你知道 Zcash，但 Railgun 让你在整个以太坊 DeFi 生态中私密使用任意资产

A lot of the research around Railgun is about how to make it do everything a public address can do. How do you tap into the burgeoning economy on EVM and do that privately, without doxing your wallet? You can think of it as incognito mode for Ethereum.

Nothing said on The Edge Podcast is a recommendation to buy or sell tokens or securities. This content is for educational and entertainment purposes only. Nothing shared here is financial advice.

Welcome to The Edge Podcast. I’m DeFi Dad here with Nomatic. Today’s show features Railgun privacy researcher, Alan. Alan, thank you for joining us. How are you doing?

If I were any better, I’d be twins, man. Thanks for having me.

Alan, there’s such a spectrum when it comes to privacy in crypto: What should be private, and where should privacy begin and end? We’ve been trying to have more of these discussions on Edge Pod, just asking what privacy even means in crypto. We recently had one of the lead privacy researchers from the Ethereum Foundation on, and he walked us through how the EF is tackling this problem. Pretty soon, we’re going to have Sovrite [?], a team building on top of Zcash, to talk about their approach.

Today, we wanted to learn more about Railgun’s approach and how it works. A lot of this stuff is still fuzzy in my head: how it actually connects together and works. Maybe you can fill in those gaps. We also want to compare Railgun to Zcash: what’s different, and where privacy should emanate from. Should it be at the app level or the wallet level? We want to talk about your theories around boring, everyday privacy that people don’t think about but that you think is important.

For starters, you mentioned before we began recording that you’ve been building in privacy for 6 years. How does a guy get so excited to wake up every day and slog away on the problem of privacy for 6 years?

1. Why Privacy Matters

Slogging away is the perfect way to put it because at times it’s grim and complicated. But that’s a good question. My background isn’t in development, app development, or this kind of research, so it was really happenstance, I guess. That’s the boring answer.

I started trading crypto and, like I guess most people—maybe not most people; maybe I’m projecting—I got into some Telegram groups where I was trading. The lack of privacy became abundantly clear when I got asked about a position I was in that I hadn’t really shared in the group. I was like, “Man, how did you know about that?” And they said, “Well, you have the Collab.Land token, and you’ve talked about this trade and that trade and this thing you bought. That’s your wallet, right?” Then I was shown my Etherscan.

I think there’s a natural progression for people: You start to self-custody, and then maybe after self-custody comes privacy. That’s where mine came from.

I’ve had “oh, shit” moments realizing I did a transaction in a wallet that’s ENS-labeled, and then thinking, “Oh, shit, I’m moving money between wallets and didn’t want this one wallet exposed.”

I’ve also thought a lot about the fact that exchanges know everything at the end of the day, and I’ve worried about data breaches. It seems like those breaches have been happening continually across all sorts of entities. I’ve heard of accounting firms being hacked, exchanges, of course, and Web2 legacy-type data breaches. Sometimes that means exposing our wallets, which is very scary.

We’re all accustomed to using blockchains that provide all this transparency, where you can basically see everything you ever do in that wallet. But I want to get to this future that you’re working toward: a place where I can have my privacy but also have the cryptographic assurances of using a blockchain like Ethereum. So, why don’t we get right into the elevator pitch for Railgun?

The TL;DR, without getting into the tech, is that Railgun is a suite of smart contracts designed to create a private address standard. Similarly to how Zcash works, you have the public side of Zcash and the private side. Railgun is handling the private side of Ethereum.

You can generate a new private address with your seed and use that private address just like you would a 0x address. A lot of the research around Railgun is about how to make it do everything a public address can do. How do you tap into the burgeoning economy on EVM and do that privately, without doxing your wallet? You can think of it as incognito mode for Ethereum.

I really like that. Incognito mode for Ethereum—that clicks for me. You’re kind of giving us an example, but I’d love to walk through a simple one. Can you do private transactions from—

Sort of any Ethereum wallet, like any regular wallet that I’m already using. Maybe I’ve got USDC sitting in an Ethereum wallet, and I want to swap it privately through Railgun. How do we do that from beginning to end, in steps?

