midwimble
PRIVATE STATE · DURABLE ANCHOR

Private money
with a place to return to.

Midwimble is a MimbleWimble privacy chain, merge-mined with and anchored to Midstate. Amounts are hidden, there are no addresses on chain, and every coin carries a dormant hash-based claim that could recover it if elliptic curves are ever broken.

Open the wallet Mine it Read the code
Mainnet 31 Oct 2026, 00:00 UTC · GPL-3.0 · experimental, not audited
Midwimble logo

Most blockchains preserve every payment as archaeology.

Midwimble starts from a different premise.

Money should be private by default.

WHAT IS MIDWIMBLE

One flows. One remembers.

A privacy coin that gets its security from Midstate's miners and its long-term memory from Midstate's post-quantum chain.

MIDSTATE
MIDWIMBLE

Most blockchains publish every payment forever: who sent it, who got it, and how much. Midwimble doesn't. Amounts are hidden inside cryptographic commitments, and outputs pay one-time keys instead of visible addresses. Anyone can still check that no coins were created out of thin air, because the maths proves the totals balance without showing them.

Midwimble is its own chain, with its own coin, its own supply and its own consensus rules. It isn't pegged to Midstate and doesn't move Midstate coins.

Merge-mining. Midstate and Midwimble use the same proof of work, so a Midstate miner can mine both chains with the same hashing, at almost no extra cost.

Anchoring. Checkpoints of Midwimble's state are written into Midstate. They give Midwimble a finality floor and a recovery point if its cryptography ever breaks. Midstate needs no changes for either: to a Midstate node an anchor is just an ordinary transaction or a value in a coinbase.

About 23,000 lines of Rust: Midstate's networking and consensus, Pluribit's MimbleWimble transactions (hardened, with an ownership fix), and new code for merged mining, anchoring, recovery and pruning.

01

Private transactions

Confidential amounts, aggregated range proofs, stealth outputs and one-time owner keys. Only the recipient can spend.

02

Merge-mined, anchored

Mined alongside Midstate with the same hashing. Checkpoints are committed into Midstate as a transaction or free through merged mining.

03

Dormant recovery

Every output carries a hidden hash-based recovery commitment that stays unused unless elliptic curves are ever broken.

04

Anchored pruning

Optional: nodes can delete old block bodies below a finalized Midstate checkpoint and bootstrap from a verified snapshot.

KEY SPECS

The numbers.

Every figure here is fixed in the code (src/core/types.rs) or the published launch parameters. Anyone can check them with midwimble params.

Midwimble key specifications
TypeMimbleWimble privacy chain, merge-mined with and anchored to Midstate. Its own coin, supply and consensus; no peg.
Tickerto be announced
Decimals8 (1 coin = 100,000,000 base units)
Max supply1,000,000 coins, reached exactly
PremineNone. Every coin is a block reward.
Block time60 seconds (target)
DifficultyASERT, 4-hour half-life, anchored to genesis
Proof of workSequential BLAKE3, 1,000,000 iterations, until block 37,300; Midstate Walk from then on (as on Midstate, which switches at its block 371,500)
Merge-miningWith Midstate. Proofs about 220 bytes; no Midstate changes.
Mining requirementA bond locked on Midstate: 128 gMDS (237 units) with 30 days of lock left, from 31 Oct 2026
Block rewardRamps up over the first 30 days, then 0.23932616 per block
HalvingEvery 2,100,000 blocks (about 4 years). First around 13 Oct 2030.
End of issuanceAbout block 49.7 million (around 2121); fees only after that
Coinbase maturity100 blocks
TransactionsPedersen commitments on Ristretto255, aggregated Bulletproofs, stealth one-time owner keys
AddressesBech32, prefix mw, v1: scan key + spend key + post-quantum recovery key
PropagationDandelion++ (being hardened)
Min relay fee100 base units per weight unit (node policy). A typical payment: 0.000046 coins.
Block / tx limit40,000 / 10,000 weight units
Finality100 blocks after a checkpoint anchored with 1,000 Midstate confirmations
AnchoringAbout every 10,000 blocks (about a week)
Post-quantumDormant hash-based (MSS) recovery commitment on every output
Genesis16 Oct 2026, 03:41 UTC. Anchored to Bitcoin block 971,656 and Midstate block 334,607.
Genesis block7c45a2ef9d2f76134fe35f6016ef7df0dfef8d4f29dd5d02d4ae8144a10139b5
Network magicMIDWIMBLE_TESTNET_V3 (kept for good on mainnet)
Mainnet31 Oct 2026, 00:00 UTC, in place, with no restart
LicenceGPL-3.0-or-later
AuditNone yet
EMISSION AND SUPPLY

One million coins. No more, ever.

