Howard Wu - Tornado Cash 2.0: Cross-Chain. Compliant. Private - TOKEN2049 Dubai 2025

Good morning. My name is Howard and uh today I'm going to be talking about Tornado Cash 2.0 uh crosschain compliant and private. Um before I get started, I want to say this is not a talk about how to launder money. Uh if you want to learn about that, go to the stage next door.

I'm just kidding. Um but this talk here is really to talk about one what tornado cache is what it unlocked uh why it doesn't work and why we as an industry still need uh something that is tornado cache like. So before I really jump into things um you know I'm founded this protocol called Alo. Alo is a new L1 that supports programmable privacy namely using private smart contracts with ZK. And uh a lot of the motivation for building Alio was actually a a transformation or understanding of how web 2 worked and then going into web 3.

And what I mean by that is that when you look at how web 2 worked in the early days, if you go back 20 years ago, um all of us remember that there was HTTP and there was no cons of HTTPS. And what that meant was that when you go on a website, you couldn't put in your credit card number. You couldn't create an account with a password. And it was incredibly difficult to ensure that you had good security when you were browsing the web. Once we had HTTPS, we actually unlocked a new capability which was to have e-commerce and to open up the value um of the web itself.

And you know, when you look at that paradigm and where we are in web 3, I actually think there's a lot of analogies. Right now, all of web 3 is fully transparent. And I think a lot of teams have started to recognize some of the pain points or challenges of having a system that is fully transparent uh for for the world to use. In terms of the development in to try to make crypto more private, there have been a handful of teams that have tried to introduce technologies to make it more private. And the first technique that was introduced actually about 10 years ago was this idea of mixers.

Uh around 2013, there was a paper called coin join that was proposed. And the idea there was to introduce um a pool. a pool where users could bring tokens in. Um they could effectively go and um deposit use a timebased system to try to obuscate and shuffle their coins and uh then come back and retrieve their assets later. Um you know it it was it was a privacy technique using obuscation.

There was two notable projects that worked on this. One was called Wasabi Wallet that was used for Bitcoin. Um and another was called tornado cache which I think many of you may have heard of at this point. Now, Tornado Cash was interesting because it attempted to solve on Ethereum the ability to provide um a level of privacy for for cryptocurrencies, but it came with some some serious downsides. Um and let me just go through why tornado cash didn't work.

First of all, um for those of you who are familiar with Ethereum, whenever you submit a transaction on Ethereum, you have to pay a transaction fee, which is commonly called gas. The problem with gas is that that gas has to be paid for from some account an account and that account actually reveals and leaks to you um who the actual sender and the transactor is. So this ends up creating a problem that many Ethereum researchers recognize and they ended up actually creating something called gas stations. Now gas stations in my view is just a way of punting the problem. So the idea there is to say users can then deposit their gas into this kind of contract that will pay the gas on behalf of the user when they go and call tornado cashe.

Now if the gas station itself is a pool where you deposit tokens to help pay for the fee, doesn't that just sound like another mixer itself? Um so you know in my view this ended up becoming just a way to punt the problem and now you had an issue where how do you deposit gas into the actual uh gas station in a way that was privacy preserving. Um so this opened up kind of a broader set of concerns and I think gas gas itself was a was a big issue for Ethereum. The second issue is actually a fragmentation by denomination. So what I mean by that is um when you deposit into tornado cache uh you had different types of denominations.

So uh the issue on a high level is to say if I were to move five ETH in and another user was to move one ETH in. Um the problem is later when I go to withdraw I'm going to withdraw five ETH and another user may withdraw one ETH. it it's kind of obvious from the chain history to say who deposited the five ETH and who deposited the one ETH and who withdrew those, right? And so you can then immediately link back and say who did what. So the way that tornado cash got around this was to create different denominations.

For example, one ETH uh 0.1 ETH and 0.01 ETH. So if I had 0.9 ETH that I wanted to deposit in, I would break up my 0.

