Zcash (ZEC): A Privacy Coin on Math
From a Johns Hopkins research paper to a top-ten cryptocurrency with a Wall Street ETF: how Zcash was built, and why it's stronger for surviving scrutiny.
Every privacy coin makes the same promise. Zcash made it with a peer-reviewed proof attached, launched by the academics who wrote it, and then spent the next decade discovering, in public, exactly where the proof was weaker than they thought.
That is not a knock. It is the most interesting thing about the project. Zcash has been cracked open by its own researchers twice, bogged down by a $10-a-day spam attack, watched its founding company’s entire team walk out in a boardroom dispute, and been delisted from exchanges on three continents. It has also shipped a large body of original cryptography, removed the single biggest weakness in its design, become the first privacy asset with a spot ETF on a US exchange, and, as of mid-September 2026, trades around $1,140 with a market value near $19 billion. Here is how a research paper became all of that.
A Paper Before a Coin
Zcash begins in a university, not a forum. In 2013, Johns Hopkins researchers Ian Miers, Christina Garman, Matthew Green, and Aviel Rubin published Zerocoin, a proposal to bolt anonymous payments onto Bitcoin. It worked in theory and was far too slow in practice. A year later, they joined forces with Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, and Madars Virza, researchers from the Technion, MIT, and Tel Aviv University, and produced the paper that actually mattered: “Zerocash: Decentralized Anonymous Payments from Bitcoin,” presented at the IEEE Symposium on Security and Privacy in May 2014.
The paper’s starting point is blunt. Bitcoin’s “payment transactions are recorded in a public decentralized ledger, from which much information can be deduced.” Its answer was to hide everything that mattered: the sender, the receiver, and the amount. The mechanism has three parts. A coin is recorded on the chain only as a cryptographic commitment, a sealed envelope that reveals nothing about what is inside. Spending it publishes a serial number, called a nullifier, that cannot be linked back to the envelope it came from, which prevents double-spending without exposing which coin was spent. And a zero-knowledge proof, a zk-SNARK, convinces the network that the whole transaction is valid without disclosing a single detail of it.
The engineering leap over Zerocoin was enormous. Proofs shrank to under a kilobyte, about 98 percent smaller, and verification dropped from roughly 450 milliseconds to under 6. That was the difference between a clever idea and something a blockchain could run.
Zooko Wilcox-O’Hearn, a cryptographer with roots going back to the DigiCash era, turned the paper into a company. The Zerocoin Electric Coin Company raised more than $3 million from investors including Naval Ravikant, hired several of the paper’s authors, and launched Zcash on October 28, 2016. The launch was chaotic in a way only 2016 crypto could manage: with almost no coins in existence yet thanks to a deliberate “slow start” that ramped mining rewards over the first 20,000 blocks, ZEC briefly traded for more than 3,000 bitcoin per coin on Poloniex before crashing back to a fraction of that the same day. Depending on which price aggregator you trust, the all-time high printed that week sits somewhere between $3,000 and $6,000 per ZEC. Nobody has ever paid that again.
Two design choices from the paper survive unchanged. The supply is capped at 21 million, with Bitcoin-style halvings roughly every four years; the second halving arrived in November 2024, and the next is due around November 2028. And privacy is optional. Zcash has transparent addresses that work exactly like Bitcoin’s and shielded addresses that use the zero-knowledge machinery. That choice made the coin easier for exchanges to list and, as we will see, harder to make actually private.
The Toxic Waste Problem
The zk-SNARKs that made Zerocash possible came with a catch that its critics never let anyone forget. Generating the system’s public parameters required a secret, and anyone who possessed that secret could forge proofs and mint unlimited counterfeit ZEC without detection. The secret had to be created and then destroyed, and the world had to take it on faith that it was.
Zcash’s answer was a ceremony. In October 2016, six participants in six locations, including Bitcoin developer Peter Todd and, as was revealed in 2022, Edward Snowden under a pseudonym, each generated a piece of the secret on air-gapped machines and destroyed it. As long as one of the six was honest, the parameters were safe. A second, larger ceremony for the 2018 Sapling upgrade drew roughly 180 contributions; two participants famously seeded their randomness with radioactive material on a flight so that no adversary could predict it.