The whole supply is mined out as block rewards on a fixed schedule written into consensus. The last block to mint pays whatever is left, so issuance stops at exactly 1,000,000.00000000.

  1. Slow start: first 30 days (43,200 blocks).
    The reward climbs in a straight line from almost nothing. Day one pays about 5.7 coins in total, the whole first month about 5,170. Launch day is when anyone with a head start could take the most; the ramp makes that window nearly worthless.
  2. Era 0: 0.23932616 per block.
    Until block 2,100,000. Roughly half the supply is issued in this first era.
  3. Halvings every 2,100,000 blocks.
    126,000,000 seconds, the same wall-clock length as Bitcoin's era. First around 13 Oct 2030, second around 10 Oct 2034.
  4. The end: about block 49.7 million.
    Roughly 95 years in. After that a block pays only its fees, and a block with no fees has no coinbase at all.
CHECKABLE BY ANYONE

The schedule is defined by its running total, so any node can check a claimed supply at any height in microseconds. Nodes that start from a checkpoint snapshot check the snapshot's supply too, so the cap never depends on trusting whoever served it.

KEPT CLEAR OF MIDSTATE'S HALVINGS

Midstate halves around late February each year. Midwimble's launch date keeps its halvings months away from Midstate's, so merge-miners never take two revenue cuts at once.

PRIVACY

Private by default.

What Midwimble hides, and an honest list of what it doesn't.

HIDDEN
  • Amounts. Every output is a Pedersen commitment, with an aggregated Bulletproof range proof showing it isn't negative. Anyone can verify that inputs, outputs and fees balance without seeing a number.
  • Recipients. No addresses on chain. Each output pays a one-time owner key, so two payments to the same address don't look related. Only the recipient can find and spend them.
  • Where a payment started. New transactions travel a random stem of peers before being broadcast (Dandelion++), and stem transactions that time out together are combined first. Dandelion++ is being hardened.
NOT HIDDEN
  • That a transaction happened: its number of inputs and outputs, its fee, and which outputs it spends.
  • Linked outputs: outputs in the same range-proof group are visibly linked. That's the cost of keeping proofs aggregated.
  • No classic cut-through. Receiver-only ownership needs each spent output's owner key and signature to stay, so Midwimble uses anchored pruning instead. History is more permanent than in Grin.
  • Your node sees what you send through it. It never sees your keys, but it learns which coins are yours from payments you send through it.

Receiver-only spend authority. Every output carries a one-time owner key (Ko = H(t)·G + B), so the recipient and only the recipient can spend it. Sending needs only the recipient's address, with no back-and-forth between wallets.

VIEW KEYS

Show your books, keep your keys.

A view key sees every payment to your address and its amount, and can spend none of them. Privacy becomes a choice you can selectively waive, not an all-or-nothing wall.

01

Who it's for

An accountant, an auditor, or anyone who should see what you receive. You decide who gets it.

02

Where to find it

Browser wallet: Settings → Advanced → View Key. Command line: midwimble wallet view-key.

03

Pool miners use it

A miner's own software uses its view key to confirm the pool paid exactly what it owes, without the key leaving the miner.

The view key covers payments to the address. Never share your recovery phrase: that's the spend key. The view key is the one you share.

MINING

Secured by hashrate that already exists.

A Midstate miner puts a small commitment to a Midwimble block in its Midstate coinbase. If that Midstate block also meets Midwimble's target, it's a Midwimble block too. One search mines both chains.

01 · EASIEST

Through a pool

Mine in your browser: one tap makes a wallet and mines for it through the merge-mining pool at rpc.cypherpunk.gold/pool, which mines Midwimble alongside Midstate. Nothing to install.

