Zcash Explained: How zk-SNARKs Made Private Payments Work, and What They Cost

Updated November 10, 2026.

Pay a supplier in bitcoin and you've published the payment. The amount, your address and theirs, the timestamp. Anyone can see it, forever. A competitor who learns one of your addresses can watch your treasury from then on.

No bank would accept that for wire transfers. Bitcoin made it the default.

Zcash was built to fix that, and it was the first large public test of zero-knowledge proofs. Ten years in, it's also the best record we have of what happens when this kind of cryptography meets real money, real bugs and real regulators. That record matters more to a risk or compliance leader than the coin's price does.

If you're new to zero-knowledge proofs, start with the pillar explainer. This post assumes the basics.

Where Zcash came from

The design comes from the Zerocash paper, presented at IEEE Security and Privacy in 2014 by Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer and Madars Virza. It showed how to use zk-SNARKs for payments on a Bitcoin-style ledger that hide where money came from, where it went and how much moved.

Zcash launched on October 28, 2016, built by the Zerocoin Electric Coin Company, which renamed itself the Electric Coin Company in 2019. The economics copy Bitcoin's: proof-of-work mining (using an algorithm called Equihash) and a hard cap of 21 million coins.

How a shielded payment works

Zcash has two kinds of addresses.

Transparent addresses work like Bitcoin. Everything's public.

Shielded addresses hide the sender, the receiver and the amount. Shielded funds live as encrypted "notes." When you spend one, your transaction carries a zk-SNARK proving four things at once:

• The notes you're spending exist on the chain.
• You hold the keys to spend them.
• They haven't been spent before. Each spend publishes a unique tag called a nullifier, and the network rejects any repeat.
• What goes in equals what comes out, so nobody prints money.

The network checks the proof and records the transaction without learning who paid whom or how much. The sender can include an encrypted memo only the recipient can read. Since 2022, unified addresses bundle the different receiver types into one address, so users don't have to pick.

Two caveats. Moving funds between transparent and shielded addresses exposes the transparent side, including the amount. And privacy depends on the crowd. A 2018 USENIX Security study by George Kappos and colleagues found that simple patterns let them tie 69% of shielded-pool activity to miners and founders, which shrank the real anonymity set for everyone else. Shielding was optional then, and few people used it.

That's changed. As of late 2026, close to 30% of ZEC sits in shielded pools, the highest share on record by The Block's tracking.

Viewing keys: the compliance feature

This is the part I'd want every compliance officer to understand.

Zcash separates the right to spend from the right to see. A viewing key lets someone read a shielded address's transactions without being able to move the funds. An incoming viewing key shows funds received. A full viewing key also shows spends, and normally the recipient and amount of each payment. Two limits matter for an audit: incoming payments never reveal who sent them, and the spender's wallet can choose to leave the outgoing details out. A viewing key is a strong audit tool, not a complete record of counterparties.

So a fund can hold shielded ZEC and give its auditor a viewing key. A custodian can keep coins in cold storage and still watch deposits. A holder can answer a regulator's request without publishing their history to the world.

The privacy is opt-out per relationship, not all-or-nothing. That's the model I'd point to when someone says privacy and compliance can't coexist. It doesn't make Zcash compliant on its own, though. Someone still has to ask for the key, and the holder still has to hand it over.

Four pools, three setups, two bugs

The proving system under Zcash has changed three times. Each change is a lesson in how ZK systems age.

Sprout proved it could work. The setup was a six-person ceremony held October 21 to 23, 2016, each participant in a different place on their own hardware. If all six had colluded or been compromised, they could have counterfeited coins undetectably. One honest participant was enough to make it safe.

Sapling made it practical. It cut the time to build a shielded transaction by about 90% and memory use by more than 97%, down to as little as 40MB. Phones could do it. Its setup drew on many more participants, starting with a Powers of Tau ceremony the Zcash Foundation ran from November 2017 to April 2018.

