Firo | The fight for the middle ground in web3 privacy - Reuben Yap | ETHDam III - 2025

Welcome to East to Eg. Hello everyone. Uh I'm Reuben. I am the project steward of uh FOH. We have been we used to be called Zcoin.

We've been around since around 2016. So uh today my talk is about you know fighting for the middle ground in privacy because increasingly you know we're going towards like very maxi views you know one is like ultimate privacy any sort of compliance is you know an attack on individual user freedom and on the other hand you have this full compliance mode they want to be very intrusive give all your KYC data and like you know being someone in the privacy space uh So, I've been in crypto since about like 2012, 2013. And a little bit about myself before going full-time in crypto. I was actually a lawyer for 10 years. And then after that, uh, you know, I actually ran a VPN business and I was cracked down, you know, even recently like my bank accounts got frozen.

So, I've been in on both sides, you know, both on the regulatory side and on the side of, you know, doing the right thing, doing legal things, but being on the fringe and being censored. So obviously I see the benefit of both. So yeah, today this is about the talk of fighting for that middle ground which often you know was seen as sellouts. We're neither here nor there. But I want to kind of express why I think this is important.

So now this fight is actually much more important than before because like right now we have a bunch of really like bad not really bad regulations but regulations that are very intrusive like for example okay we have had the financial action task force the travel rule we've been around that there are ways to navigate around that that's you know already coming into force we have the markets and crypto assets regulations which specifically dealt with privacy assets mixers and coins uh that's already mostly into force and obviously now the big one which I think you've probably seen in a couple of days ago is like oh EU is banning all privacy coins which is uh the anti-money laundering regulations which is I think is coming into force in 2026. Now, uh disclaimer, although I'm a lawyer, I am not an expert in this law. So, you know, take this, you know, ask your lawyers for for advice on all of this. And this is actually quite scary because we've seen like uh you know, just a couple like one or two years ago, we've seen like crackdowns on tornado cash, samurai wallet, and a lot of people now with the Trump administration say, "Oh, no, it's fine." You know, everything's okay.

The sanctions have been lifted on to cash, samurai wallet. they are, you know, the actions being dropped against them. But it's actually something that's really alarming because, well, first of all, I mean, it still hasn't been answered whether the the developers are actually responsible for the money laundering through tornado cash. The only thing that has happened is they're saying that you can't sanction a smart contract. So those very key questions of whether the developer can be responsible has still hasn't really been sufficiently answered.

And you know just imagine you have a change of administration if Trump goes out of power or like changes his mood or something like that. this all can change very very quickly right and you know obviously this continuous infighting you know like Zcash Monero people still hate each other and it's like uh we should be like you know working together to come up with common standards to have a common front but instead everyone's like kind of crapping on each other which you know privacy coins privacy assets are already like I don't know less than 1% of the market and now we are like fighting among a little piece of pie which I think doesn't help the whole thing. And we've seen like just in the past two or three years, we've seen like rapid delistings of privacy assets uh from many exchanges like OKX, we saw Binance deal, Monero, we got delisted very recently and this is a trend that's going to continue especially if we don't address a lot of this like negative feedback that's addressed to privacy. So I I know the words are a little bit small but you know uh basically the in short you know there is a privacy spectrum right one which is like maximal privacy where you know we're not going to be playing with regulation we build what we think is necessary mandatory privacy no compliance whatsoever and you know that's uh well it's a position to take one that I actually support but there's also like the middle ground solutions such as like Zcash hash what people are doing with the rail gun and privacy pools and you know fo we we've done something with like exchange addresses and this is kind of like well we don't want to have like back doors we don't want very intrusive KYC requirements we don't want to have like inbuilt KYC into like at the protocol level type of thing but here we are still allowing exchanges some tools to make it easier for them to comply because exchanges want to comply you know it's basically a costbenefit analysis to them and we to make tools easy for them to use. So that's kind of like the middle ground where we are not compromising to say like we're going to build a back door or something like that.