2. How Railgun Shields Funds

Yeah, good question. You have your public address, maybe Nomatic.eth or something like that, and you can shield those funds into a 0zk address. You move the funds into a 0zk address, and from that point, that’s where the privacy starts.

Let’s say you’ve shielded USDC. Would you say USDC is your stablecoin of choice? Shout-out to Circle. You could take that USDC, shield it into Railgun, and from that point, you have privacy. You’ve shielded it into the smart contract. Mechanically, what you see on Etherscan is that Nomatic.eth has put funds into Railgun. Where those funds went—whether into their personal address, or maybe they were paying DeFi Dad, Alan, or someone else into their private address—is left to interpretation.

Then you can transact from that private address just like you would with a normal public address. You can use CoW Swap, for example, or integrate 0x. The list goes on, and you can perform that swap just like you would with any other address.

As for using it with a wallet, there are applications that have done this. There’s one called Faceless, where you can use WalletConnect to interact with it. There’s one called Token Shielder, and you can use it with wallets you’re comfortable with. Most people who use Railgun tend to pick a favorite wallet that’s already integrated it. That could be Railway, Anon, Terminal, or RailOxide [?]. The list goes on, and that seems to be the path most people take.

One question about that initial process you mentioned: I take my USDC and put it into this 0zk address. Would you consider that similar to a mixer? Does it resemble Tornado Cash, like sending funds to a Tornado Cash address, or is it totally different? Once I send it to that 0zk address, is everything private from then on—the actions I do within that address? Does that make sense?

Yeah. The primary function of a mixer is to break the chain of custody between two addresses.

That’s why you use Tornado Cash, right? You would take a fixed denomination of ETH—I think the denominations were 0.1, 1, 10, and 100 ETH—and put it in, then take it out on the other side. The goal is that you have these fixed-denomination pools: you can put 0.1 ETH in and then take 0.1 ETH out on the other side, and who you are among the thousands of people who have used this contract is unknown. That’s a certain form of privacy.

The challenge with that kind of mechanism is that it doesn’t work for a multitude of tokens. I still have quite the multifarious balance of various shitcoins I’ve accumulated over the years. I have NFTs and that sort of thing, too. Mixers don’t work particularly well for those or for novel balances. If you had a balance of, say, 13.243 ETH, that would be a very challenging thing to put through a mixer and send to a new address.

Instead, what Railgun is designed to do is be something you can think of as a safe. Inside that safe, you have a lockbox. You can put anything you’d like in that lockbox: it could be USDC, ETH, or DAI.

CryptoDickbutts, whatever you happen to be into—you can put that into your particular lockbox. Mechanically, what you’re doing is making a zero-knowledge proof that you have the right to spend from your lockbox.

There are similarities, just like apples and oranges are both fruit. By the way, I believe fruit can be compared. Saying you can’t compare apples and oranges is a terrible saying to me. You can totally compare them. But they have some similarities, while being pretty vastly different in how they work mechanically.

Once you deposit into a Railgun wallet, I have a few questions from a user standpoint. It sounds like you can deposit whatever tokens are supported on Ethereum. As long as a token exists on Ethereum, can I use it on Railgun? And once it’s shielded in my Railgun wallet—and forgive me if I’m framing this wrong—what can I do with it? What are people commonly doing with it? Is there access to something like swapping on Uniswap, or an equivalent? What are users most commonly doing with Railgun? Are they making payments to one another, or seeding a new wallet and waiting to withdraw from that wallet so it’s not obvious they just put 0.1 ETH into Railgun and used it almost like a mixer?

3. Payments and DeFi Use

Yeah, great question. I think the number one thing happening with Railgun is payments. People get paid in crypto, use crypto, and spend it. They might pay into a centralized exchange account to trade, or into a Hyperliquid account because they want to go long XPL or something like that. Who knows? The number one use case is the transfer of assets.

Anybody who’s been in crypto long enough has a lot of wallets because they didn’t want to tie them together. This is a way to address that for most people: they can take the 20-plus wallets they have and consolidate them into one nice balance, which they can then use and deploy into the ecosystem however they see fit.

