that challenge even harder.
That's a big part of why I'm so excited about what we're building at Miden. We believe people shouldn't have to choose between privacy, self-custody, and a great user experience.
Today is a major step toward making that a reality.
We're intentionally limiting access during this initial phase and will gradually open things up over time. But if we've spoken about Miden or Bread Wallet before, please reach out for an access code.
I'd genuinely love to hear what you think. There's still plenty of work ahead of us, and getting real feedback from real users is what makes this next chapter so exciting.
RT @imyoungsparks: This is one of the most interesting takes I’ve seen not only on the consumer crypto front, but also agentic commerce.
This is even more nuanced than the stablecoins vs scoped cards discussion. @azeemk and Miden are asking the questions that matter 🔥
RT @QuantusNetwork: Keep it secret. Keep it safe.
@azeemk and @SebastienGllmt on why privacy has shifted from a fringe idea to an institutional requirement, and what it takes to build private systems for a post-quantum world.
Here’s their full conversation from Quantum & Privacy Day.
RT @arlery: We celebrated @davidzmorris's new documentary on @rstormsf's trial this week. Can't wait for you all to hear David's docu/podcast series in a few months. It's incredible to see the outcome, after his participation in our @OctantApp Epoch 9 last year.
Loved seeing so many friends from media at the event, and especially non-crypto media show up. This trial needs visibility and a lot more attention. Roman will go to trial in April again. Writing code is not a crime. Wanting privacy should not be a crime.
Share
Copied
mashal@arlery
I felt quite emotional when @julianzawist confirmed @GolemFoundation would contribute 50 ETH towards Roman Storm's defense two weeks ago.
I'm a cybersecurity graduate. I've studied tech and cybersecurity policies and used to regularly review them too. They suck. Tech laws are so fckn outdated. They are nowhere near close to keeping up with new tech and any innovations in tech either. When the Aaron Swartz trial was happening, it shook me so much. It's still a case I remember and feel sad about. Esp when I see AI companies using and abusing shit he was prosecuted and punished for all those years back.
This trial means a lot. The implications after this ruling will affect ALL of us. Devs or not. It will change what's okay to build. We shouldn't have to compromise on innovation just because law and policy makers can't keep up. Writing code should not be a crime. Writing open-source code should not be a crime. Contributing and donating or investing to open-source should NOT be a crime ffs.
Please consider contributing to @rstormsf's case. Every bit counts. He still needs $1.5M.
I felt quite emotional when @julianzawist confirmed @GolemFoundation would contribute 50 ETH towards Roman Storm's defense two weeks ago.
I'm a cybersecurity graduate. I've studied tech and cybersecurity policies and used to regularly review them too. They suck. Tech laws are so fckn outdated. They are nowhere near close to keeping up with new tech and any innovations in tech either. When the Aaron Swartz trial was happening, it shook me so much. It's still a case I remember and feel sad about. Esp when I see AI companies using and abusing shit he was prosecuted and punished for all those years back.
This trial means a lot. The implications after this ruling will affect ALL of us. Devs or not. It will change what's okay to build. We shouldn't have to compromise on innovation just because law and policy makers can't keep up. Writing code should not be a crime. Writing open-source code should not be a crime. Contributing and donating or investing to open-source should NOT be a crime ffs.
Please consider contributing to @rstormsf's case. Every bit counts. He still needs $1.5M.
RT @USC_VEDA: Session III at last week's Regulatory PETshop II went looking for the places where privacy breaks down in agentic commerce, and what privacy infrastructure is needed to hold it together as agents start to transact on our behalf.
Our lead discussants Yaya Jata Fanusie @SignCurve (@AleoHQ ) and Cody Wood (@worldnetwork ) opened the conversation, and Cody brought a live demo to the room: the World Orb, the iris-scanning device built by Tools for Humanity. The Orb verifies that a person is a unique human and issues a World ID that lives on the person's phone, with the aim of proving "human" without revealing who someone is. It made the privacy-versus-proof-of-personhood tradeoffs very tangible for everyone in the room.
They were joined by Azeem Khan @azeemk (@0xMiden ), Caroline Hill (@circle / Arc), and @JayCStanley (@ACLU ) bringing perspectives from blockchain privacy technology, stablecoin and payments infrastructure, and civil liberties.
Huge thanks to DC Fintech Week and The Fintech Foundation (@fintechthinksdc) for partnering with us, and to our sponsors NEAR (@NEARProtocol), SVRN (@svrn_ai) and Openreserve (@openreservebank) for making Regulatory PETshop II possible.
For event details:
RT @bobbinth: I agree with Justin that protocol agility is critical. One way to get there is to make the core protocol depend on as few assumptions as possible. The rest can go off-chain where upgrades can be performed much more easily.
