Most digital money is less private than cash. Every Bitcoin payment ever made sits in a public ledger with its amount and addresses, and anyone with a laptop can read it back. Mimblewimble is a design for a ledger that does not work like that: amounts are hidden, there are no addresses, and the chain can forget most of its own history without anyone having to trust anyone else. Grin is the original implementation of it. The code was begun in October 2016, the network has run since January 2019, and there has never been a company, foundation or investor behind it. A second Mimblewimble chain, Beam, launched twelve days earlier with a company behind it; this piece is about Grin. It is my attempt to explain both without assuming you know any cryptography.
I’m Wayne George, a software engineer in London. I wrote an open-source Grin wallet for iOS, compiled a short history called Grin: A Brief Story out of the project’s forum archives, and take part in the community that runs it. I am not neutral, but I will try to be fair, and nothing here is advice about what to buy.
A whitepaper from nowhere
The Grin documentation tells the origin story straight: “On Mon Aug 01 2016 a user named majorplayer logged into the #bitcoin-wizards IRC channel, dropped a text file hosted on a Tor server and then disappeared.” The message was almost apologetic — “hi, i have an idea for improving privacy in bitcoin. my friend who knows technology says this channel would have interest” — and the file behind the link was dated 19 July 2016, titled MIMBLEWIMBLE and signed “Tom Elvis Jedusor”, which is Voldemort’s name in the French editions of Harry Potter. Mimblewimble is a tongue-tying curse from the same books. The author never came back (the story of Grin).
The paper described a blockchain that keeps amounts hidden and can throw away most of the data it accumulates. Andrew Poelstra published a refined treatment on 10 October 2016, and ten days later another pseudonymous developer, Ignotus Peverell, told the same channel: “I have a minimal implementation of MimbleWimble available.” That became Grin, and its repository still describes itself in exactly those terms: “Minimal implementation of the Mimblewimble protocol.”
What Mimblewimble actually does
Three ideas carry the design. Grin’s documentation has the maths; here is the intuition.
The amounts are hidden but still add up
Bitcoin checks a transaction the obvious way: add up the coins going in, add up the coins going out, and refuse anything that creates money from nothing. Mimblewimble does the same check on sealed envelopes. Each amount is wrapped in a Pedersen commitment, a construction that hides the number while still letting you add and subtract commitments as if they were numbers, so the network can confirm that inputs minus outputs come to zero without seeing the values. Because hiding a number invites the trick of hiding a negative one, “a rangeproof is therefore attached to every output and proves that its value isn’t negative and that its size is restricted so it doesn’t overflow”.
There are no addresses
A Bitcoin address is a reusable label, and reuse is how transactions get tied to people. Grin has none. Every output is a fresh commitment that shares no data with any earlier one, so there is nothing to look up and nothing to link. The price, in the documentation’s own words, is that “transactions have to be built interactively, with two (or more) wallets exchanging data with one another” (Grin for Bitcoiners). More on that shortly.
The chain forgets
Because the ledger only needs to know that everything balances, “matching inputs and outputs can be eliminated, as their contribution to the overall sum cancels out”. If I pay you and you pay someone else, the output in the middle cancels and can be deleted. This is called cut-through, and it means a new node can verify the whole history without storing it. What survives from each transaction is a kernel, “at around 100 bytes”, and the documentation reckons that a Mimblewimble chain therefore “grows at roughly one quarter the rate of a bitcoin blockchain, while offering much better privacy”.
What Grin is
Grin offers itself in one line: “Electronic transactions for all. Without censorship or restrictions.” Its first block was mined on 15 January 2019, and the launch was deliberately plain: no initial coin offering, no pre-mine, no founder’s reward, no company or foundation. Development is paid for by donations, and the project says it “will attempt to rely 100% on community donations for its funding needs” (funding principles). The homepage still carries the warning it has always carried: “It’s very young and experimental. Use at your own risk!”
One grin a second, for ever
Bitcoin’s supply is capped at 21 million and its block reward halves roughly every four years. Grin emits one new grin every second, indefinitely, with no cap — sixty a block on a one-minute target. New supply as a share of the total falls as the total grows: “After 10 years, it falls below 10%. After 20, below 5%.” And for its first four years Grin’s inflation curve tracked Bitcoin’s exactly, because both paid a full, unchanging reward until year four (emission). The number of coins is nothing like the same; the shape of the curve is.
The stated reason is that Grin is meant to be spent rather than hoarded. It was the most argued-over decision in the project’s history, and it has never changed.
Cuckoo Cycle
Bitcoin miners race to find a hash. Grin miners search enormous graphs for closed loops of 42 links, a puzzle called Cuckoo Cycle designed by John Tromp. It is “primarily a memory bound algorithm, which (at least in theory) means that solving performance is bound by memory bandwidth rather than raw computational speed” — chosen partly because “eventual ASICs should run much cooler than hashing chips” (Cuckoo Cycle). ASICs are the specialised chips that get built for any proof-of-work worth mining, and the bet was that it is better to shape the chips than to pretend they will not arrive.