Then obviously you have the you know I guess the more regulated side where now you know every we want to see your flows. We will have uh certain keys that can open it if regulators want to see it. Everything has to be KYC and whatnot. I mean sure there are still use cases for this. For example, if you're institutional and things like that that kind of makes sense.

Uh but I think for the average Joe and it's also like very bad for UX and stuff like that. So yeah, this is kind of like just showing the spectrum. So again, you know, as I mentioned, like privacy is becoming, you know, very binary and we kind of just want to like, you know, dismiss some of this myth, right? Because a lot of times you say, "Oh yeah, you know, if you have transparent addresses, you're not a privacy coin." Or if you have like a certain type of features, you you are sell to privacy, right?

And that's not true. Like, you know, even if you use Zcash or something like that, if you have a shielded the shielded transaction, it's pretty private, right? Sure, there are some ways that you can leak information, but it's not correct to say Zcash has no privacy, right? Uh so this is like kind of silly. So another thing is that you know oh yeah we have to make everything transparent isn't that what blockchain is about no actually you know because we didn't have the tech to enable privacy which is why we have this transparency on blockchain because we need that v ver verifiability but the thing that we actually really want I mean like I would say maybe 80 90% of people want we want privacy for everybody but we don't want bad actors you know illicit activity to be actually used in this privacy thing.

I mean, of course, you know, there's some nuance. You know, some some activity may be illegal, but not actually bad, but you know, we don't want terrorists to be using it. We don't want like really bad sort of stuff being used for privacy. And the idea, of course, maybe it's a bit utopian. It's a bit like naive, but it's a goal to achieve, right?

It's something that we look, we want to have privacy for the average Joe for most people, but we want to keep back actors out. So that I would say is the kind of goal that we should be aiming for. Now obviously because of this binary kind of a talk especially like you know with you know like Monero being the biggest privacy coin they I think also one of the loudest in the privacy space uh there is kind of like an issue that when when everything's becoming too extreme right so right now you know a lot of these people like okay like Monero you know dark they're like you know let's totally abandon regulation we'll build our own little circular ecosystems you know where we cannot be stopped with uncensorable and all of that and that's fine you know that will continue to exist no matter what but it will also be a much smaller crowd it's going to be niche right and you kind of like become like little silo silo liquidity places very niche and that's okay but it's also means that you deprive yourself from you know being having access to the masses we have to understand that if a privacy coin has ramps to to to fiat and all of this it makes it a lot more useful. There's a lot more liquidity on centralized exchanges. That's something that actually helps privacy adoption.

But sure, we also should have this kind of like uncensorable things. But at the same time, whenever these type of tools get used for illicit behavior and we can say, oh yeah, no, it's just a protocol is working as a design. We actually feeling like this regulator saying like, oh yeah, privacy coins is used for illicit activity. Every time we see the, you know, like privacy being mentioned in Cointelegraph or whatnot, it's always like, oh yeah, you know, North Korea use this, oh, some hackers use that. It's never like, oh yeah, you know, I'm just I'm sending something to my mom and I don't want people to to learn.

That's that's not newsworthy. But every time we see privacy is being associated with negative behavior. And because of this we have very very strict regulations that come on you know the slap on and it's actually like like for example like um you know South Korea they banned like entire all privacy coins. Japan banned all privacy coins because of a hack of an exchange that was using a coin that didn't have privacy features. It was called NEM.

