Bitcoin Takeover Podcast

We recorded this conversation in Mexico, at an undisclosed location, during the celebrations for Zcash's 10th anniversary. Daira-Emma Hopwood has been with the project for 11 years, since before launch, and came to it through Zooko and the Tahoe-LAFS community. Daira-Emma reviewed the code for the 2016 ceremony and designed the ceremony protocol, later co-authored the Halo paper with Sean Bowe and Jack Grigg, which led to Orchard and Halo 2 without a trusted setup, and has been a strong voice for Zcash Shielded Assets (ZSAs). Today Daira-Emma is Head of Research and Assurance at ZODL, the Zcash Open Development Lab, which the former Electric Coin Company staff started the day after they handed in their notice.

On the table next to us was the ceremony laptop we bought from Peter Todd: the keyboard, the motherboard burned with a blowtorch, and the discs that held the software and the transcript. Daira explains what went wrong with Sprout: the flaw was not the ceremony itself but the BCTV14 proof system, whose setup put values in the transcript that were not necessary and could have leaked the toxic waste.

From there we go through the codebase Zcash inherited from Bitcoin Core 0.11.2 and why Daira-Emma is relieved that zcashd is no longer a consensus node on the network, the Equihash parameter mistake that brought ASICs in sooner and pushed GPU hobbyists out, and why Daira-Emma designs for the long term instead of trusting today's mining pool distribution.

The second hour gets more personal and more political. Daira-Emma declares an interest as a founder who received part of the founders reward, defends the Dev Fund and the ZCG grant slice, and explains why the coin-weighted poll should not, in Daira-Emma's view, override the rest of the community, both on grants and on ZSAs. The conversation covers harassment on X, why sex workers were a constituency Daira-Emma had in mind when joining Zcash, and the call for crypto to fix its credibility problem with the left.

We close on AI: how the Orchard vulnerability was found by a person using a publicly released model, how ZODL switched Orchard off within 48 hours, the worry about developer burnout and upgrades every few months, and why understanding what we build is not optional.

What we cover:

- Where Daira was during the 2016 ceremony, and the Sprout counterfeiting bug inherited from BCTV14
- Halo and the move to Orchard and Halo 2 without a trusted setup
- Designing an MPC ceremony with very little Bitcoin experience
- Moving from zcashd's C++ to Zebra and Rust, and why precise specs help AI check implementations
- Block times, NU7 and propagating zk-SNARK transactions
- What Daira-Emma would change before launch: the Equihash parameters
- Crosslink, objective finality and partitioning attacks
- Removing the transparent side and private by default addresses
- The end of ECC and the start of ZODL
- Monero, ring signatures and competition between privacy protocols
- Network privacy: Tor, Nym, Dandelion++ and multisig for hardware wallets
- The ZCG grant controversy, ZSAs and coin-weighted polls
- AI, the Orchard vulnerability, post-quantum work and assurance

This episode is sponsored by Cake Wallet, SideShift, Orange Rock, eCash and Braiins Hashpower.

The full archive of the Bitcoin Takeover podcast, with every season and every transcript we have published, is at bitcoin-takeover.com.

