Zcash: The answer to privacy in crypto?

Introduction

A few themes have dominated this year within crypto; the success of perpetual contract exchanges like Hyperliquid, DeFi exploits amidst increasing attack surfaces facilitated by exponentially better LLM capabilities, Agentic transactions on chains optimised for low-cost throughput, and privacy concerns. 

Privacy concerns are not new, to the world or to crypto. In a crypto context it covers two related things: transactions where the normally transparent flow of value from sender to recipient is obfuscated, and the ability to interact with smart contracts without exposing the details of what you are doing.

This piece explains what privacy means in crypto, then focuses on Zcash, the asset that has pushed on building it in at the base layer. Zcash has drawn outsized attention over the last year, rallying from around $40 in September 2025 to several hundred dollars as privacy moved up as a key narrative-based price driver:

It has also just been through an episode that tested whether the cryptographic integrity behind its shielded pool is robust  (which will be explored in detail). The question this piece sets out to answer: is Zcash actually the answer to privacy in crypto?

Approaches to Privacy in Crypto

Blockchains are known for being an auditable ledger of transactions, transparently broadcasting value transfers between wallets and, where applicable, smart contracts. 

There have been assets, applications and blockchains designed specifically with privacy in mind. Some have historically facilitated nefarious activity related to money laundering or other outright illicit transactions. Others reflect the cypherpunk ethos, or aim to attract future institutional flow that would demand such private properties.

One approach adds privacy on top of an otherwise transparent chain. The most familiar example is a mixer (or tumbler).  A mixer is simply a service that generally takes an incoming transaction, mixes it with dozens or hundreds of others in an attempt to obfuscate where the funds end up. Assets get pooled and the user receives the same amount, either at once, or in varying amounts (totalling to the total value) on a different wallet, typically  minus a service fee. This ultimately breaks the direct link from point A to point B.

Famously, Tornado Cash, likely the most well known crypto mixer, drew heavy legal scrutiny. Co-founder Roman Storm was convicted in the United States in August 2025 of conspiracy to operate an unlicensed money transmitting business, while the jury deadlocked on the two more serious charges, conspiracy to commit money laundering and conspiracy to violate sanctions. A second co-founder, Alexey Pertsev, was separately convicted in the Netherlands in May 2024. The protocol itself was OFAC sanctioned in 2022, before a federal appeals court ruled in late 2024 that the agency had overstepped, and the U.S. Department of the Treasury delisted it in 2025. 

Without delving into too much detail, as it is not the purpose of this article, there has been a longstanding debate over whether open-source protocols like Tornado Cash should be allowed to freely exist. Ethereum co-founder Vitalik Buterin, a documented supporter of Storm's defence, published a letter on 9 January 2026 arguing that the case criminalises the writing of code rather than any direct financial harm. 

Mixers are only one example. Privacy can also be added at the application layer through tools like CoinJoin implementations (Wasabi, the former Samourai Wallet) or smart-contract privacy systems such as Railgun, or privacy-focused layer-2s like Aztec, while cross-chain swap protocols like THORChain can obscure a trail by moving value between chains.

These approaches share a basic limitation: they are bolted onto chains built to be transparent, rather than private at the base layer. Bitcoin and Ethereum broadcast every transaction in the open, so only pseudonymity is possible. Breaking the link between an identity and its on-chain activity therefore has to be added on top, historically through a mixer, and more recently through app-layer protocols, privacy-focused layer-2s, or confidential token standards. A different approach builds privacy into the base layer itself. The two best known are Monero, which is private by default, and Zcash, which features opt-in privacy.

What is Zcash?

Zcash is a layer-1 blockchain that was launched in October 2016, built as a fork of the Bitcoin codebase, by the Electric Coin Company (ECC), founded by Zooko Wilcox-O’Hearn. Unsurprisingly given it was forked from Bitcoin, Zcash shares some similar monetary properties:

• 21 million hard cap on total supply (currently 16.7m circulating)

• Proof-of-work 

• 4 year halvings

• Lack of discretionary issuance: supply schedule is fixed in consensus and disinflationary

An academic paper titled Zerocash: Decentralized Anonymous Payments from Bitcoin (Authors from Johns Hopkins University, Tel Aviv University and MIT), written in 2014, served as the foundational basis for the Zcash network. The angle is in the title: anonymous. Zcash seeks to leverage select properties of bitcoin but expand upon its capabilities by introducing some distinct differences. You could consider the single line pitch for Zcash being something along the lines of: Sound money, but private.

Firstly, Zcash has two address types:

• T-addresses (you can think of these like normal bitcoin-type addresses)

• Shielded addresses

Shielded addresses can send transactions where the sender, receiver and amount are totally hidden.

