What it is. Zcash lets people send money privately, hiding who paid whom and how much, and many holders treat that privacy as permanent.
What we found. The privacy is only safe against today's computers; a powerful future computer could unmask every private payment ever made on this chain, all the way back to 2016, and the records that allow it are already saved forever and cannot be taken back.
Why it matters. Anyone whose private transactions were exposed later could face real harm, and the one fix being explored is still an early research idea that would protect future payments only, not past ones.
Halo 2 IPA over Pasta is Shor-broken via DL on Pallas/Vesta (NOT pairings); Sapling Groth16 + BLS12-381 is Shor-broken via pairings; note encryption ChaCha20-Poly1305 with KDF input via classical-EC ECDH is HNDL-vulnerable. Privacy users assumed 'anonymous forever'; cryptographic reality is 'anonymous-until-CRQC.' Project Tachyon is the only proposed mitigation, research-staged, no testnet.
Summary
Zcash is a Bitcoin-fork L1 (mainnet 2016-10-28) with optional zk-SNARK-shielded transactions. Sapling uses Groth16 + BLS12-381 + Jubjub (Shor-break via pairings); Orchard uses Halo 2 IPA over the Pasta cycle Pallas/Vesta (Shor-break via DL, not pairings). Note encryption is ChaCha20-Poly1305 with KDF input via ECDH on Jubjub/Pallas, HNDL-vulnerable. QRI 28 ± 5 (Band 3 Planning). Migration Stage 1 (Acknowledged). Forge subtotal (2a+2b+2c) 11/60. Decrypt subtotal (2d+2e) 6/40. Decrypt is the structural Zcash exposure: every shielded note ciphertext stored on-chain since 2016 can be decrypted post-Shor. Anonymity subtotal (3a+3b+3c+3e) 41/80. Confidentiality subtotal (3d+3f) 4/40. The 4/40 Confidentiality figure is the most significant single privacy-coin finding: shielded transactions can be retroactively de-anonymized once a CRQC exists. Project Tachyon (oblivious synchronization, removes ciphertext from chain) is the only mitigation proposed, research-staged, no testnet, NU7 inclusion not confirmed. ML-KEM and ML-DSA in active testing. ECC dev team resigned 2026-01-07; coordination capacity disrupted. All four Gates 1a fail; Mainnet-Traffic and Architecture-Execution-Gap caps both fire.
What the gates say
- Gate 1a, Hybrid signature: FAIL , no hybrid signature composition documented for transparent or shielded paths
- Gate 1a, Hybrid KEM: FAIL , no hybrid PQ KEM deployed for note encryption; ChaCha20-Poly1305 + ECDH only
- Gate 1b, Commit-to-hash: COND , no OR-composition declared
- Gate 2, Evidence reconstruction: PASS , every sub-score reconstructible from public artifacts, 3+ URLs each
- Gate 3, Primitive naming: PASS , every primitive named at the algorithm level, ECDSA-secp256k1, BLS12-381+Groth16, Halo 2 IPA over Pasta, ChaCha20-Poly1305, Jubjub, Pallas, Vesta, Sinsemilla, Poseidon Pow5
Burn-vs-rescue policy on file
Declared option f, Undeclared. Tachyon would migrate forward-looking shielded privacy via oblivious synchronization (no chain-stored ciphertext), but it does not retroactively rescue existing shielded notes. Existing ciphertexts on-chain are permanent and unprotectable. There is no STARK-rescue for existing notes. There is no freeze/burn proposal for vulnerable shielded value.
Seven dimensions
Each dimension scores 0–100 internally; the weighted roll-up produces the QRI.
1 Cryptographic Exposure weight 12% 28 / 100
Zcash publicly names every primitive in active use across transparent and shielded pools.
Transparent: ECDSA over secp256k1, SHA-256, RIPEMD-160 (P2PKH/P2SH inherited from Bitcoin fork) · Sapling shielded: Jubjub (twisted Edwards over BLS12-381 base field); BLS12-381 pairings + Groth16; Pedersen hashes; ChaCha20-Poly1305 AEAD note encryption with KDF over Jubjub ECDH · Orchard shielded: Pallas/Vesta (Pasta) cycle; Halo 2 with Inner Product Argument (IPA) polynomial commitments, no pairings; Sinsemilla, Poseidon (Pow5), and SHA-256 inside the circuit; ChaCha20-Poly1305 AEAD note encryption with KDF over Pallas ECDH Every signature, every shielded-proof soundness, every note-encryption KDF input is classical-EC. No PQ primitive deployed on mainnet.