Time Stamps:
0:00 Intro
0:45 Welcome: Zcash's 10th anniversary in Mexico
1:34 Where Daira was during the 2016 ceremony
2:31 The Sprout counterfeiting bug and where it came from
3:29 Halo: getting rid of the trusted setup
4:31 Zooko, Sean Bowe, Daira: dropouts or not?
5:32 Hands-on with the destroyed ceremony laptop
7:57 Designing the ceremony with little Bitcoin experience
10:35 What's good and bad about Bitcoin Core's codebase
12:15 From C++ to Rust: how different is Zcash today?
14:35 Block time, issuance and propagating big zk-SNARKs
16:56 Sponsors: Cake Wallet, SideShift, Orange Rock
18:24 What Daira would change in Zcash before launch
21:15 Crosslink: hybrid proof of work and proof of stake
25:33 Mining centralization: Foundry, China, hostile governments
27:06 Sponsors: eCash, Braiins Hashpower
29:00 Why Daira stayed with Zcash for 10 years
32:42 Projects built on Zcash cryptography
36:38 Removing the transparent side: private by default?
39:22 ECC dissolves, ZODL is born
45:11 Dandelion++, Tor and network-level privacy
47:57 VPNs, censorship and Iran
49:30 Hardware wallet hacks and self-custody setups
54:21 Slush, Trezor and Zooko
55:11 Any regrets about money?
55:35 The ZCG controversy and sex workers
1:05:27 Dealing with online harassment
1:09:37 Ironwood and Hopwood: who picked the name?
1:10:57 Zcash Shielded Assets (ZSAs): worth it?
1:23:20 Will Bitcoin ever adopt Zcash-style privacy?
1:25:17 Move fast and break things?
1:27:44 Why Zcash keeps its cypherpunk developers
1:30:50 Zcash 10 years from now
1:32:43 Daira's inventions and inspiration in cryptography
1:39:42 What gets Daira out of bed
1:41:31 AI, podcasts and training data
1:46:47 AI and the Orchard vulnerability
1:55:11 Head of Research and Assurance at ZODL
1:57:15 AI vs. training apprentices
1:59:35 Music, books and Zcash upgrade names
2:01:08 Amber, the Zcash color
2:01:58 Anything we missed?
2:03:48 Thank you and goodbye

Kris Nuttycombe of the Zcash Open Development Lab came back to the show two years after his first visit, this time on a hotel sofa at Zcon7 in Cancun, on the last day of the conference and around Zcash's tenth birthday.

We cover the price move and the Binance hack that was unfolding while we spoke, Zcash as what Bitcoin could have been, hard forks as a superpower, the end of Sprout and the inflation bug, Ironwood and formal verification, Crosslink and hybrid proof of work, ZIP 318 and Tachyon, the Dev Fund and Zcash Community Grants, the Equihash ASIC extinction event, and why ossification is death.

Time Stamps:
0:00 Intro & sponsors
2:09 Kris's second appearance
2:51 ZEC from $38 to $1,250
3:57 Zcon vs Bitcoin conferences
6:29 Privacy for refugees
7:42 NU7 & 25-second blocks
9:04 Why Zcash matters to Bitcoiners
12:12 Satoshi & zero-knowledge proofs
13:57 Hard forks as a superpower
19:32 Fungible internet money
21:56 Zcon7 impressions
24:27 ZEC flips Dogecoin
27:37 NEAR Intents & privacy at rest
30:33 Paying Visa merchants with shielded ZEC
33:43 A pluralism of currencies
34:19 Cake Wallet & Zcash Names
36:39 Unified addresses rant
41:35 The ceremony laptop & Zooko's CPU
42:06 Kris's story: Zooko & Tahoe-LAFS
44:22 Is Zooko Satoshi?
48:59 Sprout and the inflation bug
53:38 26,000 unclaimed ZEC
55:38 Q-Day & lost coins
59:21 Ironwood & formal verification with AI
1:03:31 The eCash hard fork
1:04:14 Dandelion++ & positive-sum thinking
1:07:04 Bitcoin dominance at 60%
1:09:10 Stablecoins are wrapped fiat
1:15:45 Are Zcash miners being phased out?
1:16:27 Crosslink: hybrid PoW/PoS
1:20:23 Kris's work at ZODL
1:22:25 ZIP 318 & Tachyon
1:25:26 Why Kris stayed with Zcash
1:29:39 Can Zcash ossify?
1:33:59 The currency of AI
1:40:23 Bitcoin layer 2s
1:42:10 Ossification is death
1:43:36 Saylor, covenants & 2106
1:46:57 Day two: Zebend
1:49:15 Zcash Community Grants & the Dev Fund
1:50:52 The Equihash ASIC "extinction event"
1:54:00 Security is not a market
1:58:12 Hashrate distribution
2:00:33 Proof of work & the labor theory of value
2:04:54 Hashrate as a finality gadget
2:06:25 Friendly forks & testnets
2:09:53 All value is social
2:12:31 Death by a thousand forks?
2:17:12 What if Zcash forked Bitcoin?
2:19:13 Zcash's next 10 years
2:21:44 Seed phrases & BIP39
2:23:14 AI made software cheap

This episode was recorded while driving to BitDevs in Atlanta. The car belongs to Art (at least 1/3 of it) and is the first vehicle ever bought for bitcoin in 2013: a 2011 Toyota Prius, for which the Mycelium wallet founder paid 1000 BTC.

