Private money, private conversation, and how Fedi is solving the guardian problem

Every payment you make and nearly every message you send now passes through a company that can see it.

That was not true for most of human history. Cash left no trail. A conversation across a kitchen table left no record. Both were private by default, and nobody had to ask permission for either.

Digital rails changed that, quietly. Your bank sees who you pay. Your payment app sees who you pay and what for. Your messaging platform sees who you talk to, when, and how often, even when it can't read the words. Each of those records sits on someone else's server, where it can be sold, leaked, subpoenaed, or used to freeze an account, block a payment or silence a voice.

This is not an accident. A credit-based system has to centralize to survive. As it grows more fragile it needs more control, and control requires visibility. The surveillance state is not a side effect of the system we live in. It is part of the mechanism that keeps it running.

Why money and conversation belong together

Money is information. It is a record of who did what for whom. Communication is how people coordinate before they ever exchange value. If someone can see both, they can map a community completely: who trusts whom, who pays whom, who is organizing what. And if they can see it, they can stop it.

That is why privacy in money and privacy in communication are not two separate causes. They are the same cause. A community that can talk freely but can't pay each other privately is still captured. A community with private money that coordinates on watched channels has handed over the map anyway.

Bitcoin solved the hardest part: money that no one can debase, seize or censor at the base layer. But the base layer is transparent by design. Every transaction is visible to everyone, forever. And holding your own keys is still hard enough that most people press the easy button and hand their bitcoin to a custodian, which puts them right back inside the system they were trying to leave, with a company watching every move.

What was missing was a layer on top of Bitcoin that is private, easy to use, and doesn't ask you to trust a single company.

What Fedi does

Fedi is built on Fedimint, an open-source protocol for community custody. Instead of one company holding your bitcoin, a group of independent operators called guardians hold it together in a multisignature wallet. No single guardian can move the funds. It takes a threshold of them, roughly two thirds, signing together.

When you deposit, the federation gives you e-cash notes in return. Those notes are issued with blind signatures, a cryptographic technique David Chaum invented in the early 1980s. The guardians sign your notes without ever seeing them, the way a notary could stamp a sealed envelope without opening it. When a note is later spent, the guardians can confirm it is genuine but cannot link it back to the person it was issued to.

The result is that the guardians holding the bitcoin cannot see your balance, cannot see who you pay, and cannot connect the person who received a note to the person who later spent it. Payments inside a federation settle instantly for almost nothing, and Lightning gateways connect the federation to the rest of the Bitcoin network.

Alongside the wallet sits chat. Direct messages and private groups in Fedi are end-to-end encrypted, so only the people in the conversation can read them. Your money and your conversations live in the same place, built on Bitcoin rather than on a bank's or a platform's promise.

The hard part: who guards the guardians?

There is an honest trade-off in all of this, and it is the reason I want to write about Fedi now.

Community custody means trusting the guardians as a group. If enough of them colluded, they could steal the bitcoin. Worse, because e-cash is private, they could issue more notes than there is bitcoin backing them, and nobody inside the federation would see it until people tried to withdraw. A fractional reserve, hidden by the same privacy that protects you.

The defense is independence. The guardians need to be people who can't easily coordinate against you, and who can't be coerced together. Until now that meant finding four or more people, ideally people who didn't know each other, who were each willing to run a server, keep it online and stay committed for years. Very few communities could do that. Most federations ended up being run by friends who knew each other well, which is exactly the setup that makes collusion easiest.

Think about the shape of that problem. Real independence requires strangers. Trusting strangers seems to require knowing who they are. And knowing who they are destroys the privacy the whole system exists to protect. For years this was the long pole in the tent. The technology for private money and private conversation existed, and it was too hard to set up safely.

PeerBadge: trust without identity

The breakthrough comes from an open protocol called PeerBadge, and the new guardian setup Fedi is rolling out on top of it, called Manifold.

PeerBadge lets someone who knows you vouch that you are a real, unique, trustworthy person, without creating any record that links them to you. A signer, who is a real person and not a server, signs your badge using a partially blind signature. They can see the trust level they are vouching for. They cannot see the key it is attached to. No record is ever made connecting the two, and if a badge is abused it can be revoked.

Manifold uses those badges to build federations out of verified strangers:

Only trusted operators. Every guardian seat requires a PeerBadge at the "Trusted" level, vouched for by one of a small group of signers who each hold their signing keys personally. In the Fedi app this shows up as "Fedi verified."

One person, one seat. Each verified operator can hold only one seat in a federation, so no one can quietly take over a federation by running several guardians.

Nobody picks their partners. Guardians are matched to federations automatically. The candidate list is shuffled every time, and seats are deliberately spread across operators vouched for by different signers. The person creating a federation can't hand-pick its guardians, and guardians can't choose which federations they join.

Pseudonymous by default. Guardians appear under pseudonyms. The badge proves an operator is a trusted, unique human without revealing who they are.

Higher thresholds. Federations are built with seven or more guardians, and the app recommends ten. In a ten-guardian federation, seven must sign to move funds.

Put those together and look at what an attack now requires. Seven operators who never chose each other, who were matched automatically, who were vouched for by different people, and who know each other only by pseudonym would have to find one another and agree to steal. Each would be risking a badge that took a real person's trust to earn. That is a very different problem from three friends deciding to dip into the pot.

I have a PeerBadge myself. It lets me establish credibility without giving up privacy, and that combination is the whole point.

It is still not magic, and I don't want to oversell it. This design makes collusion much harder, not impossible, and Manifold's own terms say so. So use Fedi the way you would use any spending wallet. Keep amounts that make sense for one. Consider spreading across more than one federation. And every so often move your funds out and back in. A federation that can't honour withdrawals reveals itself quickly. A free market of federations, each one tested by its own users, is a stronger guarantee than any single promise.

Why this matters now

We are moving into a world where communication channels are watched, accounts can be frozen with a phone call, and the pressure to centralize grows with every crisis. The tools to opt out need to exist before people need them, and they need to be simple enough for people who will never run a node.

Fedi is that kind of tool. It brings Bitcoin's honest money to communities, wraps it in privacy for both money and conversation, and now tackles the trust problem that held community custody back: how to rely on guardians without needing to know who they are.

Disclosure: I sit on Fedi's board, and Ego Death Capital, where I am a partner, led Fedi's Series A. I'm involved because I believe this matters, and I use it every day.

How to get started

It takes about five minutes.

1. Download Fedi. Get the app for iPhone or Android at fedi.xyz/get-the-app.

2. Set up your wallet. Open the app, tap Get started and follow the prompts. Don't skip the backup step: it is how you restore your wallet if you lose your phone.

3. Join Morpheus, the federation I use. On your phone, tap the invite below. Fedi will open, show you Morpheus, and ask whether you want to join. Reading on a computer? Send the link to your phone, or in the app go to the Wallet tab, choose Manual under "Set up your wallet", open the Join tab and paste it there.

https://app.fedi.xyz/link#screen=join&id=fed11qgqyj3mfwfhksw309ajnwenyxycrzdpnvfjnxdfnxa3xvefsxg6kzvpjxucxzd35v5enydmyvyunwvryv5ekycenvgmrxcenx3jnqv3489nrze3ev9jkze34qvqjqe204yde9r45kw4sv95ra50q3jh5zf2x36ynqz28a22fghxjdn5ccjazkw

4. Bring the people you talk to. Privacy only works if the people you message are inside it too. Invite your friends and family the same way you joined. You'll be protecting their conversations as well as your own.

Start small. Send a friend a few sats and a message. Once you have done it, you will see why I think this is one of the most important things being built on Bitcoin.