Another thing people do is send someone a payment link and have payments made to their 0zk address, which I think is really cool. Someone might owe you DAI or USDT for something you’ve done for them. Maybe you bought them beers and they need to pay you back, or maybe you’re working in crypto and need to get paid. I think that’s the number one use case, because of how people behave in crypto. They have this voyeuristic thing they do, judging you on Etherscan after you give them an address, and that’s annoying.

When it comes to DeFi, it really depends on the wallet you’re using. Some wallets have integrations directly into the wallet. Anon, for example, lets you use your private balance to seed a Hyperliquid balance, trade on Hyperliquid, and then re-shield that back into Railgun. Via Anon, you can put money into any Morpho Vault you like. I think it has swapping through Uniswap directly, the 0x router, and a couple of different aggregators.

The list goes on. It can mint stablecoins, so if you have shielded ETH, you can mint fxUSD. The smart contracts themselves don’t really care what other smart contracts you interact with. It’s up to the wallet developers and the people building with these tools to understand what their users want and need, and judiciously build that functionality into their applications—for example, connecting to a DeFi front end and making a swap.

4. Privacy Sets and Limits

Alan, I want to talk about some of the limitations of Railgun today. One funny thing I see in my Telegram chat—and I’m not saying this is related to Railgun—is people saying, “Look, hackers aren’t using Zcash again. They’re using Monero. That means Monero is better. Why is Zcash even going up?” Then people bicker back and forth about why Monero is better than Zcash and nerd-snipe each other.

I guess what I’m trying to say is: where does Railgun end? What are its privacy limitations? I don’t think it’s a complete black-box scenario like maybe Monero is, but can you describe that?

Fundamentally, what you’re alluding to is something called a privacy set. That’s the level of privacy a particular system can afford you. With Railgun, it’s very high for a certain subset of tokens: stablecoins and ETH. That gets back to what DeFi Dad was asking earlier. It alludes to people primarily using it for payments: some people want to get paid in ETH, some want to get paid in stables, and people transact in those assets in Railgun.

For private transactions—that is, from one 0zk address to another, paying within Railgun—I’d say the privacy you’re afforded is very high. It’s incredibly difficult, if not impossible, to figure out who’s doing what and how in a transaction happening in Railgun, unless you’re one of the parties.

But—and this is a big but—if you’re going to trade the most obscure shitcoin you can think of right now, what would it be?

I think AI, maybe Artificial Inu or something. I think that’s what it’s called.

We don’t own this either. We’ll name tokens that we don’t own.

Yeah, not financial advice. But if you’re trying to shield Artificial Inu and put that into Railgun, your privacy set is presumably going to be weak. I haven’t actually looked; maybe somebody’s already shielded this token, but I doubt it. Your privacy set for it is going to be really weak because people haven’t traditionally been using it. There’s a cold-start problem for specific tokens that definitely has some rub.

The goal for the contracts—and I’ll add a slight caveat to what I was saying—is for Railgun to provide privacy at rest. The goal is for it to be a true wallet you can trust, with privacy, where you can put all your tokens and transact from them forever.

I was just looking at DeFiLlama, and it looks like there’s about $117 million deposited into Railgun. A few quick questions: first, do you have any sense of what the most popular assets are in those shielded transactions? Second, and this is probably a much longer answer, does anyone ever think to describe Railgun as an L2? I’m trying to understand why this is different. It feels like—

Yeah.

—you’re getting a kind of L2 experience.

Yeah. Two great questions. You can see the TVL of Railgun. Since it’s a smart contract, there’s Railgun on Ethereum, Base, Arbitrum, Polygon, BSC, and maybe more in the future. We’ll talk about Ethereum. You can look at Etherscan, see the Railgun smart contracts, and see that there’s around $120 million in TVL at this point. That’s really cool, and you can see the mix of tokens: ETH, USDC, DAI, USDT, and more.