For Miden specifically, we've designed the core protocol to depend only on hashes and STARKs (with fixed-depth recursion). This doesn't mean we don't use elliptic curves or lattices - we do, and in fact Falcon is one of the signature schemes that we support out of the box. But the core protocol does not depend on these. These are used in the auxiliary off-chain services.
This setup allows us to use the most convenient primitives now, and switch over to other primitives when/if the times comes. For example, for deriving shared secretes for private note distribution we can use ECDH now, and switch to lattice-based alternatives later, without having to upgrade the core protocol.
Share
Copied
Justin Thaler@SuccinctJT
A few reflections on the lattice vs. hash-only debate that our recent Aerie post sparked:
1. Cryptographic ossification for blockchains was never safe. Until the day we know with certainty that P ≠ NP, that finding short vectors in lattices is intractable, that Keccak effectively behaves like a random oracle in deployed SNARKs, and that every single bug has been eliminated from our codebases, blockchains cannot ossify. That is simply not how safe systems are built. Issues will arise, and the system will have to respond.
It’s a double standard to reject lattices because blockchains are hard to upgrade if lattices break, while counting on upgrades if AI breaks your hash function or finds a critical zkVM bug.
The best counterargument is that hash-only designs are more agile: if your hash function breaks, just swap out the hash. But we must aspire to a higher level of agility than this. Indeed, as I cover next, if SNARK recursion itself turns out to degrade security, the proposed hash-only blockchain designs would need to be rethought from the ground up.
2. The real security debate is not lattices vs. hashes — it is lattices vs. building everything on SNARK recursion. That’s because “hash-only” is not really hash-only: it rests on hashes plus the soundness of deep SNARK recursion. Ethereum’s roadmap relies on exactly that: hash-based aggregation needs recursion to keep up with a slot’s worth of signatures, and EIP-8288 would send other signature schemes and users’ own proofs through the same recursive pipeline. In contrast, Aerie proves a slot’s worth of signatures on one laptop without any recursion.
All deployed post-quantum SNARKs rely on the Random Oracle Methodology (via Fiat–Shamir) to establish their security. This is an idealization we know fails in the real world: we have explicit counterexamples where “SNARKs” coming out of this methodology are totally insecure when instantiated with any concrete hash function.
We generally ignore these counterexamples in part because they only arise when proving contrived, self-referential statements about the very hash function used by the SNARK verifier.
But proving statements about the verifier’s own hash function is the exact thing you do in SNARK recursion. That’s why the security of recursive SNARKs can’t be established even in the random oracle model.
On top of that, the standard security proofs for recursion (in other models) suffer an “extractor runtime” blowup that is exponential in the recursion depth, suggesting that security may degrade as more recursion is applied. Yet Ethereum’s own EIP-8288 enables unlimited-depth recursion, even as it lists soundness of recursive SNARKs as a trust assumption. Proofs in more idealized models avoid the blowup, but they mainly tell us that an attack on SNARK recursion would have to exploit the concrete hash function, which is exactly what the Fiat–Shamir attacks above do.
To be clear, we don’t know of any outright attacks on SNARK recursion, and I very much hope it is secure. But some of us who have studied the question have a lingering sense that an attack may be possible in some settings. And if AI is going to supercharge cryptanalysis, there is no reason to expect it to spare Fiat–Shamir for SNARKs, let alone SNARK recursion, both of which have had far less scrutiny than lattices.
So, I do not concede that a “recursion everywhere” hash-only approach is clearly more conservative than one built on standard lattice assumptions.
3. “Just wrap everything in a hash-based SNARK” (like EIP-8288) faces challenges.
Aggregating signatures and proofs off-chain into a single block-level proof is a powerful design independent of the hash-only vs. lattice debate, and I am not telling people to avoid it. But claiming, as Vitalik Buterin did this week, that users can run whatever cryptography they want locally and wrap it in a client-side leanVM proof glosses over major hurdles.
For example, leanVM today is a minimal VM designed almost entirely to prove hash-based signatures and recursion, not general-purpose computation. And binary-field SNARKs like leanVM remain slow at proving the integer multiplications that lattice cryptography does en masse.
I am optimistic that many of these zkVM challenges can be met (including via my own work, binary-field Twist and Shout, which are now implemented in Magnetar). But regardless, if lattices can make aggregation simpler and faster, then they should be leveraged. We need to be agile no matter what.
4. For chains whose reason for existence is privacy, I truly struggle to understand the pushback. Public-key encryption (and fast single-server PIR) cannot be built from hashes alone, at least not in any black-box way. If lattices break, it is going to be very, very hard for these chains to provide acceptable levels of privacy and functionality. For a project whose entire reason for existence is privacy, a loss of confidentiality is an existential failure. Next to that, a second signature upgrade (after the first one, from elliptic curves alone to, hopefully, a hybrid lattice scheme) is easy.