9 ETH into nine tranches of 0.1 ETH and then deposit that in. Now the problem with that is that this in and of itself while in theory is nice in practice for most users that are not sophisticated would end up using this in a way that didn't protect their privacy. Namely when they broke it up into tranches of you know nine nine tranches of 0.1 you'd see in the chain history a lot of emptiness and then 0.

1 0.1 0.1 0.1 0.1 0.

1 0.1 and then nothing and then later they come and withdraw and it's another nine tranches of 0.1. So if you look at the chain history, it actually becomes quite obvious who deposited what when into this specific pool and that ends up creating an actual timing attack where you can then deduce who deposited and who who withdrew. Um so fragmentation by denomination ended up creating a a a broader issue from a detection standpoint.

And I think the bigger issue actually beyond all this is the third point which is that um tornado cache itself only addressed one specific token type which was ETH. it didn't solve it for uh general ERC20s and it also didn't solve it for things like stable coins like USDT or USDC on chain and so the the you know solution itself was very bespoke for one asset and you know I think that in the same way that in HTTPS uh uh was was a solution for the web we need something that is going to be analogous for all of crypto for all crypto assets so forget about mixers what's another way to do it well many teams have pursued this idea of using privacy preserving cryptocurrencies. And unlike the mixer approach here, users will shield their coins on a decentralized ledger and they will demonstrate ownership of their assets by proving that they know the encryption um to their actual cipher text on chain, namely their coins on chain. So this privacy through encryption or obuscation is a way to solve that, but it comes with its own set of trade-offs. Um when you look at uh you know the most prominent ones, many of you have probably heard of Monero and Zcash and you know the good news is this is something that is a true decentralized network in the same way that you would know Bitcoin or Ethereum.

Um and it also achieves a strong level of uh transaction privacy especially in comparison to the Mixer technique that I just mentioned. However, it does come with some significant downsides. One is that there are no smart contracts on systems like this. Uh this is like the kind of first generation world of private uh privacy preserving blockchains. And you may wonder why do smart contracts matter?

Well, one of the main points is actually configurable compliance. What that means is that for developers who want to use a privacy blockchain, they will need to comply with local laws and and jurisdictions that they're going to operate in. For instance, the way Dubai looks at crypto is the is very different from the way Hong Kong or Singapore or Japan or Switzerland or the US looks at crypto. And so for developers that want to onboard users in different jurisdictions, they need to come up with systems that are going to be compliant with the with the local that they operate in. And that type of configur uh configurable compliance needs smart contracts.

The last point to make is actually analogous to what I just mentioned that without smart contracts, it's incredibly diff uh difficult to define ERC20 style tokens. So, custom assets and even more so there is no support for stable coins in these types of privacy blockchains. And so, you know, you may be wondering why why does stable coins matter so much? Well, this is a visualization of all the total stable coin payments that are out there in the world today. And that dot in the middle is the amount of encrypted payments.

And if you think about the HTTP to HTTPS story, we're at the very beginning of the HTTP story here in web 3. And to put it concretely, about 27 trillion uh dollars worth of transfer volume happened in the past year, of which less than 0.01% of that was actually um endto-end encrypted transactions. And this comes with some serious implications because, you know, for instance, if I go to a local coffee shop and I want to tap to pay, I want to make sure that if I'm paying with USDC, that the merchant and the barista cannot learn my financial history by tapping to pay. But today, as you guys can imagine, these blockchains are transparent.

The minute they learn the address, they see my financial history, past, present, and future. And even more so, this has become an opt-in mechanism that allows them to now track my wallet for the rest of time. And so, if you really want to get payments and USDC out there into the real world um for average people to use, they will not expect user journey like what I just described, they will expect the payments themselves to be endto-end encrypted, to be fully private, and to give them the same level of assurance that a bank account in web 2 gives them today. So, what actually works? You know, we talked about mixers.

