Good day everyone. My name is Amin Suleimani. I am the CTO of Oxbow. Today I'm going to talk about privacy without terrorists. Before I start, I just want to say that I am very grateful to be an American.
It's much better than the alternative where my parents came from, and I owe it to them to come here , to the land of the free, where we often take America for granted in the cyberpunk space, because all of our values and, as cyberpunks, a kind of free speech and open source, depend on American laws, and we have to be careful not to weaken America. Because we might not like what other countries think of our so-called cyberpunk values. Who here has heard of Tornado Cash? Okay, everyone raise your hands. I want to talk a little about how Tornado Cash came about.
Tornado Cash was the original privacy protocol on Ethereum. And we created it because ETH fans were jealous of Zcash because of its private money features. We did n't want to reveal all of our transactions every time we sent money and expose our entire transaction history. So in 2019, Moloch DAO, a punk rock nonprofit I helped found, funded all of the seed grants for Tornado Cash. I personally, uh Tornado Cash.
I personally, uh , wrote every grant application, and our final contribution to Tornado Cash was coordinating the resetting of the admin key to zero so that the protocol would be immutable forever. Uh, this was the second ZK-Snark deployment in history after Zcash. Uh, fun fact, we actually rejected the team's grant application, and after they were denied the grant, they furiously created this whole thing in 3 weeks. So we used it for personal privacy, and uh privacy, and uh Vitalik, who has always been a hero, used it to send money to support Ukraine. Er support Ukraine.
Er , things went wrong after North Korea stole over $600 million and started funneling hundreds of millions of dollars through the Tornado Cash system. And then, on August 8, 2022, the US Treasury Department sanctioned the Tornado Cash protocol. Oleksiy and Roman were charged and, uh, sentenced to 5 years in prison. Alexi in the Netherlands and Roman, who was arrested at gunpoint at 3:00 AM, despite the fact that he, uh, cooperated with the police investigation into Tornado Cash, uh, he also received a five-year prison sentence. It's been a while since I've been to New York.
Last time I was in New I was in New York, uh, me and all my friends were sitting outside the courtroom, uh, supporting Roman Storm. Eh, I don't think the developers of Tornado Cash should be held responsible for the crimes of the protocol users. They had no criminal intent. The Tornado Cash protocol itself was immutable, and there was nothing the developers could do about it. And the developers themselves created a matching tool that allowed individual users to prove, uh, which deposit they took from.
And, uh, they're both getting ready to appeal their cases. The fight is still ongoing. And it's really important that they win this. We actually started this lawsuit for Roman thinking that confidentiality would be illegal because of a 20-year-old sanctions violation charge and a 20-year-old money laundering charge. But in reality, he was only charged with 5 only charged with 5 years of, uh, unlicensed financial services business.
But the most surprising thing about this is the most surprising thing about this is that Tornado Cash did not involve imprisonment. So as a result, everything became illegal. Uh, Etherscan, by some interpretation of this, could be considered a financial services business simply because they provide an interface for recording transactions on the Ethereum blockchain. It is critical for our industry that Roman's appeal is successful and that, uh, this charge is overturned in court so that we have clarity on all the Ethereum wallets and applications that we have built. Uh, and if you have the means, please support their, uh, fundraiser.
And this is just another slide that shows how they couldn't stop anything. Uh, this second peak is exactly when sanctions hit. And it's the only protocol I know of that was developed after the developers were thrown in prison. So, the last peak falls some time after the sanctions were lifted. So, the Tornado Cash team did not help North Korea gain privacy.
But what about the rest of us? Aren't we responsible for contributing to the anonymity of North Korean hackers? If North Korea were the only user, wouldn't it be extremely easy to track their money? So I believe that with great power comes great responsibility. And the tools we created are so powerful that the smart powerful that the smart contract itself was declared a terrorist organization by the US government.
And Judge Alexi stated in his trial in the Netherlands that there is no legitimate use case for Tornado Cash. And I think it's up to us to correct this false narrative. One result we could get is based on this Federal Reserve report on Tornado Cash, published in April 2023. It recommends to regulators that Tornado Cash users should be allowed to use it use it , but they should also be required to disclose which deposit corresponds to their withdrawals to a regulated financial institution. And they claim that crypto asset mixers like Tornado are an integral part, but the problem with their recommendation is that it creates a huge “ huge “ bait pot” of all financial records.
Um, and users should check themselves. So, uh, Vitalik, Chainalysis' chief scientist, Jacob, and the two authors of that original article, the St. Louis Fed, and I, have written a new article about privacy pools. And this, uh, in this article we're talking about a different way of achieving regulators' goals. The idea is that users of a privacy protocol can publicly distance themselves from illicit funds that may have been deposited into that protocol.