Summary: We don’t know for sure what is secure and what isn’t. We are all weighing unquantifiable risks against each other, and we do not need to agree on a total order on them. But hash-only solutions face many open engineering challenges, and they are not more “conservative” in the way some have argued. Some of those challenges are entirely prosaic and have nothing to do with bugs or cryptography, like hardware support for custom schemes whose hash function is still undecided. I hope we can overcome those challenges within the appropriate timelines, but they must be acknowledged and portrayed realistically.
Overall, cryptographic agility and defense in depth (e.g., hybrid signatures) are the answer, which is why we are building both lattice-Jolt and hash-Jolt. In practice, the positions are less polarized than social media discourse suggests: for example, StarkWare is working to make Falcon verification cheap ( which is great to see.
Here is the (apparently) controversial take I am sticking to: Conditioned on agility, whenever lattices make systems simpler or more functional, we should embrace them rather than default to “hash-only” designs. Lattices are what the rest of the world will depend on, with decades of study and hardening behind them, and at the system level, less functional often means less secure. Where hash-only designs are just as simple and functional, by all means use them.
A few reflections on the lattice vs. hash-only debate that our recent Aerie post sparked:
1. Cryptographic ossification for blockchains was never safe. Until the day we know with certainty that P ≠ NP, that finding short vectors in lattices is intractable, that Keccak effectively behaves like a random oracle in deployed SNARKs, and that every single bug has been eliminated from our codebases, blockchains cannot ossify. That is simply not how safe systems are built. Issues will arise, and the system will have to respond.
It’s a double standard to reject lattices because blockchains are hard to upgrade if lattices break, while counting on upgrades if AI breaks your hash function or finds a critical zkVM bug.
The best counterargument is that hash-only designs are more agile: if your hash function breaks, just swap out the hash. But we must aspire to a higher level of agility than this. Indeed, as I cover next, if SNARK recursion itself turns out to degrade security, the proposed hash-only blockchain designs would need to be rethought from the ground up.
2. The real security debate is not lattices vs. hashes — it is lattices vs. building everything on SNARK recursion. That’s because “hash-only” is not really hash-only: it rests on hashes plus the soundness of deep SNARK recursion. Ethereum’s roadmap relies on exactly that: hash-based aggregation needs recursion to keep up with a slot’s worth of signatures, and EIP-8288 would send other signature schemes and users’ own proofs through the same recursive pipeline. In contrast, Aerie proves a slot’s worth of signatures on one laptop without any recursion.
All deployed post-quantum SNARKs rely on the Random Oracle Methodology (via Fiat–Shamir) to establish their security. This is an idealization we know fails in the real world: we have explicit counterexamples where “SNARKs” coming out of this methodology are totally insecure when instantiated with any concrete hash function.
We generally ignore these counterexamples in part because they only arise when proving contrived, self-referential statements about the very hash function used by the SNARK verifier.
But proving statements about the verifier’s own hash function is the exact thing you do in SNARK recursion. That’s why the security of recursive SNARKs can’t be established even in the random oracle model.
On top of that, the standard security proofs for recursion (in other models) suffer an “extractor runtime” blowup that is exponential in the recursion depth, suggesting that security may degrade as more recursion is applied. Yet Ethereum’s own EIP-8288 enables unlimited-depth recursion, even as it lists soundness of recursive SNARKs as a trust assumption. Proofs in more idealized models avoid the blowup, but they mainly tell us that an attack on SNARK recursion would have to exploit the concrete hash function, which is exactly what the Fiat–Shamir attacks above do.
To be clear, we don’t know of any outright attacks on SNARK recursion, and I very much hope it is secure. But some of us who have studied the question have a lingering sense that an attack may be possible in some settings. And if AI is going to supercharge cryptanalysis, there is no reason to expect it to spare Fiat–Shamir for SNARKs, let alone SNARK recursion, both of which have had far less scrutiny than lattices.
So, I do not concede that a “recursion everywhere” hash-only approach is clearly more conservative than one built on standard lattice assumptions.
3. “Just wrap everything in a hash-based SNARK” (like EIP-8288) faces challenges.
Aggregating signatures and proofs off-chain into a single block-level proof is a powerful design independent of the hash-only vs. lattice debate, and I am not telling people to avoid it. But claiming, as Vitalik Buterin did this week, that users can run whatever cryptography they want locally and wrap it in a client-side leanVM proof glosses over major hurdles.