We talked about this kind of first generation version of privacy preserving blockchains. They come with their own trade-offs. And what I see is that there's two main problems and there's really one way to solve it. The problems are that well, if you have a fully public blockchain, you're effectively overexposing the amount of data that you're giving and allowing everyone to track and trace you for the rest of the time. But at the same time, we also recognize that you can't just fully encrypt your blockchain and call it a day.

namely that you are unable to demonstrate compliance. Your solution may be one-sizefits-all. It may not be tailored for different jurisdictions and you may not have sufficient configurable compliance to actually work in different loces. And so we built Alo. Alo is a new blockchain.

It supports programmable privacy. It has privacy uh smart contracts at its core. And we're using this technology to really try to solve the privacy and compliance issues that were in technologies before us. Namely, ALO is permissionless, it's programmable, and it's privacy preserving. It sits at the heart of these key properties that we believe are necessary to actually make quote unquote tornado cache 2.

0 exist in a compliant crosschain and private manner. And if you look at the ecosystem today, this is really the first approach or the first team to really build this thing out there and and put it out in the wild. Alo today is already available. It's out there in the wild and it's something that you can use. Um, and we believe that this is going to be the approach that many teams after us are going to use to demonstrate how payments enters the real world.

Namely, there's several key pieces we think that will be beneficial to stable coin issuers. Um, the one that I really want to call into attention is the view key. The view key will allow for anyone to be able to decrypt transaction data. Um, it is a strong compliance mechanism that allows for policies to be built, for instance, to reveal just specific pieces of transaction data. It can also for example demonstrate that there is no transaction history that was associated with OFAX ancient accounts and you can also introduce thresholding techniques so that you can selectively reveal after certain criteria are met.

But it goes beyond that. We also think about compliance from a compliance by design um kind of tooling framework. And what I mean by that is that once you have private smart contracts, you now can introduce rules engines and policy engines so that you can make the actual compliance pieces customizable and configurable to the local and the jurisdictions that you want to operate in. And there's several teams that we work with to try to demonstrate that. Um, predicate being one that's doing this via a smart contract on chain.

As you guys may know, there's chain analysis, TRM labs, and Inca digital which are providing different types of intelligence and analytics as well. Um, and this is just one one of many approaches uh to demonstrating compliance. You know, in addition, we also have this idea called verifiable credentials. The idea with that is that imagine if you could use your iPhone tap on your passport in your passport there's an RFID chip where you can verify a signature that's issued by your government and that and allows you to then provide an attit attestation that you are for example over the age of 18 without revealing your date of birth or that you are from a non-ofax sanctioned country without revealing your citizenship and if you tie that with additional details like your banking details that you could then further prove that you're an accredited investor without revealing your exact net worth. This provides you, for example, in bridges or in DeFi protocols, higher spending limits or different types of of of permissions that otherwise would not be authorized in a smart contract.

And this gives you different levels of controls um especially from a KYC standpoint. But in addition, you know, compliance and privacy are always an ongoing conversation. And it's important that you have something like private smart contracts because you then can continue to upgrade your smart contracts and you can iterate as policies evolve as well. And there are many teams out there who are advocating for privacy alongside compliance including crypto isac blockchain association coin center and we've also put together our own governance uh proposals to try to make this a community conversation something that can be rolled out across the entire ecosystem. And so I think that this is kind of the best way to really think about how you are going to build a system that provides privacy while also achieving all of the the compliance techniques that people are going to require.

Alio today is already launched. Um it is it has day one listings from Coinbase and Hashkey and we believe this is going to be defining a new standard for both privacy and compliance. Um, we certainly believe that this is going to be how uh, payments and commerce are going to be crosschain, how they're going to be compliant, um, and how they're going to become confidential. Um, and with that, I'm out of time. I want to thank you for all of your attention, and I hope you'll come and check out Alio.

Thank you very much.