10 years ago, we launched Zcash, making a private version of Bitcoin. But the origins go back to the 80s, when, in the wake of the Watergate scandal, cryptographers first dreamed of private electronic cash, and the story runs through Satoshi’s invention of Bitcoin. Zerocoin came three years before Zcash launched in 2016. We’d written it as a zk-mix for Bitcoin, and then a year later, Zerocash, which introduced SNARKs to cryptocurrency and is now the de facto approach to private payments on chain. More than 30 years before that, in the early 80s, cryptographers first dreamed of private electronic payments. This was right after the invention of public key cryptography, the Watergate scandal, the Church Committee’s revelations of intelligence agency wrongdoing, and an ongoing fight between the nascent academic crypto community and the government over regulations and alleged backdoors. It was also right as it became clear that the growth of the internet and electronic payments would pose a major surveillance risk. Today, there are a number of cryptographers who think crypto is simply math, devoid of purpose, and a number of folks in cryptocurrency who do not care about privacy (or perhaps even cryptography). That was not the case in the 1980s. Starting with David Chaum, cryptographers first designed e-cash, a centralized private payment scheme that required a trusted bank to blindly sign special tokens. These went nowhere: existing trusted institutions, like banks, didn’t adopt the protocols, and no one wanted to trust magic internet money run by a strange company. Then Satoshi invented Bitcoin, overcoming the trust issue by inventing a blockchain. Bitcoin’s key innovation was the blockchain, which replaced a trusted bank with a public database anyone could participate in running. Because anyone could participate, it got off the ground without convincing a bank to run it. But because anyone could participate, there was no privacy: everyone could download the database of payments. And we couldn’t just use an e-cash scheme, as that required someone to keep a secret signing key, and the entire point of Bitcoin was that no one had to be trusted. This is where Zerocoin, Zerocash, and Zcash come in. They replaced the e-cash system with a zero-knowledge proof and, this fact is not well understood by many, strengthened the privacy of e-cash schemes by giving the recipient full privacy even if the bank was malicious.