For example, leanVM today is a minimal VM designed almost entirely to prove hash-based signatures and recursion, not general-purpose computation. And binary-field SNARKs like leanVM remain slow at proving the integer multiplications that lattice cryptography does en masse.
I am optimistic that many of these zkVM challenges can be met (including via my own work, binary-field Twist and Shout, which are now implemented in Magnetar). But regardless, if lattices can make aggregation simpler and faster, then they should be leveraged. We need to be agile no matter what.
4. For chains whose reason for existence is privacy, I truly struggle to understand the pushback. Public-key encryption (and fast single-server PIR) cannot be built from hashes alone, at least not in any black-box way. If lattices break, it is going to be very, very hard for these chains to provide acceptable levels of privacy and functionality. For a project whose entire reason for existence is privacy, a loss of confidentiality is an existential failure. Next to that, a second signature upgrade (after the first one, from elliptic curves alone to, hopefully, a hybrid lattice scheme) is easy.
Summary: We don’t know for sure what is secure and what isn’t. We are all weighing unquantifiable risks against each other, and we do not need to agree on a total order on them. But hash-only solutions face many open engineering challenges, and they are not more “conservative” in the way some have argued. Some of those challenges are entirely prosaic and have nothing to do with bugs or cryptography, like hardware support for custom schemes whose hash function is still undecided. I hope we can overcome those challenges within the appropriate timelines, but they must be acknowledged and portrayed realistically.
Overall, cryptographic agility and defense in depth (e.g., hybrid signatures) are the answer, which is why we are building both lattice-Jolt and hash-Jolt. In practice, the positions are less polarized than social media discourse suggests: for example, StarkWare is working to make Falcon verification cheap ( which is great to see.
Here is the (apparently) controversial take I am sticking to: Conditioned on agility, whenever lattices make systems simpler or more functional, we should embrace them rather than default to “hash-only” designs. Lattices are what the rest of the world will depend on, with decades of study and hardening behind them, and at the system level, less functional often means less secure. Where hash-only designs are just as simple and functional, by all means use them.
Need to give a big shoutout to the Money20/20 team for giving me the chance to meet Timbaland yesterday before his set at Omnia in Las Vegas.
Despite being a massive hip hop fan, I have to say that his best work, in my opinion, is FutureSex/LoveSounds with Justin Timberlake.
That opinion probably dates me a bit, considering the album came out back in 2006. But if you know, you know..
RT @bobbinth: Doing computation on the client side and sending STARK proofs to the network is how Miden works today :) Another improvement is to store state on the client side as well - will help with state bloat.
Share
Copied
vitalik.eth@VitalikButerin
Ultimately, precompiles and EVM are both the wrong place to put most cryptography support into Ethereum. The reason is that precompiles and EVM both operate on data that has to be included into the ethereum chain somehow, which realistically means included in a block as calldata. That space is limited - even with PeerDAS and blocks-in-blobs, there's a practical cap of ~8 MB/s before it starts getting uncomfortable.
Remember: it's not a blockchain. It's a cryptographic world computer. Any data/computation that does not need to be in the "main thread" of data/execution should not be put into the main thread.
Instead, the correct solution is... EIP-8288 maximalism.
If you have any heavy computation that's self-contained, compute it and STARK it client-side (this is quickly getting faster and faster, even on phones), and push the STARK through the EIP-8288 recursive aggregation mechanism. The chain sees the fact that the computation was done and what the result is; it never needs to see the actual data and computation.
This way everyone can use whatever cryptography they want, the Ethereum chain can be lean, and we never need to add more precompiles again.
Ultimately, precompiles and EVM are both the wrong place to put most cryptography support into Ethereum. The reason is that precompiles and EVM both operate on data that has to be included into the ethereum chain somehow, which realistically means included in a block as calldata. That space is limited - even with PeerDAS and blocks-in-blobs, there's a practical cap of ~8 MB/s before it starts getting uncomfortable.
Remember: it's not a blockchain. It's a cryptographic world computer. Any data/computation that does not need to be in the "main thread" of data/execution should not be put into the main thread.
Instead, the correct solution is... EIP-8288 maximalism.
If you have any heavy computation that's self-contained, compute it and STARK it client-side (this is quickly getting faster and faster, even on phones), and push the STARK through the EIP-8288 recursive aggregation mechanism. The chain sees the fact that the computation was done and what the result is; it never needs to see the actual data and computation.
This way everyone can use whatever cryptography they want, the Ethereum chain can be lean, and we never need to add more precompiles again.
I know I’ve been saying mainnet soon, but it’s actually mainnet on October 26th.
Yes, it’s a partner mainnet, so get in my DMs on here or Telegram so I can help you get access.
The same people who have spoken to me about access to Bread Wallet will already have mainnet access. If you haven’t though, hit me up..