This is importantly opt-in behaviour. If you were to begin using Zcash in a default manner, it would be very similar to using Bitcoin for transactions (open, transparent, auditable). This is the biggest difference between Monero and Zcash. Monero is private by default, whilst Zcash has this opt-in privacy characteristic. Some view this as a weakness, whilst others might say the flexibility is a strength, allowing for selective disclosure depending on use case. From an institutional perspective, the flexibility can more likely satisfy requirements from auditors and regulators (due to the fact that you can selectively disclose a transaction's details to an auditor without revealing it on-chain).

Shielded Supply, the Pools, and How Opting in Works

When someone decides to use a shielded address, they move funds out of the transparent, Bitcoin-like part of the Zcash network and into its private side. Every ZEC transaction fits into one of four types:

• Transparent to transparent

• Transparent to shielded (opting in)

• Shielded to shielded (fully private)

• Shielded to transparent (opting out)

Ultimately what makes a shielded transaction private is a zero-knowledge proof: a way to prove that a transaction is valid, that the sender owns the correct amount of funds and is not double spending, without actually revealing the sender, the receiver or the amount. This means the network can confirm the transaction is legitimate without being privy to its actual contents. The original Zerocash paper introduced this zk-SNARK mechanic that helped birth the Zcash network and its subsequent network upgrades.

In practice, most Zcash transactions are done transparently, and we have seen a significant increase in shielded supply accompany the outsized rally from mid-late 2025:

At the time of writing, roughly 27% of Zcash supply sits in shielded addresses. The vast majority of circulating supply sits in transparent wallets; whilst offering privacy, the Zcash network largely operates in a similar fashion to Bitcoin with very similar underlying monetary and technological properties.

Shielded supply has been described as if it were a single place, which it isn't. A shielded pool is the common cryptographic set that every private transaction draws on. When funds are shielded on Zcash, they join one large anonymity set, and any subsequent transaction proves it is spending validly from that set, that the funds exist and are not being double-spent, while keeping the sender, receiver and amount hidden. The network confirms the transfer is legitimate without learning who sent it, to whom, or how much.

Zcash has four value pools: one transparent, and three shielded, Sprout, Sapling and Orchard. Each represents a different iteration of its privacy technology introduced by network upgrades.

Sprout (2016): the original shielded pool. Transactions were slow and computationally expensive for the network, so there was little uptake.

Sapling (2018): a pool that significantly improved speed and computational efficiency, enabling practical private transactions.

Orchard (2022): the current generation, activated 31 May 2022 as part of the NU5 upgrade. Built on the Halo 2 proving system, it removed the need for a trusted setup and introduced unified addresses, a single format that bundles a user's shielded and transparent addresses and defaults to the most private option both sides support. Most shielded activity now sits here. 

Sprout and Sapling relied on a trusted setup. This is a one-time ceremony that generates the secret cryptographic parameters the system needs to function. The problem is that if someone happens to keep a copy, those parameters could be used to forge valid proofs and counterfeit ZEC undetected, precisely because no one can see inside a shielded transaction. Zcash went to great lengths to make these ceremonies trustworthy, splitting the secret across many independent participants so no single party ever held it. Orchard's Halo 2 proving system removed the trusted setup altogether.

Orchard removed the trusted-setup risk that affected earlier shielded designs, but it did not remove the broader risk that a circuit bug could compromise proof soundness.

The Orchard Vulnerability

In April 2026, Shielded Labs, one of the organisations that funds Zcash development, hired an independent security engineer named Taylor Hornby to review the protocol for vulnerabilities before anyone malicious found them. On 29 May, he found one. Working with Anthropic's Claude Opus 4.8, Hornby identified a flaw in the Orchard proof circuit and wrote a complete exploit. In a local test environment, it generated unlimited, undetectable counterfeit ZEC. The bug had been live since Orchard launched in May 2022, surviving nearly four years before being discovered.

The flaw was a soundness bug. In a zero-knowledge system, soundness is the guarantee that the network only ever accepts valid transactions. This bug broke that guarantee, letting an attacker forge proofs and create ZEC from nothing inside the shielded pool. Because shielded transactions hide their contents, any counterfeit minting would have been invisible.

There is an important limit to what the bug could do, and it comes back to the turnstile. Zcash tracks the total value moving in and out of each pool and enforces that no more value can leave a pool than legitimately entered it. Counterfeit ZEC could be created inside Orchard, but the turnstile caps how much can ever exit (at most the same amount of ZEC that went in). So the value at risk here was the total amount of ZEC held within the Orchard pool (~3.7m), not the full 16.7 million ZEC currently circulating.