We talk about cars, Bitcoin development, why the medium of exchange side of BTC matters, and how we can achieve privacy and scalability. Other people join too towards the end: Ekrem Bal from Citrea, Christian from Alpen Labs, Paul Sztorc from LayerTwo Labs, and Rob Hamilton from Anchor Watch.

Time Stamps:
0:45 Riding to the BitDevs barbecue in the 1,000 BTC Prius
2:05 The first car ever bought with bitcoin
11:29 Robin's 1,000 BTC dream car: a VW Beetle?
16:01 BitPay, KYC and why BTCPay Server exists
29:50 Would you pay 1,000 BTC? Shielded CSV vs Visa
32:54 Roger Ver and the block size war revisited
38:01 TABConf highlights: Peter Todd, Paul Sztorc and a 2029 cleanup
45:27 LayerTwo Labs, BIP300 and drivechains
49:31 Cake Wallet, Wasabi and the Spark custody problem
57:30 Arriving at BitDevs: the Taproot annex PR
1:01:09 Ekrem of Citrea and the Bitcoin privacy wars
1:06:24 Bitcoin Spaces and one name for every address
1:10:15 Alpen vs Citrea, then Paul Sztorc joins
1:16:10 BitNames and the Truthcoin relaunch

The second day of TABConf 8, live from Atlanta. Ekrem Bal talks Citrea privacy, Kevin Loaec explains Liana wallet, Spaces Protocol introduces BTC handles, Bitcoin credit unions enter the scene, Peter Todd unboxes his Zcash ceremony laptop 10 years later.

Time stamps:

0:00 Stream warm-up
2:29 Ekrem Bal: Citrea pivots to privacy with Crest
7:22 Privacy and scalability on Citrea
11:30 Privacy as protection from physical attacks
16:00 Lessons from almost a year on mainnet
19:00 User feedback and the Clementine web app
20:13 Alpen, garbled circuits and Clementine v2
21:33 Next use cases: lending, vaults and agent spending limits
22:51 Making Citrea post-quantum
26:21 Great Script Restoration and trust assumptions
29:29 OP_CAT vs CTV vs template hash
31:26 How Crest differs from Tornado Cash
33:12 Railgun and proof of innocence
33:53 Why build on Bitcoin instead of Ethereum
36:23 Favorite fork: Taproot and Zcash envy
38:19 The eCash replay trick
41:24 Skiing and mountaineering
42:51 110 BTC on Citrea
43:34 Kevin Loaec joins
44:31 First and last TABConf and the unconference format
46:21 A bad year: Coldcard, Liquid and Liana
48:00 Stu joins
48:41 Vaults vs Liana’s timelocks
51:59 Most interesting guest and 10 hour episodes
54:02 Forks magazine
55:32 Script emulation on Bark
56:08 Liana videos and Revault
57:32 Favorite covenant and enforced amounts
59:40 Wrench attacks and Liana’s exposure
1:01:07 Ledger leaks and buying hardware online
1:03:41 Coldcard’s RNG bug, license and bounties
1:06:07 Andrew joins: Spaces Protocol
1:10:30 Buffer joins
1:10:55 3,700 spaces and @bitcoin handles
1:11:18 The TABConf name giveaway and delegation
1:14:39 Nacho and payment handles
1:15:39 Burning @tabconf forever
1:17:45 32 bytes on chain and cert relays
1:19:15 Client-side validation and censorship resistance
1:20:18 One click install on StartOS
1:21:14 How Spaces makes money
1:22:17 What stops an alt Spaces?
1:24:01 Namecoin, squatters and 10 auctions a day
1:27:25 Utility: Nacho and social proofs
1:29:37 Don’t reuse your name address: silent payments
1:32:19 Spaces and Bitcoin’s scalability
1:33:39 Do names expire?
1:35:43 One character names
1:37:10 Insight gateways, Nostr and Blossom
1:40:43 The Fabric resolver
1:41:23 Handle pricing
1:44:02 Where to learn more about Spaces
1:47:00 Spaces and the forks
1:53:44 Last call for @tabconf handles
1:55:42 Goodbye Andrew and Buffer
1:57:34 Hallway break
2:00:00 Kevin Loaec returns: Paris, Sparrow and Miniscript
2:05:26 Funding open source without begging users
2:12:33 A horrible year: hacks and forks
2:13:47 Bitcoin follows the crowd
2:28:55 New guest and matching watches
2:29:57 What makes you bullish about Bitcoin?
2:31:05 Closing hallway chatter
2:43:10 Part 2: Back online: The Bitcoin Pivot and the three C’s
2:47:39 How credit unions will custody bitcoin
2:49:28 An advisory firm with vendor-agnostic partners
2:51:47 Why TABConf is welcoming
2:52:26 Feedback and the wave of credit union mergers
2:56:32 Credit unions vs banks: the not-for-profit mission
2:58:32 Lightning and paying with Bitcoin
2:59:10 Credit unions as Lightning service providers
3:00:22 Rehypothecation risk and Aave
3:01:39 NCUA, not FDIC
3:02:07 Where to learn more about The Bitcoin Pivot
3:02:52 Peter Todd arrives and the stream pauses

