Federated & Pooled Systems — Fedimint and Ark

How Fedimint works?

Fedimint, short for federated mint, is a Bitcoin-native Layer-2 protocol that revives the concept of Chaumian eCash – a cryptographic system that enables users to transact anonymously using blinded digital tokens. What distinguishes Fedimint from earlier eCash systems is its use of federations to manage minting and custody, combined with native integration with the Lightning Network for interoperability.

In Fedimint, users deposit bitcoin into a multi-signature wallet controlled by a group of trusted guardians. These guardians form a federation responsible for issuing eCash tokens, which are cryptographic claims backed 1:1 by BTC held in the federation’s custody. When a user deposits bitcoin, the guardians jointly issue blinded tokens that the user can spend privately. These tokens can be redeemed later for on-chain BTC or sent to others within the mint.

The cryptographic blinding process ensures that the federation cannot link the issuance of a token to its later redemption or transfer. This provides strong transaction privacy, even against the federation itself. Unlike Lightning, where all routing data is visible to intermediate nodes, Fedimint enables fully private, off-chain payments.

To interact with the broader Lightning Network, Fedimint uses gateways or services that act as bridges between eCash and Lightning payments. If a user wants to send a Lightning payment, the gateway accepts their eCash tokens, settles the Lightning invoice, and returns the change as new eCash. Similarly, inbound Lightning payments are converted into blinded tokens by the gateway. While these gateways introduce a point of trust, they can be run by any participant, including community members or privacy-focused service providers.

Fedimint is designed to support multiple mints in parallel, each with its own guardians and monetary supply. This enables localized communities to run their own financial systems on top of Bitcoin, tailored to their needs and trust assumptions. The protocol also supports modular extensions such as identity verification, access controls, or voting systems.

How Ark works?

Ark is a newer Bitcoin Layer-2 protocol introduced in 2023 by developer Burak Keceli. Unlike Lightning or Fedimint, Ark does not rely on channels, liquidity routing, or direct user custody. Instead, it enables non-interactive, anonymous payments by coordinating many users’ transactions through a central host who batches and broadcasts them to the Bitcoin blockchain.

The Ark protocol is built around a structure called virtual UTXOs (vUTXOs). These are temporary, off-chain claims on bitcoin that can be created, transferred, and redeemed by users within a fixed interval. Each vUTXO has a timeout after which it must be refreshed or redeemed on-chain. The host is responsible for maintaining the UTXO set, facilitating transfers, and broadcasting aggregated transactions.

To send a payment, a user creates a blinded request specifying the destination and amount. The host collects many such requests from different users and aggregates them into a single on-chain transaction using one-time address encoding. The output is structured in such a way that only the intended recipient can decode and claim their funds. Because multiple payments are merged and blinded, individual transactions are not linkable, providing strong on-chain privacy.

Ark’s key innovation is that it allows one-round anonymous payments without requiring interaction between sender and recipient. This stands in contrast to Lightning, where both parties must be online and able to route payments through intermediaries.

The protocol also improves capital efficiency. Users do not need to lock up liquidity in channels. Instead, the host maintains a pool of real bitcoin to process transactions, while users hold cryptographic vUTXOs representing short-term claims. This architecture minimizes the need for inbound liquidity, routing, or rebalancing.

Ark’s privacy comes with trust trade-offs. The host must be online, honest, and able to construct valid transactions. Although users do not relinquish full control over their funds, they must depend on the host to facilitate payments. The use of blind signatures and periodic rotation of vUTXOs helps reduce surveillance risk, but it does not eliminate it entirely.

As of 2025, Ark remains experimental but has seen multiple testnet deployments, and integration efforts are underway in privacy-focused wallets like Mutiny. Its one-tap send flow and predictable fees make it attractive for mobile users, especially in censorship-prone or surveillance-heavy environments.

Custodial trust models vs cryptographic guarantees

Both Fedimint and Ark rely on intermediaries, but their trust models differ in structure and strength. In Fedimint, users delegate custody to a federation of guardians who control a multisig wallet. The security of the system depends on a threshold number of guardians acting honestly. This resembles a multi-party custody setup, where users choose guardians based on local trust, transparency, or governance models. If a majority of guardians collude or fail, funds can be frozen or misused.

However, Fedimint enhances trust through Chaumian eCash blinding, which ensures that even honest guardians cannot link transactions to identities. This preserves user privacy while limiting the federation’s surveillance capabilities. The system is therefore considered semi-custodial: users give up full control over their bitcoin but gain privacy and ease of use.

Ark, by contrast, does not hold user funds directly. The host provides access to pooled liquidity but cannot spend users’ vUTXOs without cooperation. Transactions are constructed using cryptographic commitments and timeouts, allowing users to redeem or refresh their funds if the host becomes uncooperative. This makes Ark non-custodial in principle, though the host remains a central dependency for liveness and availability.

In both models, users trade off self-sovereignty for convenience, scalability, or privacy. While not as trustless as Lightning or on-chain transactions, these systems introduce new assumptions that may be acceptable in certain social or technical contexts—particularly when privacy or onboarding simplicity is the priority.

Real-world usage: Mutiny, Fedi, Ark v0.5

In 2025, the adoption of Fedimint and Ark is still early-stage but growing. Wallets and projects like Mutiny and Fedi are playing key roles in making these technologies usable outside of experimental environments.

Mutiny Wallet integrates both Lightning and Fedimint, allowing users to receive Lightning payments or convert funds into eCash tokens for private storage. It offers an interface for selecting mints, sending tokens, and redeeming them back to BTC. The wallet targets users who want strong privacy but do not want to manage Lightning channels or interact with custodians.

Fedi is building a commercial implementation of Fedimint designed for communities, NGOs, and local networks. It provides tools for setting up federations, onboarding members, and managing transactions. In contexts where trust is rooted in local relationships, such as villages, activist groups, or diaspora communities, Fedi aims to offer a more culturally aligned financial infrastructure.

Ark v0.5, released in late 2024, introduced improvements to privacy, fee smoothing, and performance. The reference implementation demonstrated that one-round payments could be scaled to thousands of users with minimal on-chain overhead. Developers are now exploring wallet integrations, host discovery protocols, and incentive models for host operators.

Strengths and limits

Federated and pooled Layer-2 systems offer distinct advantages over other scaling approaches. Privacy is their strongest feature. By default, Fedimint and Ark obscure transaction metadata, sender-recipient links, and network-level activity. In contrast, Lightning requires online coordination and reveals certain data to routing nodes.

These systems also improve scalability. Since they operate on batched or pooled models, they reduce the number of on-chain transactions per user. This allows them to serve hundreds or thousands of users with a fraction of the on-chain footprint compared to Lightning or base-layer transactions.

User experience is another area of strength. These models reduce technical complexity, channel management, and liquidity configuration. For mobile-first users in developing countries or under censorship regimes, the simplicity and predictability of these systems may outweigh the loss of full self-custody.

However, they come with important limitations. Both Fedimint and Ark introduce centralization points, whether in the form of guardian federations or transaction hosts. These entities can be pressured, regulated, or attacked. While cryptography mitigates some risks, these systems remain vulnerable to denial-of-service, governance capture, or operational failure.

Censorship resistance also depends on the diversity and distribution of operators. A global, permissionless set of guardians and hosts would improve robustness, but as of 2025, most deployments are still small and experimental. The challenge lies in scaling these systems without sacrificing their privacy or decentralization goals.