I think it was way way back and then they banned privacy coins even though there was no proceeds that were used uh to actually launder into any sort of privacy assets. So you know we have to treat it I think it's better to think of privacy in a nuance fashion and we also have to realize that the the opposite to say oh yeah let's do like KYC even if we talk about zk KY KYC credentials and all of this all of these solutions require someone to still hold your KYC details and credentials they still can be hacked it's a crappy uh UX you know every time when I want to use an exchange now I'm like oh yeah look up look down open your mouth ah you know it's not a great experience Right. So let's try to treat it like you know in in a kind of moderate fashion where yes we want to prevent bad actors. There may be some sort of blacklist that needs to be done but not something that's super intrusive that we have to give out all our data. Now another very common myth especially those promoted on the more maxi side is that oh yeah you know criminals use us there because we work you know I think that's a really really horrible thing to be saying.

first of all is giving ammunition to those that want to fight privacy to say yeah look you know privacy advocates are all about you know illicit activity which is a very easy thing to fall into and more importantly it's not even true criminals use whatever is the most convenient and the most liquid you know we have seen so many times like the Bitfinex like in 2016 the hack I think they just use some like centralized coin laundry which you know the the people actually managed to trace the flows, right? Even like the tornado cash that they did like quite crappy. They like kind of consolidated into one deposit address which meant that even when they went through tornado cash, they still could be tracked and even recently like there's things something called pig butchering scams where you know they people pretend to be pretty people and like you know do some love scams and they all were using USDT on Tron right which had no privacy. So it's very clear that criminals just use what they think is good, not necessarily it's actually good and they make a lot of mistakes, all this obsac stuff. So let's stop talking or championing any sort of use of criminals.

Even if it's true, we shouldn't be championing it. And it's actually like a very small proportion of actual privacy usage. Now just uh you know I wouldn't go into the details of like what exactly regulations require but uh you know they require a whole bunch of things maybe some of these things are not right but this is what the laws that are coming into force or are in force already right they want to know who you are basically sender receiver right they want to know where it's from they want to show the transaction history maybe the entire transaction history right they want to have blacklist checks you know make sure it doesn't come from a sanction or hack funds and all of this and they want people to keep records. So like that's it in a nutshell and I guess like Mica FATF M are like the kind like main regulations that crypto companies are worried about. So this is just a a brief overview, right?

But the thing is that you know some people are like saying well you know you come out with kind of like a like a compromised solution when these new regulations come into force you know maybe it would not be accepted but the thing is that buying time has it actually own benefits right so so because you know centralized exchanges and all these swap providers and all of this they still form I don't know 80 90% I mean I'm plucking this figure out of the thin air but I'm really very sure that most of This still goes through centralized crypto ramps and stuff like that, right? And even if these compliance measures eventually fail, it buys time for us to build proper decentralized tools, right? Because we need time. These type of tools, especially more censorship resistant ones, tend to be a bit harder to build because you have, you know, you have to have the P2P network, you have to have all this sort of censorship resistant. It tends to be a worse you user experience.

You need time for people to learn, educate, and get used to that. So, but even those that are like currently sens that claim censorship resistance, they're not as censorship resistance as they think they are, you know, often often like, you know, after we were talking about like Havana RTO that's being used by Monero where all the arbitrators are run by the same uh admin keys, you know, it's it's not ideal, right? So again uh you know we would like to say like yes there are some compliance measures that may be a bit half it may not last in the long term but if it buys time it is still some benefit towards it and example of this is something called exchange and tax addresses which was something that um so Binance I think I can't me remember the exact year but they were under a lot of pressure from European regulators and also the department of justice this to crack down on privacy coins, right? And they were on the verge of delisting all privacy coins. Uh you know, even some of them fake privacy coins that didn't have any privacy, but you know, like Verge, like it doesn't have any privacy.

It's totally onchain. But then because Coin Gecko says it's a privacy coin, regulators say, "Yep, let's include that in the list, right?" And then all these fake privacy coins say, "Oh, actually not a privacy coin." But I mean, that's a a separate thing. But the thing is that Binance went through this list and started saying that do you have any plans to remove your privacy and they they asked us and we were like no and then say okay noted and I was like wait a minute you know this doesn't look very good right and uh we were also trying to contact the other coins that also had like a similar thing like Zcash Pivx and all of this and Zcash was actually at that time pushing like oh Binance why don't you use our view keys you know that will comply and operating all of this, right?