Or keep a Midstate miner on that pool as normal and add a Midwimble address. No bond needed either way.

Pool fee: 12.5% for now. It's temporary while Midwimble gets going.

02

Solo merge-mining

Against your own Midstate node: midwimble merge-mine. Needs a bond.

03

Run a pool

midwimble pool and midwimble pool-mine. The provably fair design pays PPLNS directly in the coinbase.

BONDS: A TICKET, NOT A WEIGHT

A block must be signed by a mining key that a bond on Midstate authorises. A bond is an ordinary Midstate coin locked until a set height. Proof of work alone decides who finds a block: a 1,000 gMDS bond mines exactly as hard as the minimum, and there's no slashing.

  • Before 31 Oct 2026, 00:00 UTC: at least 224 units (about 0.016 gMDS), 2 days of lock left.
  • From then on: 237 units (128 gMDS), 30 days of lock left.
  • Each bond's blocks count in full only up to its share of the day: four blocks a day once 360 bonds are eligible. Co-bonders can lend bonds to a pool and keep sole control of their coins.
A POOL MINERS CAN AUDIT
  • PPLNS, paid directly in the coinbase, so there's nothing to settle afterwards.
  • Each miner hashes its own copy of the job, bound to its own address, so shares can't be stolen.
  • Miners spot-check the pool's share accounting, and check their payout with their view key before hashing.
  • A coinbase pays at most 31 miners, so very small miners are paid by fair sampling: exactly their share on average, in fewer, larger payouts.
ANCHORING · FINALITY · RECOVERY

A place to return to.

About every 10,000 blocks, a checkpoint of Midwimble's state is written into Midstate: as an ordinary Commit transaction, or for free inside a merge-mined Midstate block. It records that a state existed, not who paid whom.

Finality. Once the anchor has 1,000 Midstate confirmations, the chain is 100 blocks past the checkpoint, and no conflicting anchor is known, no reorganisation can reach below it, however much work a competing chain claims. Forging the evidence would cost about an hour of Midstate's entire network.

This state existed.
checkpoint · field layout 
version          1
network          midwimble
height           <block height>
header_hash      <32 bytes>
state_root       <32 bytes>
cumulative_work  <chain work>
previous         <previous checkpoint>

anchor → MIDSTATE
  commit tx  |  merge-mined coinbase
finality   1,000 midstate confs + 100 blocks
DORMANT POST-QUANTUM RECOVERY

Midwimble's everyday cryptography uses elliptic curves, like most privacy coins, and a large enough quantum computer would break it. So every output also carries a hidden recovery commitment tied to the recipient's hash-based (MSS) key, which is part of every v1 address.

If curves are ever broken, a future hard fork can activate a recovery epoch at an anchored checkpoint from before the break. Owners reclaim their coins with hash-based signatures. Elliptic-curve keys aren't consulted, so an attacker holding every curve secret still can't claim them, and total claims are capped at the checkpoint's supply.

WHAT THIS ISN'T
  • Midwimble is not post-quantum in normal operation.
  • The recovery path is designed and tested, but activating it is a hard fork, and it isn't wired into the node today.
  • Recovery commitments are written by senders and consensus can't check them. Wallets flag bad ones.
  • Your wallet builds its recovery key once, when it's created. It takes from a few seconds to a minute.
FEES, LIMITS AND PRUNING

Cheap to use, bounded to verify.

Weights follow Grin: an input is 1, an output 21, a kernel 3. Outputs cost the most to verify and store, so they cost the most to send.

Fees

Nodes relay transactions paying at least 100 base units per weight unit. An ordinary payment (one input, two outputs) costs 4,600 base units: 0.000046 coins. The floor is node policy, not consensus.

Limits

A block holds up to 40,000 weight units (about 1,900 outputs); a transaction up to 10,000. Every kernel id is unique across the chain (replay protection). Coinbase outputs mature after 100 blocks.

Pruning (optional)

Off by default. With --prune, a node deletes block bodies below the finalized checkpoint and keeps headers, kernels, UTXO records and range proofs. New nodes can start from a snapshot verified against its anchor (--checkpoint). The network relies on archive nodes for now.

LAUNCH

Launched in the open, provably from zero.