The ceremonies were rigorous, but they were still a trust assumption in a system whose entire purpose was to remove trust assumptions. Fixing that took three years of research. In 2019, Zcash cryptographers Sean Bowe, Jack Grigg, and Daira Hopwood published Halo, a technique for recursive proof composition that needed no trusted setup at all. Its successor, Halo 2, went live in May 2022 with the NU5 upgrade and a new shielded pool called Orchard. Zcash’s most cited weakness was, at that point, gone. ECC’s announcement was measured: removing trusted setups “presents a substantial improvement in safety for upgradeable protocols.” In practice it was a landmark result, and Halo 2 is now used well beyond Zcash.
Ten Years of Upgrades
The project has shipped a network upgrade roughly every year since launch, each with a name and a purpose.
Sapling, October 2018. The upgrade that made shielded transactions usable. Constructing one had taken about 40 seconds and three gigabytes of memory; Sapling brought that down to a few seconds and around 40 megabytes, enough for a phone.
Blossom, December 2019. Block time cut from 150 seconds to 75.
Heartwood and Canopy, 2020. Miners could receive rewards directly into shielded addresses; the first halving arrived; and the original Founders’ Reward ended, replaced by a community-negotiated development fund.
NU5, May 2022. Halo 2 and the Orchard pool, plus unified addresses so that wallets could default to shielded receipt without users needing to understand the difference.
NU6 and NU6.1, 2024 and 2025. The second halving, a new development-fund structure, and, for the first time, direct coinholder votes on how protocol funds get spent.
NU6.2 and NU6.3 (Ironwood), June and July 2026. An emergency fix and then a brand-new shielded pool, for reasons covered below. Ironwood also introduced early quantum-resistance protections and shipped with more than 2,700 formally verified theorems behind its circuits, which is not a sentence one gets to write about most cryptocurrencies.
NU7, approved by coinholders. A coinholder vote that closed on September 14, 2026 asked holders to decide, among other things, whether to keep the halving schedule or smooth issuance, whether to cut block time to 25 seconds, and whether to retire the original 2016 shielded pool. Holders backed it: 99.9 percent of the roughly 2.4 million ZEC that voted favored cutting block time to 25 seconds, 98.9 percent voted to keep the halving schedule, and about 99.3 percent voted to ship NU7 as soon as feasible.
Underneath all of that, the original node software, zcashd, reached end of life in July 2026. The network now runs on Zebra, a Rust implementation built by the Zcash Foundation. Very few coins have replaced their reference client while running, and Zcash did it without a hitch.
The Money Question
Zcash’s funding model has been controversial from the first block, and it is worth walking through.
For the first four years, 20 percent of every block reward went to the Founders’ Reward, a pool split among the company, its investors, its employees, and the Zcash Foundation. That works out to about 10 percent of all ZEC that will ever exist, allocated to insiders. Bitcoin purists called it a premine by another name. Supporters argued it was the only practical way to pay a team of world-class cryptographers to build something this hard, and that it was disclosed on day one.
When the Founders’ Reward expired in 2020, the community fought over what came next and settled on ZIP 1014: a further 20 percent of block rewards for four more years, split among the Electric Coin Company, the Zcash Foundation, and a new grants program. In 2024 the community renewed the idea but changed the shape, sending 8 percent to community grants and 12 percent into a lockbox with no spending mechanism attached at all. A year later, the NU6.1 upgrade put that lockbox under a multisig held by independent organizations and gave coinholders a direct vote on disbursements. Zcash is, as a result, one of the very few networks whose holders decide how the protocol’s own treasury is spent.
The governance side has been rockier than the code. Zooko stepped down as CEO of the Electric Coin Company in December 2023, with ZEC trading at about $29, and handed the role to Josh Swihart. In January 2026, the entire ECC team resigned at once after a dispute with the board of its nonprofit parent over whether the company could take outside investment; Swihart said the team had been “constructively discharged.” The board disputed that, saying the issue was compliance with nonprofit law around outside investment in Zashi. Within two months Swihart had raised $25 million from Paradigm, a16z crypto, Winklevoss Capital, and Coinbase Ventures for a new for-profit developer, the Zcash Open Development Lab, and relaunched ECC’s Zashi wallet as Zodl. The Zcash Foundation took over the project’s GitHub organization, website, and social accounts in May. Zooko himself now leads product at Shielded Labs, a Swiss nonprofit.
Read one way, that is a founding company falling apart. Read another, it is a project that lost its central organization and kept shipping, because five independently funded groups, the Foundation, Zodl, Shielded Labs, Project Tachyon, and Valar Group, now share the work that ECC once did alone. A network that survives the loss of its founding company’s entire team is showing real decentralization in practice. It took Zcash a decade and a crisis to prove it.
