NIGHTFALLCOIN — money that refuses to snitch

The part nobody else does

A supply you can verify yourself

Most privacy coins ask you to trust that no one is quietly printing money behind the confidentiality. Nightfall does not ask. Every node evaluates one equation over the entire chain, and it only balances if not a single coin was ever created out of nothing.

Σ UTXO − Σ kernel excess = (minted − burned) · G

Sum every unspent output, subtract every transaction kernel, and the result must equal exactly the coins that were legitimately mined minus the fees that were burned. Inflation cannot hide in this equation — it breaks it, and every node sees the break instantly.

supply_proof… OK

Bulletproof range proofs

Every output carries a zero-knowledge proof that its hidden amount is a real number between zero and 2⁶⁴. Without it, a negative amount would mint value while the books still appeared to balance.

Schnorr excess signatures

Each transaction proves knowledge of a secret with respect to a second generator. That is only possible if the amounts cancel exactly — it is the mathematical statement "I created no money".

An auditable burn

Fees are destroyed, never paid to a miner. The fee is the one public number in a transaction, precisely so the burn can be checked rather than merely claimed.

Privacy

Nothing to read, nothing to leak

Privacy here is not a mode you switch on. There is no transparent path to fall back to, because there is no transparent path at all.

Amounts are commitments, not numbers

What lands on the chain is a Pedersen commitment — a point on an elliptic curve that mathematically binds the sender to a value while revealing nothing about it. Only you and the recipient know what moved.

Your address never appears

Every payment generates a fresh one-time key derived from a shared secret. Two payments to the same address share no visible field — not even the sender can link them afterwards.

Encrypted memos, constant length

Attach a note to a payment; only the recipient can read it. Every payload is padded to the same size, so even the length of what you wrote gives nothing away.

View keys that cannot spend

Hand an accountant, an auditor or a partner a key that reveals every amount and memo you send or receive — and nothing else. It is structurally incapable of moving a coin.

Blocks dissolve transactions

A block does not store a list of transactions. Every payment in it is merged into one flat, sorted set of inputs and outputs, so an observer cannot tell which input paid which output. CoinJoin, automatically, in every block.

No admin, no freeze, no keys

There is no mint authority, no blacklist, no pause switch. Not as a policy — the capability simply does not exist in the protocol, and a fair genesis with zero allocations is enforced in code.

Mining

Built so a laptop still matters

Nighthash-v2 is Argon2id: producing a single hash requires 32 MiB of randomly-addressed memory. Purpose-built hardware would need that much fast RAM per parallel core, which is exactly where the economics of an ASIC stop working.

Open the wallet and press Start mining

There is no pool to join, no configuration file, no separate miner to install. The wallet runs a full node inside itself and uses every CPU core but one.

Connect to a peer before you mine

Two miners who never meet build two separate chains from the same genesis, and the lighter one is discarded when they finally connect. The wallet warns you loudly if you are mining with no peers.

The heaviest chain wins — always by work

Chain selection compares cumulative proof of work, never block count. Difficulty retargets every single block over a 90-block weighted average, so the network absorbs hashrate swings in minutes.

Rewards mature, then they are yours

Block subsidies unlock after 1,440 blocks, roughly six hours. The delay protects you from reorganisations — the coins are already yours, just not spendable yet.

Parameters

No treasury. No investors. No original sin.

Every coin that will ever exist has to be mined. There was no allocation to a team, a foundation or a fund — the genesis block contains nothing, and the code refuses to start if it ever does.

0Max supply

0Premine

0Block time

0Fees burned

Emission

20 NIGHT per block, halving every 2,250,000 blocks, terminating at 89,999,999.7075 NIGHT. No tail emission — after the cap, security is paid for by fees and by the people who want the network to exist.

Cryptography

Ristretto throughout. Blake3 for hashing, Bulletproofs for range proofs, Schnorr for signatures, XChaCha20-Poly1305 for payloads, Argon2id for proof of work. No trusted setup, anywhere.

Written in Rust

Eight crates, no unsafe code in the consensus path, 116 tests — including a suite that replays six real attacks against the previous protocol version and asserts every one of them now fails.

Download

One app. Node, miner and wallet.

The Core Wallet runs a complete node inside itself. No server to trust, no third party watching your balance, nothing to configure.

macOS · Apple Silicon

M1 – M4 · macOS 12.5+

Download .dmg

macOS · Intel

macOS 12.5+

Download .dmg

Windows

64-bit · Windows 10+

Download .exe

Builds are unsigned. macOS: right-click → Open on first launch. Windows: More info → Run anyway. Or build it yourself from source — that is the point.

What this is not, yet

A privacy project that hides its weaknesses is a privacy project you should not use. Here is everything currently missing, in plain language.

Not audited by anyone outside the project. The cryptography was written and reviewed by the same people. That is a conflict of interest, and no amount of passing tests substitutes for outside eyes.
The transaction graph is obscured, not erased. Block-level aggregation hides which input paid which output within a block. But spent outputs stay visible, because deleting them would delete the signature that makes non-interactive payments safe. The two are mutually exclusive; we chose usable payments and are saying so.
No network-layer privacy. There is no Dandelion++ yet. The node that first relays your transaction is probably the node that created it. Use it accordingly.
Pre-launch. The chain is young, the network is small, and a small network is a network that can be out-mined. Do not put value on it that you cannot afford to lose entirely.

The previous protocol version had a balance proof that proved nothing — anyone could have minted unlimited coins. We found it, published the full analysis, threw the chain away and started over. Read the audit.