The network that launched on 16 October as the public testnet becomes mainnet in place on 31 October 2026 at 00:00 UTC. Nothing restarts: the chain carries on, and so do the coins mined on it.

  1. 16 Oct 2026, 03:41 UTC: genesis.
    It commits to Bitcoin block 971,656 and Midstate block 334,607, both mined after the code freeze. Nobody could compute the genesis, or quietly pre-mine against it, before those blocks existed.
  2. Slow start.
    The reward ramps over the first 30 days. About 1,270 coins, an eighth of a percent of the supply, are issued before mainnet.
  3. 31 Oct 2026, 00:00 UTC: mainnet.
    Only the bond changes. Blocks stamped from then on need mainnet's 128 gMDS bond. Every node must run a build with the early phase before then; older builds split off at the first block after the switch.
  4. After the switch: anchor.
    A checkpoint from past the switch is anchored in Midstate. Once it's final, the early history is settled for good.
  5. About 10 Nov 2026: Midstate Walk.
    From block 37,300 the proof of work is Midstate Walk, a few hours before Midstate switches at its block 371,500. Every node must run v1.3-DIMEBAG or later before then, and any Midstate node v6.2.0 or later; older builds reject the first Walk block. Merged mining pauses between the two switches.
WHY TESTNET COINS CARRY OVER

Testnet participation was low, so the people who did turn up to run nodes, mine and test the bonded path took real risk on new code. Carrying their coins into mainnet rewards that, and the slow start keeps the amount small.

ONE HASH TO CHECK

Run midwimble params on your own build and compare one hash, the genesis block id 7c45a2ef…0139b5. It commits to the network name, both anchors, the genesis time and the starting difficulty. The join script refuses to run unless its build reproduces it.

Joined during the testnet? Your coins become real on 31 October. Write down your recovery phrase (midwimble wallet --wallet <file> phrase). If the join script made your wallet before mainnet was announced, its password is the old default testnet: change it with midwimble wallet --wallet <file> password.

Release: release name and binaries to be announced

GET STARTED

Four ways in.

A browser wallet takes two minutes. Running a node or mining takes a little longer.

01

Get a wallet

Open the browser wallet. Create a wallet, or restore one from 24 words or a .mww file. Write down the 24-word recovery phrase: it's the only way back in if you lose the browser data.

The wallet talks straight to Midwimble nodes over WebRTC and never shows them your keys. It shares phrases, addresses and the wallet file with the command-line wallet.

02

Run a node

git clone https://github.com/ciphernom/midwimble
cd midwimble
python3 scripts/join_testnet.py

The script builds, checks the genesis and follows the chain. Its name still says "testnet"; it joins the network that becomes mainnet.

03

Mine

Easiest: mine in your browser, or point a Midstate miner at the merge-mining pool and add a Midwimble address. The 12.5% pool fee is temporary while Midwimble gets going.

Solo, with your own bond: python3 scripts/join_testnet.py --mine walks you through locking and registering a bond. Add --full-bond to keep mining after 31 Oct. You'll need a Midstate node with the bonded-mining patch and a Midstate wallet.

04

Look things up

The explorer follows an output from the block that created it to the block that spent it, and shows each bond's share of the fork-choice window.

midwimble wallet --wallet w.mww create
midwimble wallet --wallet w.mww balance
midwimble wallet --wallet w.mww send --to <address> --amount 0.25
midwimble wallet view-key

Safety. Never publish a node's RPC port (9434 by default): anyone who can reach it can redirect the node's mining rewards. To share an explorer, use --explorer, which only reads. "Release" on a pending payment doesn't cancel it on the network. It makes the coins spendable again in your wallet, and is only for a payment that will never confirm.

STATUS AND SECURITY

Working network, unfinished review.

Midwimble is experimental software. The network is running and becomes mainnet on 31 October. The code has not had an independent security audit. Only put in what you can afford to lose.