You can see the makeup of it, and back to what Nomatic and I were just speaking about, you can determine a privacy set for a token by looking at that. You can say, “Oh, man, there’s $80 million of ETH in Railgun, so me using Railgun with my peasantly $150 of ETH is going to be totally fine. I’m going to have a great privacy set.” But if I see that there’s $300 of some token in there and I deposit $80,000 worth of it into the contracts, I’m going to have a really tough time not being assumed to be the actor behind those tokens as things go on.

What you can’t see is when a transaction happens between people within the mechanism. Let’s say I send DeFi Dad 100 ETH, or something crazy like that, because I’m rich. You wouldn’t know that it was me sending 100 ETH to DeFi Dad. The only thing you see is a state update on Ethereum. You don’t see that I’m taking it from my lockbox and giving it to you to put into your lockbox.

As for calling it an L2, it’s funny because if you get really heady about it—and maybe the cryptography types will find this funny—it’s basically like a state machine on a state machine. It’s not technically an L2, but you do have state that you’re maintaining for Railgun. What makes it really neat is that, because it’s not an L2, it has great censorship-resistance and immutability properties that an L2 won’t have. Sometimes L2s can be shut down, brought back, shut down again, or have their sequencer paused. That’s a big challenge with L2s, at least when they’re getting started. So, yes, it’s slightly different, but it is a fun way to think about Railgun.

Just on that note, fairly recently, as part of, I think, the Bitget hack, I think some of the funds—like, NEAR stepped in and stopped some of them from being moved around.

Yeah. Think of the capture rate for that. It was over 90%.

Yeah. I think this one was like $49 million. On one hand, I’m like, “Oh, sweet, great move by NEAR. Screw those hackers.” On the other hand, you’re kind of like, “Oh, a privacy protocol, NEAR, has the ability to step in and do things.” That’s interesting too, right? Those things don’t really sit together quite right for me, but I’m very conflicted at the same time. But, yeah.

I get it. For me, this is something I think about all the time because I hate a thief. I don’t like criminals, dude. I think stealing from people sucks. When I see something like NEAR, it’s a centralized protocol, dude. It’s a bridge. You’re going through Jim Bob’s S3 bucket, probably, right? It’s a centralized thing, and they stepped in and did something.

I think what happens in DeFi very frequently is we conflate all DeFi as being the same, and that’s just not the case, man. Their centralized service—that’s fair. It’s great. I use NEAR. It’s sick. It works really well, dude. They’re a centralized entity, and they accepted and did something. To me, that’s the right thing to do. I’m with you: that tears at me, because I don’t want that kind of mechanism when it comes to DeFi. But when it comes to centralized things like that, I think it’s totally fine. I think it’s a good thing.

I want to go back to Zcash for a second. We’ve kind of already touched on this, but maybe you could sum up, in the simplest form, how you’re different from Zcash. That’d be great.

A lot of the design language and architecture of Railgun definitely tip their hat to Zcash. I don’t think we make any bones about that. A lot of the premises, like shielding, come from that nomenclature. Railgun is effectively a Zcash-style shielded mechanism for Ethereum. There are a lot of similarities between the two.

What makes it different is that Zcash is primarily for ZEC. Now they’re talking about shielded assets and that sort of thing, which could come to fruition in the future and be really interesting. But as it exists today, it’s for ZEC. Railgun is designed to be that kind of shielded mechanism for ETH, USDT, DAI, and stablecoins. If we look at the transactions happening in crypto, the number one thing is sending stablecoins somewhere. People want to use stablecoins, and Railgun provides that for those users. I think that’s really the big difference: access to DeFi and stablecoins.

Alan, from what I’ve learned from you already, I look at the price disparity between something like Zcash and Railgun, and I’m trying to make sense of it or right-size that disparity. From what I understand, Zcash is just shielding ZEC, but you can’t really do much in that ecosystem, as far as I know. With Railgun, you can bring any asset into a Railgun wallet and experiment with it and use DeFi.

So to me, I’m looking at it like, “Hey, there’s a plethora of usability in the Railgun ecosystem versus Zcash.” This isn’t me trying to ask you, “Hey, why doesn’t the price go up on Railgun? Make number go up.” It’s more like, why that disparity, I guess, in your mind?