Sapling also quietly fixed the first counterfeiting bug. On March 1, 2018, ECC cryptographer Ariel Gabizon found a flaw in the Sprout proving system's setup that would've let a cheating prover forge a valid-looking proof. The team kept it secret, shipped the fix inside Sapling, and disclosed it on February 5, 2019. They said they'd found no evidence anyone else discovered it or that counterfeiting occurred.

Orchard removed the ceremonies. It shipped with the NU5 upgrade on May 31, 2022, using Halo 2, a proving system with no trusted setup. No toxic waste. Nobody to trust.

Then the second bug. In late May 2026, Taylor Hornby of Shielded Labs found a soundness flaw in Orchard's circuit that could, in theory, have allowed counterfeit ZEC. Analysts concluded it was likely never exploited, but here's the uncomfortable part: in a shielded pool you can't watch counterfeiting happen. You can only see, eventually, that the supply doesn't add up.

Ironwood is the response. The NU6.3 upgrade activated on July 28, 2026. It sealed Orchard to new deposits, opened a new pool with a corrected and formally verified circuit, and added notes designed to be recoverable if quantum computers arrive. Funds leaving Orchard pass through a "turnstile," an accounting rule that stops more ZEC from leaving a pool than verifiably went in. If anyone did counterfeit, the shortfall shows up at the turnstile instead of silently inflating the total supply.

That's a boundary control. When you can't inspect inside the system, you reconcile what crosses its edges. Auditors have done that for a century. Zcash rebuilt it in cryptography.

Governance is part of the risk

Protocols don't run themselves. On January 7, 2026, the entire Electric Coin Company team resigned after a dispute with Bootstrap, the nonprofit board that governed ECC, over plans to take its Zashi wallet private. The same people formed the Zcash Open Development Lab (ZODL), raised more than $25 million from investors including Paradigm and a16z crypto, and renamed the wallet Zodl. ZEC fell sharply on the news.

The protocol kept running, and ZODL engineers did much of the Ironwood work alongside the Zcash Foundation, Shielded Labs and others. Still, if you're assessing any ZK system, ask who maintains the circuits and what happens if they leave.

Where regulators land

Zcash sits in two places at once, as of November 2026.

In the US, Grayscale converted its Zcash Trust into a spot ETF. It began trading on NYSE Arca under ZCSH on August 25, 2026, with more than $300 million in assets carried over from the trust.

In the EU, Article 79 of the Anti-Money Laundering Regulation bars banks, financial institutions and crypto-asset service providers from keeping anonymous accounts, or accounts that let transactions be anonymized, including through anonymity-enhancing coins. It applies from July 10, 2027. The law doesn't name Zcash, but exchanges serving the EU are widely expected to delist privacy coins before then.

Same asset. One regime lists it on a stock exchange; the other is pushing it off regulated platforms.

What this means if you're regulated

If clients hold ZEC, directly or through the ETF, your exposure is ordinary crypto risk plus one question: can you see what you're responsible for? For direct holdings, that means a written policy on which pool, who holds viewing keys, and how you answer a records request.

If you're weighing shielded payments with counterparties, AML monitoring depends on viewing-key access and cooperative counterparties. Transaction-monitoring tools built for transparent chains won't see inside the pool. Plan for that, and check where each counterparty sits on the EU deadline.

If you're evaluating ZK for anything else, read Zcash's history as a vendor due-diligence checklist. Who ran the setup? Has the circuit had a soundness bug? Is it formally verified? What's the boundary control if the proof system fails? Who maintains it, and what if they walk?

None of this is investment advice. It's a ten-year field test. Twice, a flaw that could have allowed counterfeiting reached production: once in the Sprout proving system's setup, once in Orchard's circuit. Both were found and fixed with no known exploitation. In a shielded pool, "no known exploitation" is the strongest claim anyone can make.

For the cryptography underneath, read the zk-SNARKs deep dive. For the transparent, hash-based alternatives Zcash didn't choose, see the STARKs and post-quantum post. And for how ZK shows up in DeFi and compliance more broadly, see ZK in finance.