IMPLEMENTED AND RUNNING
  • MimbleWimble transaction core with receiver-only ownership
  • Confidential commitments and aggregated range proofs
  • Merged mining with unmodified Midstate nodes
  • Bonded proof of work and the provably fair pool
  • P2P networking, sync, reorg handling, Dandelion++ (being hardened)
  • Midstate anchoring (commit tx and merged mining) and finality
  • Dormant recovery commitments and recovery logic
  • Optional anchored pruning and checkpoint sync
  • Browser wallet, explorer, view keys
  • Launch parameters set and published

Tests: 190 unit, 16 integration and 11 doc tests. The integration tests run real nodes through sync, reorgs, lying peers, Dandelion++ payments, merged mining, the pool, quantum-recovery attacks and pruning.

STILL TO DO
  • Independent cryptographic review: ownership scheme, merged-mining proof, recovery commitments
  • Security audit
KNOWN LIMITATIONS
  • Not post-quantum day to day; recovery after a curve break needs a future hard fork.
  • Recovery commitments are written by senders and can't be checked by consensus; wallets flag bad ones.
  • Anchor verification is SPV-level.
  • Conflicting anchors stop finalization rather than resolving automatically.
  • Outputs in the same range-proof group are visibly linked.
  • Pruned nodes can't serve history; wallets restored from them lose outgoing history.
  • No fee bumping or cancelling yet: the mempool is first-seen, so there's no replace-by-fee.
  • Unconfirmed coins can't be spent, which also rules out child-pays-for-parent.
  • A coinbase pays at most 31 pool miners.
  • The CLI wallet has no history command (the browser wallet does).
  • GPU mining is verified on software Vulkan only, not real GPU hardware.
ROADMAP

What's next.

Only work grounded in the code and docs. dates to be announced

  1. 16 Oct 2026: network launched as the public testnet.
  2. 31 Oct 2026: mainnet switch, then the first post-switch checkpoint anchored in Midstate.
  3. Tagged releases with binaries. So you don't have to build from source.
  4. Independent cryptographic review. Ownership scheme, merged-mining proof, recovery commitments.
  5. Full verification from snapshots, instead of downloading every block.
  6. Better handling of conflicting anchors.
  7. Fee bumping and real cancel (replace-by-fee). Under consideration.
  8. Recovery epoch: stays dormant unless it's ever needed.
FAQ

Questions people ask.

Something missing? Ask in the community, below.

Is Midwimble part of Midstate?

No. It's its own chain with its own coin, supply and consensus rules. Nothing is pegged to Midstate and no Midstate coins move into it. It's merge-mined with Midstate (shared hashing) and anchors checkpoints into Midstate for finality and recovery.

Do I need Midstate coins to use Midwimble?

Not to hold or send Midwimble. Block producers need a bond locked on Midstate. Pool miners don't, because the pool holds the bonds.

Was there a premine or a sale?

There's no premine in the emission code: every coin comes from a block reward, starting from a genesis that couldn't have been computed before the Bitcoin and Midstate blocks it commits to. There was no sale.

Are coins mined on the testnet real?

From 31 October 2026, 00:00 UTC, yes. The testnet becomes mainnet in place and nothing restarts.

How private is it?

Amounts are hidden, there are no addresses on chain, and Dandelion++ obscures where a payment started. Which outputs a transaction spends is visible, outputs in one proof group are linked, and there's no classic cut-through. See Privacy.

What's a view key for?

Letting someone see the payments to your address and their amounts without being able to spend anything: an accountant, an auditor, or your mining pool.

Is it quantum-safe?

Not day to day. Every output carries a dormant hash-based recovery claim, and checkpoints are anchored in post-quantum Midstate, so coins could be recovered after a break through a future hard fork.

What does "release" on a pending payment do?

It stops your wallet waiting on that payment and makes the coins spendable again in the wallet. It doesn't cancel anything on the network: if the transaction was broadcast it can still confirm.

Can I speed up or cancel a payment?

Not yet. The mempool is first-seen and doesn't accept fee-bumped replacements.

Why is the pool fee 12.5%?

It's temporary, while Midwimble gets going.

Has it been audited?

No. A cryptographic review is on the to-do list. Treat it as experimental.

Where's the whitepaper?

The design is documented in the repo: anchoring and recovery, bonded proof of work, pruning and pool merged mining.

Private present.
Durable past.

A privacy chain that knows what to do when cryptography changes. Mainnet 31 October 2026.

Open the wallet