But Binance wanted very clear things and I'm not saying that, you know, that we should be listening to Binance and all of this, but these are the this is the way their legal team at least kind of said that this is the way that we can kind of comply with Micah kind of comply regulatory uh the concerns and pressure that's on them and they didn't want any sort of direct touching of shielded funds. So that means like let's say if you have a Zcash shielded pool, they didn't want you to unshield towards a Binance address because then they like oh well where did it come from? We can't really say. I mean yes we know that it's to this particular account but we can't show that. So that's something they didn't want.

They also didn't want it to go to any sort of like you know from Binance into a shielded address. Right. The other thing is that they wanted to be able to refund to the address that sent the funds. So like you know it's very easy with Bitcoin right Bitcoin or Ethereum I send address I send a deposit in everyone can see yes address A send to Binance right and if if Binance say like oh I not really I don't really like the taint of this uh funds I'll just return it back straight and that's easy because we know where the source is with with privacy coins like for example FO Monero or like let's say if you're using a Zcash shielded address you don't have that you can't return it because the source the the the sender is not clear, right? So then they would have to ask the the person and say like hey uh can you give us address to to send it back to and that could be a third party address uh unless you you showed a proof of ownership that yes I actually control this address but that's like too much work for for for an exchange to deal with.

Just imagine like you know let's say like we are small coin then they have to have all this additional compliance tooling to to just deal with this. So the easiest way is to say okay force them to just use transparent addresses so that when every sort of deposits go into the exchange they can just return just like in bitcoin right so what is exchange addresses and tax addresses so we actually you know through negotiations with the legal team and stuff like that I proposed this idea to say let's have a address type that's main meant for exchanges only of course anyone can generate it but who would want to generate this and it will be enforced on the protocol core level that it cannot accept any sort of unshieldings directly. It can only accept uh deposits from a transparent address. So that means that let's say if I have funds in a shielded pool or like in inferial smart pool, I would have to unshield to a transparent address first and then deposit it into Binance, which does at least satisfy the ability to refund because they don't have to ask any sort of ownership proofs and all of that. And you know it does satisfy like a few things like you know ability to show transaction history.

I would say that's a bit of a gray area but for the moment that satisfied their requirement. So we actually managed to like get avoid the D-listing then you know Zcash still you know we got slapped on with a monitoring tag both with Zcash uh and yeah Zcash and Furo I think were the main ones. Mobile Coin and Monero got delisted. Pivax for some reason never had a monitoring tag on. It's it's all because like regulators focus on particular private coins.

But obviously this this kind of thing is like well it's kind of a a trade-off solution. It's not particularly elegant but it solved the issues of the day and it bought time right. And obviously there's certain trade-offs. you know, we we obviously prefer to have a privacy on by default, but it allows exchanges to at least operate in a at least a a compliant manner that regulators will get off their back for the moment. Another example I would say you know as I think that's very like gaining traction in the Ethereum space is the idea of privacy pools and privacy pools are quite simple in the well not simple in the sense in the idea that you're basically you know attaching a zk proof to say that ah yeah my funds came did not come from any of these sanctioned addresses right and like for example with like railway which is the main wallet for rail gun uh which also uses privacy pools It has all these lists like OFAC, chain list, trm feeds, all these blacklisted addresses and whenever you deposit it actually locks your funds for like 1 hour before you can do any sort of uh transactions with it and obviously has the auto return of blacklisted deposits, right?

Uh obviously there are some concerns here, you know, in the sense that well first of all they call it proof of innocence. That means like everyone's like assumed to be guilty but until unless you have this proof of innocence. So there's some philosophical issues there. But at the same time you know who controls this list you know and these lists are basically controlled by these companies they have a lot of power. Will it go past that like you know maybe they'll start abusing it for other things and doing arbitrary freezes.

But look, it's it's a trade-off, right? And in a way, at least you can say, all right, like we we prevent the worst actors from using something like rail gun. It can continue to operate without the kind of overheads that like tornado cache has. So again, you know, I would say a middle is a middle kind of solution, which is decent uh and actually like the user experience. I don't know if anyone has used privacy pools.