The response was fast. Developers first coordinated an emergency soft fork to disable Orchard transactions, then activated a hard fork, NU6.2, that restored Orchard with a corrected circuit. The fix was in place within days. Shielded Labs disclosed the vulnerability publicly on 5 June, and ZEC fell roughly 30% over the following day. 

Shielded Labs was careful in what it claimed. There is no evidence the vulnerability was ever exploited, and the team believes it is unlikely. But it stopped short of certainty, for the same reason that makes Zcash private: because no one can see inside the Orchard pool, no one can currently prove that no counterfeit ZEC was ever minted there. The supply cap is verifiable. The internal integrity of the legacy pool is, for now, highly likely but not provable.

Shielded Labs has put forward a new shielded pool, Ironwood, that would seal the legacy Orchard pool and force every coin to migrate out through the turnstile. Once migrated, anyone running a node could verify that the ZEC in circulation does not exceed what it should, whether or not counterfeiting ever occurred. The point is to make it impossible for any counterfeit ZEC to ever circulate. 

How the Privacy Options Compare

Privacy in crypto is not a single feature but a set of trade-offs. Whether it is on by default or has to be turned on. Whether it hides who you are, how much you moved, or both. Whether it needs a separate tool, a separate app, or a separate chain. And how exchanges and regulators treat it. The assumption that privacy on a transparent chain means you need a mixer no longer applies. Both Ethereum and Solana now have privacy options that are not mixers, from confidential transfers built into the token standard to shielded DeFi systems and dedicated privacy layers. The table below compares how privacy is approached within different blockchains:

Monero is the only asset here that is private by default. Everything else makes privacy a choice, and the choice is implemented in very different places: inside the protocol (Zcash), inside the token standard (Solana's confidential transfers), in a separate application or chain (Railgun, Aztec), or not really at all without an external service (Bitcoin). The newer EVM and Solana tools also tend to hide amounts rather than identities, which is useful for some use cases but is not the same as the full sender, receiver and amount shielding that Zcash and Monero offer.

Is Zcash Actually Private?

Zcash appears to have the strongest cryptography of any privacy asset, but Monero offers better privacy in practice. The two statements do not contradict each other. They follow from the same design choice: privacy on Zcash is opt-in, and on Monero it is not. There is one main weakness in the Zcash approach that is not present in Monero: Due to partial shielding (i.e. transparent → shielded → transparent) there are potential leaking risks due to user behaviour, timing and round-trip patterns that can become apparent.

When a Zcash transaction is shielded, its zero-knowledge proof hides the sender, the receiver and the amount, and proves the transaction is valid without revealing any of them. Two things make this arguably the strongest approach in the category. Orchard's Halo 2 system needs no trusted setup, removing the one structural counterfeiting risk the earlier pools carried. And a shielded transaction is hidden among everything in the pool, not just a handful of decoys, which is how Monero's ring signatures work. 

That design also allows for more flexibility when it comes to institutionalization. Because shielding is optional and Zcash supports viewing keys, a holder can transact privately and still prove the contents of a transaction to an auditor or regulator when needed, for example to comply with Travel Rule requirements. Combined with the fact that Zcash can be held and traded entirely transparently, something Monero cannot offer, this is likely one of the reasons Zcash, and not Monero, has survived on a much larger set of regulated exchanges. Europe is the exception, and it is often overstated. MiCA does not ban the Zcash protocol or the ZEC token, and holding and transparent use remain legal. But Article 76(3) bars exchanges from listing an asset with an "inbuilt anonymisation function" unless they can identify holders and their transaction history, and because a user can still deposit shielded ZEC, EU venues have delisted it alongside Monero. Zcash's optionality has kept it listed where no such rule applies, notably the US. 

The Orchard exploit was obviously a bad thing. A counterfeiting flaw that sat undetected in the largest pool for nearly four years is a fairly large oversight, and the privacy that makes Zcash valuable is ironically what made the bug so hard to find. The response, a proactive audit that caught it, with a fix shipped in days, and a follow-up upgrade to make supply verifiable again, were good signs of a fast, technically capable developer base. This is encouraging when looking out into the future for Zcash moulding alongside the growth of the overall privacy meta that is seemingly prevalent recently.

That being said, only around a quarter of ZEC sits in shielded addresses, so the effective anonymity set is far smaller than the technology allows, even if the trend is moving the right way. Monero has no such gap. Privacy is mandatory, so every user is forced into the same large pool, which gives it a bigger real anonymity set and its long-standing status as the privacy coin of choice. That same property is why it is the more heavily scrutinised and delisted of the two. For full privacy, hiding who paid whom and how much, the contest is still Zcash against Monero. The newer confidential-transfer tools on Solana and Ethereum mostly hide amounts, not identities, which covers some use cases, like hiding a payment amount, but not the full anonymity that Zcash and Monero offer. 