Why did Railgun start, right? Zcash existed in 2020. It was a thing; it was there. Tornado Cash was there, and it was good. It worked. But it wasn’t good enough for the use case, at least for people like me and how I exist in the ecosystem.

I think the reason Railgun exists is because mixers, while an enhancement to privacy, aren’t the end state of privacy. And while things like Zcash, to me, are great—and the ethos, you know—in fact, when the price started moving, I was so excited. I went out and, being a degen, dug out a bunch of old seeds to try to find where they were. I’ve used it. I think it’s cool.

The big difference here, though, is that it’s sort of at arm’s length from all the cool things I’m doing. I’m trading on Uniswap. I’m using Curve and CoW Swap. Actually, I’m using a lot of CoW Swap, admittedly. The mooing has totally won me over over the time I’ve been using it. I’m using vaulting mechanisms, staking tokens, and doing this and that. That’s where the economic activity is that I want to participate in.

The dichotomy we’re talking about is that Railgun lives in that burgeoning ecosystem, while Zcash is sort of at arm’s length from it. Tying in NEAR has made that arm’s length shrink back a little and made it easier for people to get into that ecosystem. But ultimately, it’s still something you have to move to. If you look at the research in Zcash, it seems like they’re moving more toward some kind of Zcash shielded assets, so we’ll see where that goes. But the ecosystem today is using stablecoins, DeFi, and Ethereum, so I want my privacy mechanism to be on Ethereum.

5. Using Railgun With DeFi

One thing I’m a little behind on: normally, I like to play with applications to learn that way, rather than trying to read up on them. I truthfully don’t know where to look up what applications you can use with Railgun.

Am I able to experiment with any DeFi application and make use of shielded funds in Railgun, or am I limited to certain DApps that have an integration with Railgun? How do you approach that as a user?

Yeah, great question. Currently, it’s really up to the people developing wallets around Railgun to integrate things. If someone’s listening and wondering which one has the most stuff, it’s Anon. Anon has most of the DeFi features you might want.

You can interact with Morpho. You can deposit into any vault you’d like from Anon, which I think is really cool. You can do swaps through a litany of different swap providers, and you can mint stablecoins. I think the one you can currently mint is fxUSD. They have farming, and you can interact with Beefy. There are a couple of other things I’m probably missing, but suffice it to say, it’s a curated DeFi experience at this point.

One of the big research projects we’ve been trying to wrap our heads around in Railgun contributor land is how to do that seamlessly. We developed a research project called Railgun Connect, and it’s designed to let you arbitrarily connect a Railgun balance to any DeFi mechanism you’d like. I think that’s coming along well. It’s a very tricky thing to do, but a lot of the research we’ve done has made it much easier.

With AI, it’s going to be really fascinating. Maybe you’ll have a really cool, agentic experience where you can seamlessly tap into any DeFi. But that’s a “soon™,” not a do-it-right-now kind of thing.

Alan, we were joking offline. I asked you to send me a few things you wanted to talk about before this, and I was saying, “I usually ask for stuff, and people don’t send me anything.” You sent me a literal novel on things. We probably won’t get through all of it on the podcast, but I’m super thankful you did your homework. Nobody ever does, so kudos. One of the things you wanted to talk about was wallet privacy versus application privacy, and where that privacy should live on that spectrum. Maybe talk to us a little about your views on this.

Yeah. I’m not sure if it’s controversial, but my hot take is that the privacy that really matters in crypto is wallet-side privacy. That is to say, actor blinding, peer-to-peer blinding, however you want to phrase it. Whenever I transact with DeFi Dad here and send tokens to him, presumably he’s like any other DeFi user: he’s going to immediately open Etherscan and proceed to judge me.

He’ll look at my token balances, maybe click on the address that funded that address, and do the random walk we all do on Etherscan. He’ll think, “Oh, man, he uses Kraken. Oh, you’re a Coinbase user. Oh, he got this airdrop. Oh, he has a Milady.” You make all these jokes to yourself as you judge this person online. It’s a voyeuristic experience. We make fun of it, and it’s cute. You think, “I’m more OG than him because my wallet is 1,800 days old and this one’s only 300 days old,” or whatever.