I have I really hate it but uh you know it's a necessary evil like when you click on it the thing runs and your your computer has to start calculating these proofs of innocence. It can take like 20 30 seconds and then you wait for it and every time it syncs you have to receive these proofs and verify all these things. It's not a great user experience, but if it gets regulators off to say like, "Oh, yeah, this is kind of all right." Okay, I can deal with that. But that's one of the trade-offs.

So, I guess like, you know, a lot of people say like, "All right, you know, let's kind of like, you know, screw compliance. We can deal with our own like P2P decentralized methods, right?" and a good thought and experiment, you know, Monero being the like the number one like I would say uh privacy coin in terms of market cap and maybe even like liquidity and adoption. Uh you know what if it lost all its major centralized exchanges today, right? Obviously, you know, when they lost their Binance uh listing, you know, it was a big hur look, we can survive without centralized exchanges.

And sure, Binance was a big exchange, but it wasn't the only one. If you take a look, you know, what if it lost Kcoin, HDX, Kraken, all at one go, what would actually happen, right? So, let's just take a look at like this was I think taken two or three days ago. Um, you can see obviously, you know, obviously with decentralized exchanges, some of these are like wash trading, right? But let's just take a look with a grain of salt like cool coin 42 million 28 uh 24hour volume and you can see even most of the exchanges here even if it's uh you know a wash was traded it's like three four five 6 million 2 million all of this trade ogre you know 7.

5 million right so it's quite substantial right now let's compare to the actual P2P options that are being used today for monero like bis bisque, right? We we always talk about using bisque. It's 350 to 650,000. Ret swap Havana usually 150,000 and they had like some kind of fee rebate. So recently it's been hitting 1 million to 2 million uh uh a day which is not bad.

And unstoppable swap which was like oh yeah atomic swaps on Monero that's like really like 20 to 60,000 almost hardly anything. And this is for like a multi-billion dollar market cap coin. Can you say like you lost all these main rails will this be able to take over? And let's say okay even like the the number one leading one is like Retto swap Havveno Retto right now. This is actually like you know it's not as decentralized as you think it is.

You know there are ways that because the RTO swap people run the arbitrators they can actually steal funds. So it's not ideal. Obviously, it will get better as more people use it, but we are not ready today to move to all these options. I think that's just kind of the point that I'm trying to make, but I'm not trying to scrap on the people who who built for the extreme, right? Like, you know, projects are Monero, Darkfy, you know, they just say, I'm going to build what's maximum privacy and not care about regulation.

And this is actually important in the sense that look you know yes it may mean that they remain niche but at the same time like for example something like tall right how many of you actually use to on a regular basis I mean I use it sometimes but I would say like what once or twice a month or something like that but it's still for the people who use it it's really really important right so as as I mentioned there privacy coins may be a small percentage of that volume but 100% vital for those people who need to use it. Right? And again we should not be just looking at freedom tech that you know should be evaluated by oh you know how many users it is but how does it serve the people that really really need it. And in a way by having solutions like this it also allows us in the middle ground to be like negotiating from a position of of strength to say like look if you're going to crack down on us we're going to go more dark and then you have zero insight. So like for example in like Monero uh when a lot of like centralized exchanges they were I I can't quote who but there were people that were speaking towards uh like US regulators they were saying well you know when we start delisting all these things from from the centralized exchanges we actually lose more sight about what's happening in the Monero ecosystem when with centralized exchanges they could still get certain types of information right so in a way they pushing the extreme also makes those in the middle ground in a kind of like better position.