So, is Zcash the answer to privacy in crypto? Not yet, but it certainly has a real shot. There is a clear path of upgrades from the Zcash developers which will only strengthen its capabilities over time and also hopefully minimize the attack surface. What we would be looking for would be the uptake of shielded pools increase dramatically as a sign of adoption, as well as a longstanding track record without any potential exploits that would compromise the networks integrity. 

Even though the Orchard flaw appears not to have been exploited, it is not the first counterfeiting vulnerability Zcash has had to patch, and privacy is exactly what makes such flaws hard to detect in the first place. All this being said, Zcash uniquely sits as one of the best engineered privacy assets in crypto and has a very promising future.

What is ZEC Worth?

ZEC is not a cash-flow asset. There is no staking yield, no fee burn, no buyback, and no revenue that accrues value directly to token holders from network usage. Zcash is proof-of-work, so transaction fees go to miners (like in Bitcoin), and the portion of issuance that funds development is a cost to holders, not a return to them. This does not mean ZEC is worthless.

ZEC is a monetary asset. It allows you to permissionlessly transact value, with no need for an intermediary, featuring an opt in privacy characteristic. You value it in a similar way to how you would value Bitcoin, on the size and credibility of the monetary demand it can capture.

The problem is that ZEC is, in most respects, a worse Bitcoin. It has a fraction of the liquidity, a fraction of the hashrate, far thinner exchange and custody support, and none of the acceptance or institutional adoption that Bitcoin has accumulated over the last 15 years or so. A transparent ZEC transaction is simply a Bitcoin transaction with worse liquidity and properties behind it. On that basis ZEC should trade at a steep discount to Bitcoin's monetary premium, and it does. The way we can therefore frame its value would stem from how much of its discount to Bitcoin it should close looking forwards. And this should come, from a high level, to how much shielded usage as a percentage of the total supply it can achieve, and how much overall usage the network can get over time. That is what would make it sound money, but private.

Below is the ZEC/BTC relative market cap since 2024, with shielded supply overlaid:

Shielded supply rose sharply over the period, from ~10% to around 30%, but it initially climbed slowly. The ratio did almost nothing for the best part of two years, then went vertical in the space of a couple of months. The gradual increase in shielded supply did not have an outsized impact on ZEC strength relative to Bitcoin, until both had very large moves starting in September 2025. This is not a claim that ZEC became more valuable as its shielded supply increased, but it paints an interesting picture: The privacy narrative became a leading one, and more traders and investors learnt of opt-in privacy features that the Zcash network has to offer

Around the time of the Orchard exploit, Zcash gave back part of its outperformance to Bitcoin, and a couple of weeks later shielded supply fell by around four to five percentage points, from roughly 31% to 26%, as users grew fearful their holdings were at risk, whether from the bug itself or the price reaction to it. As things resolved, ZEC recovered and shielded supply has since held around that level. 

In this section we are conjecturing something simple: there is an increasing subsection of crypto users that are keen on privacy for a number of reasons. We have established that Zcash, when used transparently, is an inherently worse Bitcoin. Its future value is therefore likely to be hinged on how much of its unique privacy properties it can leverage over its counterparts.

Without arduous detail, we believe that Zcash’s inferior properties come from its less established mining network and therefore weaker network effects, which mean inferior settlement assurances and thinner liquidity. An increase in usage of the network is likely to help close some of its relative inferiority to Bitcoin. 

There is one catch. Say shielded supply reached 75%. Would centralised exchanges still list it? For Monero, mandatory privacy is what got it delisted almost everywhere. Zcash offers something Monero does not: it can be used entirely transparently, and its viewing keys allow per-transaction disclosure to a regulator, for tax or compliance purposes, even as private usage rises. So heavy shielded usage is a double-edged sword, but a more resolvable one for Zcash than for Monero outside the EU, even if, as Europe shows, optionality is not always enough. 

We can, under some fairly wide assumptions, therefore project the success of ZEC based on whether it can successfully achieve widescale privacy whilst sitting within an accepted regulatory framework that would enhance or at least maintain its microstructural properties (i.e. liquidity). Using the following matrices we can project different scenarios based upon shielded usage and reference Bitcoin market caps (Implied price takes each ratio, applies it to the reference Bitcoin market cap, and divides by ZEC's circulating supply, held flat at ~16.78m):

The approach is inherently simple, and illustrative of what drives fundamental value to the token based on what its value proposition is. Speculative fervour and larger market swings in the short term can regularly sway prices, and so this should be treated more as an exercise to understand the potential success of the Zcash network at becoming sound money, but private.