I think that kind of thing is broadly bad for the ecosystem, and it limits the usability of crypto. That’s the space researchers want to solve: how do we give wallets that privacy? How do we make it like PayPal, bank transfers, or using your Visa at a coffee shop? The only thing they see on the little terminal is “Approved,” and then they hand you your coffee and you go about your business. They don’t know how much money you have in your bank account. They don’t get to judge you or say, “I see you’re late on your mortgage.” They have no idea. It’s none of their business. That’s what we need in crypto payments.

The place I’m not too excited about putting privacy is directly on DApp mechanics. I don’t want to say I fear it, but I’m not really excited about it because one of the coolest things about crypto and DeFi is that I can verify what’s happening with a DApp I’m interested in. If I want to see that Aave’s loan-to-value is healthy and what I expect it to be, I can look. If I want to know that a certain vault is paying out in a certain way, I can look and know. If I want to see that something’s truly decentralized and not held by a multisig, I can look. You have this great auditability, and it’s easy.

I fear that if we make DApps a black box, I’m going to have a really hard time, as a plebeian user, verifying that the AMM I’m going to use—or whatever the swap mechanisms of the future are—has the liquidity I want, and knowing that it’s doing the right thing is going to be incredibly challenging. Before I finish, to any of those obtuse math nerds who say, “Oh, well, you can do it in FHE or something like that,” I don’t want to have to be a cryptographer or have a PhD in mathematics to verify that kind of thing. That adds a certain trust element for me. I have to trust a nerd; I can’t just go and look. That’s the side of privacy I’m not very excited about.

No, this resonates so much. When I try to explain how radical the transparency of DeFi is to friends who aren’t as familiar with it, it’s hard to comprehend. Imagine you make a Venmo payment, and then you can see their entire financial history. You can see what they pay on their mortgage, whether they have a life insurance policy, and every stock they ever traded.

Again, you can obfuscate some of that with different wallets. You can use a combination of DeFi and maybe a centralized exchange. But at the end of the day, it’s a little insane.

Do you guys remember Venmo, where you could leave a comment on your payment? I’d send 15 bucks to Nomatic, and it’d be like, “For the beers,” or something like that. My friends and I used to put the most obtuse, ridiculous things in there because it’s embarrassing; it’s a public little stream of what the payments are for. We’d just be obtuse, like, “Oh, thanks for the drugs,” or whatever.

And the funny thing is, as you’re doing that, you know that the way we’ve been using DeFi, it’s been that transparent. As much as we’re kidding around about looking at someone’s wallet after they send you money, we’ve done that. I’ve definitely looked to see what else someone has, especially if it’s a friend you trust or an investor whose success you admire, and you’re trying to figure out whether they’re holding certain tokens. There are some benefits to being able to do that.

I love your argument for why we need privacy at the wallet level versus the DApp level. It makes a lot of sense that you still want some transparency so you can verify where the funds are in a vault and where the yield sources are. I know the average person probably isn’t looking at that, but it’s important to have that data available so we can have verifiability driving DeFi forward—not “trust me, bro,” but reimagined as some Frankenstein thing—

Yeah, yeah.

—on a blockchain.

Or even worse, it’s “Trust me, bro, I’m a mathematician.” That, to me, is an equal “trust me, bro” kind of statement. I think that’s frequently where a lot of the brainiacs in the space go. They say, “Oh, well, I can verify this in a fully homomorphic encrypted way.” Cool, you can do that. I have no idea how. I know how to go to Etherscan and look at the TVL of a contract. I don’t know how to do some sort of advanced, encrypted mathematical computation.

That’s not my thing. If we raise the barrier to entry for verifiability, it’s going to be incredibly difficult. Imagine for a second that your SEC filings—a company’s 10-K statement—required some crazy encrypted computation in order to review them. The SEC would be like, “Nah. We’re not doing that. We’re not playing that game here.” I’m not sure we should play that game in DeFi either, at least not yet.