So, you know, kudos to them even if it rains niche. Uh but they have their role to play. So, I guess in the end, you know, what I'm trying to say is that look, we are all building for privacy, right? And we should be championing those that are also fighting the middle ground, you know, as as as unsexy as it may become because it's easier to say max privacy, I don't care, screw the government and stuff like that. is much more meaningful rather that ah let's try to find compromise that's very unsexy but that's the reality right reality is that seldom the extremes wins it's always the middle ground that generally gets adoption right and sure you know we still need the maxis they they pre they are the ones that will be kind of like the backup generator if everything kind of fails right they play a very very important role so at the end of the day we are all in the same boat we are championing different ways ways to attack the privacy issues, but we all fighting for the same thing.

So, we should be cheering everyone on. So, yeah, that's I guess the main part of my talk over uh you know, you can this is like some of the research that I do uh not I do, my project does. This is where you can find out more about us. We built some cool privacy protocols and yeah, I just want to remind people that the to the fight with the tornado cash paper is not over. You know, I think Alexi Perzv is still in trouble in in the Netherlands.

So, don't forget about them. You know, everyone's especially like the more like, you know, don't people who don't really follow it. Oh, yeah. No, it's not soft yet. You know, these people are still in trouble.

We really wish them the best and uh you know, continue showing support for them. So, that's the main uh for my talk if there are any questions. Yeah. Yes. Let's give a round of applause for Reuben.

Yap, guys. Amazing, amazing talk, man. I really saw that you spoke from the heart there. Very important and very interesting, especially from a privacy and legal standpoint. Thank you much for that.

Uh there are two questions um that I saw that popped up. One of them was um yeah, so how do we work together for example with the Monero and Bitcoin? How do we work together to make sure that we you know can have a better future in that case? I it's not so difficult like for example Fo and Monero like at least our research teams have collaborated you know and with the privacy protocols we've discussed ways even like they have like a working group about uh policy and stuff like that even if we may not totally agree just having like open dialogues with each other and saying like okay this is the things that we're going to pursue and you know if they are supportive of it I think that's like it may sound like a bit nebulous it's more about the small things you know like rather than every time when we see a Zcash guy, the Monero people smack or like the Zcash it goes vice versa, right? And yeah, it makes the communities not want to work with each other.

So I think just being more decent people honestly and they are actually ways to to collaborate like for us so just having to listen to the other party like respect both approaches and not like you know crap on everything. Yeah. Uh second question is that actually a lot someone said most money laundering is also done by so KYC details you know because at the end of the day uh yeah you know you do KYC it gets hacked Russian or North Korean hackers specifically have the you know the KYC details and they can make use of that to create accounts or whatever the case may be especially with AI like facial recognition and stuff like that could be easily generated. So yeah, the whole point of doing KYC then kind of loses its focus. Yeah.

Yeah. I mean that is also true. But actually the main way for money laundering is not even about KYC thing. It's about trade based money laundering where they are trillions of dollars if I'm not mistaken that goes through trade-based money laundering where you doing like fake trades and mocking up stuff. That's actually the major way to do money laundering and I don't think KYC solves any of that.

But I mean obviously now you have more intrusive KYC thing. They have the livveness check. They have the facial stuff that goes some way to mitigating some of this uh so KYC details but it's still a problem but I would say it's not the biggest problem for money laundering and quickly we can jump on the BTC and lighting cash. So yeah on that I have to admit I'm not very familiar what cash cash is. I mean I'm Yeah.

Me neither. So, I don't know who asked the question specifically, but um yeah, but or you might want to stay anonymous. That's also okay. I mean, obviously, Lightning Network, I mean, I've tried it. Um when it works, it's great.

When it doesn't, it doesn't. And I think as as Joe said, you know, like they've had many many years to get it right. Uh I'm I mean, even the original Lightning developers didn't design it for it to be. It was just meant to be like some okay you know I'm going to make repeated payments and then I expanded this use case but it wasn't the oneizefits all that it is meant to be and I think the sooner that we are more honest about lightning limitations the better we can move on not to say that lightning isn't good tech it's just that we had to realize it limitation is not it doesn't solve everything uh even like you know the privacy stuff it's not perfect yeah all right that's uh all the questions that we have. Please guys give a round of applause to Ruben Yap once again.

[Applause]