Mimblewimble

Mimblewimble is a radically stripped-down blockchain design that achieves privacy and compactness at once by throwing away almost everything Bitcoin keeps. It has no addresses, no transaction scripts, and no permanent record of individual transactions — just confidential amounts and the minimal cryptographic glue needed to prove the money supply is honest. It was posted anonymously in 2016 under the name 'Tom Elvis Jedusor' (the French name for Voldemort, fitting its Harry Potter naming theme) and refined by Andrew Poelstra and others, then implemented in the Grin and Beam cryptocurrencies.

Every output is a Pedersen commitment hiding its amount, exactly as in confidential transactions, so values are never visible. There are no addresses because a transaction is built interactively between sender and receiver: the two parties jointly choose blinding factors and co-sign, which means receiving funds requires an interaction rather than just publishing a static address. The proof that a transaction does not create money is a kernel containing an 'excess' value — the difference of the blinding factors — together with a signature; if the inputs and outputs balance, this excess is a commitment to zero with a known signature, certifying conservation without revealing amounts.

The signature feature that makes Mimblewimble unique is cut-through. Because the validity of the chain depends only on the set of currently-unspent outputs plus the kernels, any output that was created and later spent within the history can simply be deleted — it cancels out. The chain therefore does not need to store the full sequence of historical transactions; a new node can sync by downloading only the unspent outputs, the kernels, and the block headers, which is dramatically smaller than replaying every transaction. Cut-through gives both better privacy (no historical transaction graph survives) and far better scalability.

The honest limitations are important. Mimblewimble's privacy is weaker than it first appears: a well-connected 'sniffer' node that observes transactions on the network before they are aggregated and cut through can reconstruct much of the original transaction graph — the so-called flashlight attack — so it does not match the anonymity of a shielded zk pool. It also has no smart-contract scripting (though scriptless-script tricks recover some functionality), and like most current schemes it is not post-quantum secure, since its privacy rests on the discrete-logarithm hardness of elliptic curves.