You know what, Alan? I wanted to get to some of the things you guys are doing at Railgun and the Ethereum Foundation. We had a lead Ethereum researcher on to talk privacy with us, and it seems to me like there’s a lot of overlap and collaboration. I want to delineate how close that relationship is, and how Kohaku, the Ethereum wallet the EF is building, is working with and integrating Railgun. What does that working relationship look like?

It’s very interesting. From a selfish perspective, when I started contributing to DeFi in 2020, I didn’t think I’d be hanging out and chatting with people from the Ethereum Foundation. It’s pretty cool. It’s flattering and validating that people of that caliber care about the kind of thing I’m working on.

It’s been a fun collaborative effort. What’s really interesting is that Railgun is a big decentralized effort. You have people contributing from teams like Chainway, out of Turkey, who helped write the private proof-of-innocence mechanism for Railgun. There’s a team out of France called ZKNOX, and they wrote really cool hardware support for Railgun. Then you have the Ethereum Foundation writing the Kohaku SDK, and then there’s the Railgun Reloaded SDK. And then there’s the RailOxide SDK they custom-wrote for their wallet.

It feels truly decentralized, but there’s certainly a lot of interesting coordination. It’s been fun to understand the requirements of the people contributing to Kohaku and what they’re looking for from Railgun, and to figure out how we can enhance what we’re doing to complement that. I’d say they’re standing on their own and building their own thing, and it’s garnering some success. We’re starting to see more things built with the Kohaku SDK that integrate Railgun smart contracts, which is exciting. Most notably, I think Ambire is going to release a Railgun-integrated wallet soon, and that’s really cool. I’m not sure if that answers your question, though.

I also wanted to follow up on the other point of confusion: Is the EF competing with Railgun? I think you might have explained that by saying Kohaku is integrating Railgun smart contracts. Maybe you can illuminate that a bit more, because sometimes I’m watching this as a non-technical person, thinking, “Is the EF just going to bring in all its own privacy tech, and then the people who’ve been building in privacy are screwed?” It’s like some of the cross-chain teams I saw working: “Is the EF just going to do its own cross-chain finally?”

I think the answer generally is no. From my perspective, they’re finally stepping up and trying to build SDKs that show how to use the primitives that exist on Ethereum, while also leaning into a lot of the new things they’ve been shipping in EIPs. We’ve had account abstraction for long enough, and people aren’t really using it, or at least not to its fullest extent. I’m biased in saying that, so don’t @ me. Suffice it to say, I believe what they’re doing is complementary, not in competition with Railgun.

I don’t think the EF is trying to get into the DApp-building game, because that would probably be pretty doom and gloom. If you’re building an ecosystem and then start competing with your ecosystem, you’re probably going to create a pretty large vacuum. I think people would leave and build elsewhere. Why would I build on Ethereum if, once I got big enough, they were just going to compete with me? From a self-preservation perspective, I don’t think they’d do that, because it would be pretty bad for Ethereum.

6. Privacy as a Default

Alan, based on what you’ve shared, I’m trying to come to some conclusions: Will privacy become a default setting for us in DeFi, or will it look more like a toggle switch? Is privacy going to be a destination that we opt into as users, or do you envision it being more of a default setting?

I spend a lot of time thinking about that question. I spend a lot of time on that exact thing. I think the answer is yes and no. It’s both. Allow me to expand on that for a second. I think privacy is a stack, and there are a lot of different points of privacy. I’ll try to tie this into an analogy with a browser.

If we look at the state of the internet from 1994 until about 2016, the little “S” at the end of HTTP wasn’t as ubiquitous as we expect it to be in 2026. In fact, most browsers would say, “Warning: the little S isn’t at the end of HTTP.” That’s expected. People go back to safety. They say, “I’m not going to use that website. It doesn’t have SSL encryption on it.”

I think we’ll have something like that. But will there be an incognito mode? Incognito mode isn’t always on; you have to hit Control-Shift-N or use the hamburger menu in the top-right corner of your browser to go into incognito mode and look at flight information. I think that’s really cool: you have that optionality. There’s even more optionality on top of that, like a VPN. You have the “S” at the end of HTTP, SSL encryption, then incognito mode, and a VPN on top of that.