Live from TABConf 8 in Atlanta: Paul Sztorc demos a quantum-resistant soft fork, Christopher Allen on Blockchain Commons, Michael Tidwell on TABConf, plus Andre Beganski, Alex Lewin, Janusz and Will on their work in the space. Recorded on Wednesday, October 14th 2026.

Time stamps:

0:00 Stream warm-up
1:55 Welcome to Bitcoin Takeover at TABConf 8 with Paul Sztorc
2:30 CUSF 2 demo: quantum-resistant signatures, OP_VAULT, OP_CTV & OP_CAT
4:30 Sweeping coins into a quantum-resistant UTXO with BitWindow
5:05 Why miners will never run it
5:52 Is quantum FUD? Pascal's Wager & Saylor
7:50 Bitcoin's overconfidence & the competition
8:41 How altcoins took Bitcoin's use cases
10:17 Greg Maxwell & the belief in Bitcoin's infallibility
11:39 Camera dies, webcam to the rescue
12:30 eCash hard fork: free coins later this month
13:08 Soft forks are opt-in, ignorable & reversible
14:35 Kafkaesque: will soft forks become mandatory?
16:01 Live questions: claiming eCash & does Saylor self-custody?
16:46 Mike Belshe, BitGo & custodians
17:48 The war on crypto, PGP & Enigma
18:44 How to claim your eCash coins
19:13 Liquidity pools instead of paying for exchange listings
21:37 Shinobi walks by & the Coldcard trophy
21:50 Paul leaves for the Town Hall
22:34 Spotting Christopher Allen & sponsor thanks
24:14 André Beganski joins: from Decrypt to MARA Foundation
25:25 Decrypt, The Block & trade publications
25:57 DL News & DeFi Llama
26:49 Blockworks' offer & Supply Shock
27:43 BTCTKVR: Forks! magazine
28:10 The Ledger magazine & sourdough bakers
29:43 Going independent: Bitcoin Magazine vs Bitcoin Takeover
30:30 Storytellers vs AI
32:13 Original reporting & journalism as a public good
33:54 Sponsors & transparency
34:36 Camera battery woes & how to follow André
35:50 Orange Rock sponsor break
37:55 Alex Lewin joins: Finite & private AI
38:47 Fedi, Blockspaces & NCR
39:28 Atlanta, BitDevs & Capture the Bitcoin
40:14 Janusz joins: Zark = Zcash + Spark
41:38 Private AI meets private money
43:35 Privacy as an ingredient for liberty
44:03 Fungibility & a universal currency
45:21 Why Zcash-style privacy and not Monero?
47:05 Shielded pools vs ring signatures
49:44 Scaling privacy: Tachyon vs FCMP++
51:18 The first inning of privacy research
53:56 A bearish year: what still makes you bullish?
56:23 AI will make Bitcoin better, not worse
57:46 Why aren't you at the TABConf funeral?
58:50 The hallway track & why showing up matters
1:00:48 AI psychosis & conferences
1:01:36 Coffee, tobacco & AI as a productivity drug
1:03:08 Forks magazine handout
1:03:46 Atlanta's BeltLine
1:04:52 Favorite conferences: Bitcoin++ & Nashville
1:06:12 The Town Hall & the Tabbies
1:06:47 Paul has spoken at all eight TABConfs
1:07:43 Favorite fork? Bitcoin vs Zcash
1:09:22 The Orchard bug & a coordinated soft fork