And so when users make a deposit, there's a waiting period, and then a set of associations is generated from all deposits that are verified as not illegal, and users can voluntarily post proof that their deposit came from one of those deposits without revealing exactly which one. And here's how we can separate the good money from the bad while avoiding data leaks. This is Basel. How many of you know about the Basel Tower and the Bank for International Settlements? It's like the last boss of cryptocurrency.
You will understand. I have to go there and present the paper, and these are my co-authors. Um, so the way it works is that users make a deposit, wait for approval, we do a KYT check, know your transaction across all wallets, and see where the source of the funds is coming from. And funds from unreliable sources are rejected. Only approved deposits can be withdrawn privately, and rejected funds will still be able to be withdrawn quickly, which is a kind of escape hatch that allows them to get their funds back so that we don't freeze anyone's money and so that the protocol does n't remain in custody.
We've been keeping this on the mainnet for a year now. This is anonymized for over $20 million . We are seeing a recent increase in stablecoin volume. We are very happy about this. But the first version of privacy pools was a proof of concept.
The second version of Privacy Pools is launched today and you can check it out. She's, uh, working on Sepolia. And it has a whole bunch of new features. So, firstly, it has a secure pool that allows private transfers within the pool, like Zcash and Railgun. Secure pools are really important because they help, uh, break the connection uh, break the connection , uh, not only in terms of the amount, uh, and the recipients, uh, but also because you can't correlate the time because you don't know what transactions are happening there.
Uh, it's better than privacy, which is a new buzzword, uh, because privacy hides the amounts, but not the sender and recipient. They are all public. So, it's, uh public. So, it's, uh , a completely anonymous system where the sender and recipient are also hidden. It has a default correspondence where each transaction confirms the association of a set of members.
So that means if we accept money, we accept a deposit, and then after a while that deposit is considered potentially illegal. Uh, now we can reject this deposit and remove it from the association set. And so, every transaction that happens after that automatically proves that their money did not come from the deposit that we just rejected from our set of associations. And that way everyone else can prove they're not villains. You can register for this using any EVM wallet.
You can pay people before they even sign up. You can make private payment requests that don't even reveal your address to the pool. And, uh, we're working on a way to make privacy pay you so you can generate revenue from DeFi. We are also working on a hardware wallet and multi-signature support. And I have some great giveaways here that demonstrate how it works.
Uh, go to the test network, check. There definitely won't be an airdrop. So do n't expect anything. Uh, that's how the deposit process works. So, you can view the deposits.
Uh, and, you know, once you deposit money, it goes into the pool, and then you have to wait a little while for approval. It's faster on the test network. Uh, on the mainnet it's usually an hour, uh for larger amounts, sometimes, uh, a day or two sometimes, uh, a day or two if we need to check them manually. Uh, and then once your money is in the pool, you can transfer it privately. And then confirm the transfer.
And this allows you to send money from the pool to another user, and they can then receive it and spend it from there. And when you're done being in the pool and transferring, or want to use your money elsewhere, you can withdraw your funds. And all anyone sees on the blockchain is that your money came through a smart came through a smart contract. That's all. And if your funds are not accepted or the deposit is declined later, you can always exit the system with your money.
And this is called "exiting through rage." I wouldn't be allowed to call it a "rage exit" in the UI , but, uh, it's an exit. Uh, and you can also make a private payment request. And in a private payment request, you don't actually have to reveal your address, and someone else can pay you. And then you can take the link that's generated when you get paid and import, uh, that link into your account and get paid.
So I encourage everyone to check out v2.privacypools.com. Follow us on Twitter. I am in Seoul now.
Our project is called Oxbow, which is spelled as zero x bow. And we, uh, create privacy pools. And we're honored to have Vitalik as an investor, and he agrees with our, uh , philosophy of this project, which is that the compromise we're making is that we've made it harder to access, and we also have the ability to exclude people who we believe have illicit funds. However, uh, we don't have any way to retroactively de-anonymize people by default in the system. And we think that's a good compromise because, uh, having these backdoors in your systems can be used against you.
Uh, one of the funniest headlines I read recently was, uh, about how Vladimir Putin questioned his centralized surveillance system that exists in Russia after watching the Israelis use a centralized surveillance system that the Islamic Republic of Iran used, and, uh, it resulted in a whole bunch of them being turned into kebabs. So, uh, this is, uh, thank you Israel for pointing out the weakness of some centralized surveillance systems surveillance systems . And I think that in the future, we will all consider privacy a national security issue and take it even more seriously than we do today. And I look forward to doing this in America as an American, so that we can earn the right to privacy systems without detention forever. And if we win here, we win for the whole world.
Thank you very much.
Automatic transcript — names and jargon may be misspelled.