I think the same kind of stack exists in crypto. For example, I think we’re going to have privacy against the mempool. I’m sick and tired of feeding Jared from Subway. I hate getting front-run and sandwiched. I hate people searching the mempool and reordering my transaction because it’s public, and they have a clear strategic advantage when they scan it. I don’t like it, and I think that’s going to be a standard form of privacy in crypto.

I think we’re going to have privacy against RPCs. We’re starting to see some really cool research from the Ethereum Foundation. I think it’s called AnonRPC. If you look it up, you can see that it lets you pass RPC calls over Tor, for example. I think that will expand and become easier, and the latency will erode away. Privacy against your RPC will become obvious. I think that sort of thing will flourish because that’s what institutions want and need in order to come into the space. They don’t want a public mempool where they can get front-run, back-run, side-run, left-run, or whatever. They don’t want to get wrecked like that.

And we don't want to be monitored at the RPC level either, right? Because even if you encrypt the mempool without private RPCs, you're still going to get heuristically wrecked by people who are running those. I think that's probably a given, right? That's the yes: we're going to have that privacy baked into all different wallets. Something like Railgun would exist as incognito mode that you can toggle on and off for various things.

Privacy isn't about hiding everything. To me, it's more about self-selecting what you reveal to the world. ENSes are cool, you know what I mean? I think there'll probably be a public persona that you project, and then a private balance behind that.

Alan, I was just sitting here thinking. We talked to you about this before we started recording, but can you explain the utility of the RAIL token again? You said, “I think a ton of it is staked.” Can you remind us how much of it is staked and why people are staking it?

A lot of it is staked. In fact, when you look at the top holder of RAIL, it's the staking contracts. It's like 70-plus percent of the total RAIL out there in the world. The reason people stake it is to participate in the security review of proposals that happen to the system. Certain bits and pieces of the mechanism are upgradable, so you can vote on those sorts of things.

The most recent proposal that came up was whether Railgun should get deployed on Base. People review the deployment on Base and make sure it isn't backdoored or something like that, and then they vote yay or nay. They're basically guardians of the Railgun ecosystem, if you will. That's really cool. People do that because they care about privacy, maybe use Railgun, and want to defend it from bad proposals.

The other reason I presume people stake RAIL is that it also pays out active rewards to people who are staking. If you have voting power in this security voting mechanism, you get yield from doing that. That comes from the Railgun treasury, which collects fees on transactions happening to and from Railgun. It takes basis points from those transactions, and that goes into the treasury. Every 2 weeks, it scrapes off rewards for people who are staking the token.

It's been a pretty good year. I think it'll probably end the year at just over $2 million in rewards to active stakers. That's what people are excited about.

Guys, I think this is a great place for us to start to wrap up. Alan, thank you so much for coming on with us. I feel like you've been working on privacy since before it was ever in vogue. We really wanted to cover Railgun because we felt like we were overdue to cover the important work you're all doing on Ethereum. We'd love to have you back in the future, and I want to give you the final word here before we go.

But first, thanks for having me. This is fun. I like having good conversations like this, and I appreciate it. I would love to come back. There are some things we didn't talk about, like the future of privacy and the whole post-quantum thing.

If people are listening to this—I don't know if you post it on Twitter or something—and you guys want to hear about the future of privacy and the whole post-quantum thing, we have some great takes on that too. Maybe we can do a part 2 at some point in the future. In terms of last words, one of the cool things I always like to say is that Railgun’s a decentralized project. If you’re a developer, do research, like cryptography, think privacy is cool, or are building a wallet and looking for a feature to add to your wallet, Railgun’s a really cool thing to use. There are a bunch of different SDKs: Railgun Community, Railgun Reloaded, and Kohaku, the Ethereum Foundation’s privacy SDK, which has Railgun in it. I think that’s a really great SDK as well. If you’re a privacy builder, or even privacy-curious, drop us a line on Twitter, @ me, whatever. There’s a Telegram group called Church of Railgun where we hang out. We’re all privacy nerds, but pretty easy to get ahold of, so come hang out.