So two variants ran side by side for the first two years: an ASIC-friendly one that began at ten per cent of rewards and rose to all of them, and ASIC-resistant Cuckaroo29, which fell from ninety per cent to nothing and was modified at scheduled hard forks — compulsory network upgrades — every six months, “in order to interrupt possible ASIC development for it”. The ASIC-friendly side started as Cuckatoo31+, which the documentation notes “was initially the primary PoW but was phased out completely after 18 months”. Cuckatoo32+ is what remains today (proof-of-work).
Interactive transactions and slatepacks
This is what surprises people coming from other coins. Because both parties contribute to the cryptography, sending grin is a short conversation: the sender starts the transaction, the receiver adds their part and signs, and the sender finishes it and broadcasts. The wallets need not be online at the same time, but the data has to make the round trip.
The standard for that round trip is the slatepack. A slatepack address is “a bech32 encoded ed25519 public key”; the sending wallet derives an onion address from it and tries to deliver over Tor, and if that fails the transaction falls back to a block of encrypted text between BEGINSLATEPACK and ENDSLATEPACK markers that you can paste into a chat, an email or anything else that carries words. My own iOS wallet works this way. Its README also lists peer-to-peer transfers over local Wi-Fi and Bluetooth, so two phones can hand a transaction between them with no internet connection at all.
Why privacy in money matters
Your bank statement is private by default. The bank can see it, and so can the law with a warrant, but the corner shop cannot and neither can your neighbour. A public blockchain turns that inside out: anyone who has ever paid you can see the balance you hold, what you spent it on next and who with, for as long as the chain exists.
That is not abstract. It matters to the person whose employer can see what they donate to, to the small business whose supplier can read its margins, and to anyone whose coins are refused because someone further up the history did something wrong. That last one is fungibility, the property that one pound is as good as any other, and a transparent ledger quietly loses it. Mimblewimble’s answer is not to bolt privacy on afterwards but to leave the identifying data out in the first place.
The trade-offs
None of this is free.
The interactive model is the biggest cost. A transaction that needs a reply is harder for exchanges, payment processors and ordinary people than one that needs only an address, and it has held back adoption. There is no “send it here and walk away”.
There is no scripting language. Bitcoin’s small programmable contracts do not exist here, so multi-signature wallets, which need more than one key to authorise a spend, and atomic swaps, which trade grin for another coin without a middleman, have to be built out of the elliptic-curve maths instead. Some of that has proved harder than hoped: multisig in particular ran into unsolved problems around threshold range proofs.
Hidden amounts raise the stakes on correctness. On 18 March 2021, Grin++, David Burkett’s independent C++ implementation, refused to accept block 1,136,081. A caching bug in the main implementation meant a range proof that had already been verified for one output could be accepted for a different one — which is precisely how you would create coins out of nothing on a chain where nobody can see the amounts. A fix shipped within hours and the invalid block was rewound. It remains the best argument I know for a network having more than one implementation of its rules.
Then there is the emission. Perpetual issuance is defensible as monetary policy and hard to love as a story. And the project is small, funded by nobody with a marketing budget, and run by volunteers, which is a strength in some lights and a limitation in others.
From a core team to a governance council
Grin has been governed in public from the start. I read most of that record while compiling the history from the forum archives, and the shape of the thing has changed more than once.
In August 2018, before launch, contributors with commit rights formed a technocratic council to hold a multi-signature wallet for the project’s funds. Ignotus Peverell — Igno to everyone — called the arrangement the “technomity”: “a type of meritocracy, where a technocratic council makes decisions, and a leader (Igno) has the right to exercise final say, but hardly ever has the need to do so.” They looked hard at incorporating and left it open rather than settling it. The governance summary of the time reads: “While no one has completely ruled out the need for a foundation, many of us seem to think it may not be needed or required.” Part of the argument was that “anonymity can be an asset to help shelter this project somewhat”. When Igno left a few months after launch, that unincorporated structure had to carry on without its founder.
In 2020 the project formalised things through RFCs, its written proposals. RFC 0016, begun on 11 September 2020, dissolved the core team because “all critical decision making became centralized around the core team”, and narrowed what was left to almost nothing: “The main purpose of the council is to manage the keys to the Grin General Fund and have final say in spending decisions.” Everything else would self-organise.
In March 2021 John Tromp posted that “the Council has expressed a willingness to share funding control with people from the wider Grin community”, and a call went out for candidates from outside it (forum thread).
By 2025 that arrangement had worn thin, for the dullest and most human of reasons. A thread opened on 6 May 2025 put it plainly: “increasingly it has become difficult to a) get sufficient CC members to join meetings and b) get CC key-holders to sign transactions in a timely fashion.” The proposal was a reset — new volunteers, a new multi-signature wallet — and that is what happened. The older council merged into the new one, the funds were consolidated into “a single 4/7 MultiSig”, and the body took the name Grin Governance Council (forum thread).
My name is in that record. The 6 May 2025 post listed me among the proposed members — “@waynegeorge (software engineer, who long followed Grin)” — and the thread introducing the new council later that month names me as one of its six (forum thread).
For a project with no legal entity, that is a strange kind of appointment. There is no letter, no register, no induction. The treasury is a wallet, the boardroom is a forum thread, and all of it is visible.