ECDSA-secp256k1→ Shor-break-via-DL-without-pairingsJubjub→ Shor-break-via-DL-without-pairingsBLS12-381 + Groth16 (Sapling)→ Shor-break-via-pairingsPallas/Vesta + Halo 2 IPA (Orchard)→ Shor-break-via-DL-without-pairings (IPA, NOT pairings, but Shor-break-via-DL applies)ChaCha20-Poly1305 AEAD→ symmetric, Grover-weaken (256→128 bit)KDF input = ECDH on Jubjub (Sapling) / Pallas (Orchard)→ Shor-break-via-DL-without-pairingsSHA-256 / RIPEMD-160→ Grover-weaken
0 PQ families on mainnet. All deployed primitives are EC-DL or pairings-based; symmetric primitives weakened by Grover. Cryptographic-Diversity Cap (lattice-monoculture) does not apply because no lattice family is deployed either.
ECDSA-secp256k1 ≈ 128-bit classical, broken by Shor (no NIST PQ category); Jubjub/Pallas/Vesta ≈ 128-bit classical, Shor-break; BLS12-381 ≈ 128-bit classical, Shor-break-via-pairings. No deployed primitive maps to a NIST PQ category 1-5.
Halo 2 audited by Trail of Bits at NU5; March 2026 ZCG grant application by Veridise to formally verify the five Orchard gadgets and ZIP 224 in Lean 4, under review, $201,600 / 18 months. constant_time: librustzcash/zebrad implement constant-time arithmetic over Pasta. library_provenance: zcashd (deprecated end-of-life), zebrad (Zcash Foundation Rust node), librustzcash, halo2, multi-implementation. Cryptanalytic tier: Tier 1-2 (ECDSA classical; Halo 2 IPA Tier 3 research-grade in proof-system terms).
2 Quantum Recovery Exposure weight 10% 17 / 100
Transparent ZEC pool uses ECDSA-secp256k1 with full pubkey reveal at spend (P2PKH). Mempool reveal is observable. Shielded spends do not reveal a public key per se, but the spending authorization signature is RedDSA over Pallas (Orchard) or RedJubjub (Sapling), both classical-DL, Shor-forgeable. Reused transparent addresses and any Sapling/Orchard spend with publicly-revealed Halo2 verification key components lose forgery resistance post-Shor.
~9.5 years of unmoved transparent-pool ZEC at P2PKH/P2SH. Shielded pools (Sprout deprecated, Sapling, Orchard) hold notes whose spend authority is Pallas/Jubjub-bound and Shor-vulnerable. Lost coins are non-trivial (early-mining era cold storage).
Every historical Zcash signature back to genesis 2016-10-28 is forgeable post-Shor: transparent ECDSA, Sapling RedJubjub, Orchard RedDSA-Pallas. No SNARK-rescue mechanism is currently architected.
Validator gossip / RPC TLS uses standard X25519 / AES-GCM. No hybrid PQ KEM deployed.
CRITICAL. Every shielded note from 2016 onward is a ChaCha20-Poly1305 ciphertext blob stored on-chain, with the symmetric key derived via ECDH on classical curves (Jubjub for Sapling, Pallas for Orchard). A future quantum adversary executing Shor against the recipient's diversified transmission key can decrypt every historical shielded note ciphertext, recovering note value, recipient diversifier, and memo field. The 30-pt sub-score is the most significant single finding for Zcash. Mitigation pathway: Project Tachyon, proposed (not ratified, not on testnet), moves to oblivious synchronization, removing note ciphertext from the chain entirely. ML-KEM (Kyber) under active testing for note encryption.
3 Metadata, Anonymity & Confidentiality weight 25% 38 / 100
Shielded pool (Orchard) hides sender, recipient, and amount via zk-SNARK proofs. Transparent pool exposes graph fully. Shielded-to-transparent boundary leaks amounts. ZEC has measurable but minority shielded usage; transparent activity remains common. Strong-but-not-mandatory (Monero defaults all txs to ring-sig + RingCT).