Where the Privacy Actually Failed
This is the section a critical evaluation has to earn, and Zcash gives it plenty to work with.
Nobody used the shielded pool. For years, optional privacy meant no privacy. A 2018 study by researchers at University College London analyzed 2.2 million Zcash transactions and found that founders and miners “account for around 66% of the value drawn from the shielded pool,” that founders’ withdrawals of exactly 250.0001 ZEC were trivially identifiable, and that “it is also possible to shrink its anonymity set considerably by developing simple heuristics.” Most ZEC sat in transparent addresses that were no more private than Bitcoin. As late as early 2024, only about 8 percent of the supply was shielded.
The counterfeiting bug of 2018. In March 2018, cryptographer Ariel Gabizon discovered that the original parameter-generation process had left a flaw that would let an attacker forge proofs. ECC’s own disclosure put it plainly: before the fix, “an attacker could have created fake Zcash without being detected.” Four people knew. They fixed it silently in the Sapling upgrade that October and told the world in February 2019, arguing that disclosure before the fix would have been an invitation. No evidence of exploitation was ever found, but the episode proved that the trusted-setup critics had been right about the category of risk.
Sandblasting. Starting in June 2022, an attacker began flooding the chain with shielded transactions, at an estimated cost of about ten dollars a day, taking monthly shielded outputs from about 42,000 to more than 21 million. Wallets could not sync, the chain tripled in size, and ECC spent sixteen months in a self-declared “emergency mode” rewriting fee rules and wallet synchronization. The network was never insecure, but for over a year it was barely usable for the exact people it was built for.
The counterfeiting bug of 2026. On May 29, 2026, Taylor Hornby of Shielded Labs found that a component of the Orchard circuit, live since May 2022, was under-constrained in a way that would allow “unlimited, undetectable counterfeit ZEC.” Because the pool is private, there is no cryptographic way to prove it was never exploited. The response was fast and drastic: an emergency soft fork froze all Orchard activity within days, NU6.2 patched the circuit, and Ironwood replaced Orchard entirely in July with a “turnstile” that caps withdrawals from the old pool at what verifiably went in. ZEC fell to roughly $310 on the news. It had nearly tripled by the end of August.
Two things are true about that list. It is longer and more serious than the equivalent list for most top-ten coins. And every item on it was found and fixed by people inside the Zcash ecosystem, disclosed publicly, and resolved with a protocol upgrade rather than a press release. A project that ships novel cryptography will have novel bugs. The question is what it does with them, and Zcash’s record there is unusually good.
The Turn
For most of its life, Zcash was a respected research project with a middling coin. In 2025 that changed.
Shielded usage finally moved. Zashi, ECC’s shielded-by-default wallet launched in 2024, drove a surge into the Orchard pool. By mid-2026, about 30 percent of all ZEC sat in shielded addresses, up from 8 percent two years earlier, and shielded transactions reached nearly 60 percent of weekly transaction count at one point. As of mid-September 2026, roughly 4.9 million ZEC, about 29 percent of the 16.9 million in circulation, is shielded, most of it already migrated to the new Ironwood pool.
The market noticed. ZEC traded near $50 in September 2025. It crossed $600 by early November, peaked near $750, and then rode out the ECC crisis and the June counterfeiting scare before running to $1,000 in early September 2026, its first four-digit print since launch week in 2016. At roughly $1,140 and $19 billion as this is written, it is the tenth-largest cryptocurrency by market value.
Institutions moved with it. Grayscale converted its Zcash Trust into the Grayscale Zcash ETF, which began trading on NYSE Arca on August 25, 2026, the first spot privacy-coin ETF in the United States, and had grown to about $346 million in assets a week later. Winklevoss Capital led a $59 million placement to turn a Nasdaq-listed biotech into Cypherpunk Technologies, a treasury company that now holds about 1.9 percent of all ZEC and runs a mining fleet estimated at 18 percent of network hashrate. Tyler Winklevoss said, “If Bitcoin is digital gold, Zcash is encrypted bitcoin, or digital cash.” Arthur Hayes wrote in May 2026 that it was his largest holding after bitcoin, then sold his entire position on June 5 after the Orchard bug was disclosed. Gemini, which has supported shielded withdrawals since 2020, added unified-address support in 2025. The SEC, which had subpoenaed the Zcash Foundation in 2023, closed its investigation in January 2026 without taking action.