1:11:29 Only Bitcoin is stubborn enough to invent witness encryption
1:11:59 Two hard forks this year: Luke's coin & eCash
1:12:40 Fork strategy: don't touch cold storage
1:13:43 Zcash as a BIP 300 drivechain
1:14:52 If Bitcoin goes to zero
1:16:13 Christopher Allen joins
1:17:40 Randomness warnings & VeriSign security reviews
1:19:32 LetheKit & dice entropy
1:20:00 Don't rely on any single key: multisig, MuSig & FROST
1:21:00 Wallet companies & the Coldcard victims
1:22:34 Coinkite, open source & closing the code
1:24:15 No single points of failure, compromise or denial
1:25:08 How Coldcard treated security researchers
1:26:36 Bug bounties in the age of LLMs
1:27:51 Cypherpunks who embraced Bitcoin
1:28:45 Netscape, SSL 2 & the RSAREF license
1:30:18 Writing the SSL 3 reference implementation & TLS 1.0
1:30:47 DigiCash & David Chaum
1:31:29 Certicom, micro-currencies & the Merkle patent
1:32:03 Schnorr patents & ECDSA
1:33:10 secp256r1 suspicions vs secp256k1
1:35:44 Discovering Bitcoin in 2013
1:36:08 UTXOs to revoke X.509 certificates
1:37:08 Decentralized identifiers & DPKI
1:37:37 Paul Sztorc returns: Rebooting the Web of Trust
1:38:32 Namecoin
1:38:59 Christopher's beef: key reuse in Ethereum & Nostr
1:40:30 BIP 32 & one key pair per identity
1:41:19 Christopher promises a part two
1:42:46 Paul introduces Will: 21 days before the midterms
1:43:35 Will on six privacy prisoners
1:43:59 Larry Harmon & Ian Freeman
1:44:45 Roman Sterlingov & Bitcoin Fog
1:47:32 Roman Storm & Tornado Cash
1:48:19 Samourai: Keonne Rodriguez & William Hill
1:50:59 The judge switch & the plea deals
1:54:25 The pardon campaign
1:55:42 Aaron Day's StarkFreedom PAC
1:58:52 Michael Tidwell joins
1:59:42 The Tabbies
2:01:29 Why TABConf 8 is the last one
2:02:01 Death by a thousand cuts
2:03:51 My first TABConf & thanking the sponsors
2:05:27 eCash: the calmest hard fork in memory
2:07:16 Will miners steal from drivechains?
2:08:15 TABConf debates: BTC vs BCH vs BSV
2:09:06 Monero, Dash & bringing people into the fold
2:09:51 Amanda B. Johnson & DarkCoin at the monthly meetup
2:11:55 No-shill policy during the ICO craze
2:12:50 Paul Sztorc's TABConf debates & Peter Todd
2:14:08 How TABConf got scammed in 2019
2:17:58 Greg Maxwell, Nick Szabo & who never came
2:19:45 Why the obituary happened a day early
2:20:31 Forks magazine
2:21:20 Top highlights: hardcore trivia & the standing ovation
2:23:40 What will Michael do with his eCash?
2:24:00 Kill Tidwell: Bitcoin comedy
2:25:12 Matt Odell never came
2:26:13 The first Bitcoin car & Rassah's plane
2:27:36 Atlanta lore: Jeff Garzik, Stephen Pair & BitPay
2:29:42 Bitcoin is not my religion
2:31:01 Favorite fork: Taproot
2:32:45 I like all the hard forks
2:35:24 Diversifying into airdrops: the most irrational VC
2:38:47 Goodbye Michael & wrap-up