None of that was available to Monero, and that contrast explains a great deal. Zcash’s optional privacy, long criticized as a half-measure, turned out to be the feature that let regulated custodians, ETF issuers, and public companies hold it. Bitcoin-style transparent addresses gave compliance departments something to work with; the shielded pool gave everyone else the privacy. Whether that is a principled compromise or a convenient one depends on who you ask, but it is the reason a privacy coin is trading in a brokerage account.
The Case Against, Stated Fairly
Zcash is not a finished argument, and its headwinds are real.
Regulation remains hostile in much of the world. Japan and South Korea forced delistings years ago. OKX dropped ZEC in 2024, Binance put it to a “vote to delist” in 2025 that it survived (Binance later cleared it entirely), and India and Dubai’s financial free zone restricted privacy coins in January 2026. The European Union’s anti-money-laundering rules will bar regulated platforms from handling anonymity-enhanced coins from mid-2027. Transparent addresses soften the blow, but the coin’s core feature is still the thing regulators object to.
Privacy is still a minority behavior. Roughly 70 percent of ZEC remains in transparent addresses. A privacy coin where most of the money is not private has a smaller anonymity set than its design allows, and the research from 2018 has not stopped applying.
Complexity is a liability as well as a strength. Two counterfeiting vulnerabilities in eight years, both in the core proof system, are two more than a currency wants. The project’s answer, formal verification of the new Ironwood circuits and far more eyes on the code, is the right one, but the base rate of novel cryptography producing novel bugs has not changed.
Governance is young. The multi-organization structure that emerged after the ECC team’s exit has existed for months, not years. Coinholder voting has run a handful of times. Whether five independent groups can coordinate a network upgrade under pressure is a question NU7 is about to answer.
And mining concentration is quietly a concern: when one company’s fleet accounts for close to a fifth of the hashrate, the network’s proof-of-work security has a single point that did not exist a year ago. Shielded Labs’ Crosslink project, a hybrid proof-of-stake finality layer now in a productionization phase running through 2027, is partly a response to exactly this.
The Verdict
Zcash set out in 2014 to prove that digital cash could be fully private and fully verifiable at the same time, and it did. Everything since has been the harder work of turning a proof into a currency: making it fast enough for phones, removing the trust assumption, surviving spam and bugs and boardroom fights, and finally convincing enough people to actually use the private part.
The critical case is that it took ten years, that the privacy was optional for too long, and that the cryptography has needed rescuing twice. The positive case is that every one of those problems was solved in the open by the people who built it, that the coin now has the largest institutional footprint of any privacy asset by a wide margin, and that it continues to publish research, Halo, Tachyon, formal verification, post-quantum commitments, that the rest of the industry ends up borrowing.
A currency built by cryptographers was always going to be judged on its math. Zcash’s math has held up better than its critics predicted and worse than its founders hoped, which is roughly what real science looks like. What sets it apart is that it kept doing the science.
Read It Yourself
The original 2014 Zerocash paper is freely available from the Zerocash project and is far more readable than its reputation suggests. The Halo paper is on the IACR ePrint archive. Upgrade specifications, including NU7, are published at zips.z.cash, and the Zcash Foundation’s disclosures on the 2026 vulnerability and the Ironwood response are at zfnd.org. If you hold or use ZEC, read the primary sources rather than anyone’s summary, including this one.
A Note on This Article
This article is provided for general informational and educational purposes only. It is not financial, investment, legal, or tax advice, and nothing in it should be read as a recommendation to buy, sell, hold, or use Zcash or any other digital asset. The figures, dates, and descriptions above were drawn from publicly available sources, including academic papers, protocol documentation, and the published statements of the organizations involved, believed to be reliable at the time of writing, but markets, software, and organizations change quickly and the author makes no representation or warranty as to the accuracy, completeness, or timeliness of any of it. References to specific companies, products, researchers, executives, or institutions are for illustration and commentary only and do not constitute an endorsement or a criticism of any of them; every opinion expressed here is the author’s alone. Readers should not rely on this article in making any financial decision. Cryptocurrency carries real risk, including the risk of total loss, and anyone considering it should conduct their own independent research, review the relevant projects’ current disclosures directly, and consult a qualified professional before acting. Crypto Highlander and its author accept no liability for any loss or damage arising from the use of, or reliance on, the information contained here.