(i) Top-3 RPC: ECC-operated and Zcash Foundation nodes, plus YWallet/Zashi-bundled servers. No published fraction; community-operated nodes exist. (ii) Mempool gossip: Bitcoin-derived gossip protocol, observable to peers. (iii) Validator metadata retention: undeclared (partial, node operators are independent, no formal policy).
Until 2026-04-24, Zcash had no native cross-chain bridge. THORChain enabled native ZEC swaps starting 2026-04-24, non-custodial without wrapping. Shielded-to-transparent unshield is required to enter THORChain liquidity, leaking that amount and timing. No mainstream wrapped-ZEC bridge in production.
CRITICAL FINDING. Halo 2 IPA over Pallas/Vesta is discrete-log-secure, not PQ-secure. A future quantum adversary breaks the soundness of every historical Orchard proof and the PK encryption protecting every Sapling/Orchard note ciphertext. Result: retroactive de-anonymization of every shielded transaction back to 2016-10-28 genesis. The Sapling protocol layer adds a second exposure: BLS12-381 pairings + Groth16 are also Shor-broken. Project Tachyon's oblivious-synchronization design is the only mitigation under discussion, research-staged, no testnet.
No structural mix-network. The shielded pool itself is the anonymity set (commit-reveal-style anonymity via zk-SNARK), but is not a mix-network with cover traffic. No cMix-class IT-secure shuffling. Off-chain wallet-side mixing (Zashi default behavior, transparent-address rotation in Q4 2025 roadmap) is wallet-policy-level mitigation, not protocol-level.
Every Sapling/Orchard note encrypted with ChaCha20-Poly1305 + ECDH on classical curves (Jubjub/Pallas). Tachyon design proposes to remove note ciphertext from the chain entirely (research-staged). ML-KEM 'active testing' for note encryption. Status: 'announced research, no testnet, no mainnet.' 3/20 = announced, not yet on testnet.
4 Migration Architecture weight 12% 61 / 100
Zcash has demonstrated cryptosystem migration: Sprout (BCTV14 zk-SNARK) → Sapling (Groth16 + BLS12-381 + Jubjub, NU2 2018-10-28) → Orchard (Halo 2 IPA + Pasta, NU5 2022-05-31). Each was a hard fork via the Network Upgrade Pipeline. Hot-swap without hard fork is not architected, every cryptosystem transition required a new shielded pool.
No account-abstraction stack; PoW chain with viewing-keys + spending-keys architecture. Orchard ivk/ovk/dk separation supports a partial key-rotation primitive (rotate diversified addresses), but spend-authority rotation requires new note creation. Q4 2025 ECC roadmap includes 'Transparent Address Rotation Feature' (auto-generates new transparent address after each receive). Client-layer PQC path (Tachyon, ML-KEM testing) is announced research, not deployed.
Eight network upgrades executed without contested fork: Overwinter (NU1), Sapling (NU2), Blossom, Heartwood, Canopy, NU5, NU6 (2024-11-23 mainnet), NU6.1 (planned activation height 3146400, ~2025-11-23). NU7 is in candidate-selection phase (NSM, ZSAs, Crosslink under consideration). Coordination historically smooth pre-2026; ECC team resignation Jan 2026 introduces coordination uncertainty.
No hybrid PQ deployment ratified. No ZIP currently proposes co-signing with classical + PQ. Tachyon design is a structural redesign rather than a hybrid, and is research-staged. ML-KEM is in 'active testing,' not specified for any NU.
N/A by default credit (stateless schemes). All proposed PQ candidates so far (ML-KEM, ML-DSA, hash-based STARK) are stateless. No XMSS/LMS proposal in scope.
Zcash is PoW (Equihash). No BLS aggregation in consensus. Crosslink (proposed PoS-finality layer for NU7+) would change this if shipped, but is in prototype. Per v3.0.1, 4f is N/A for non-aggregating-consensus chains. Renormalized to /80 → 49/80 → 61/100.
5 Deployment Execution weight 18% 12 / 100
Zero. No PQ primitive on mainnet for signatures, KEM, or proof system.
No merged PQ code in zebrad or zcashd consensus paths. Tachyon prototype work in research repos. ML-KEM testing internal at ECC.
PoW chain, no validators. Mining pools (ViaBTC ~32%, F2Pool ~16-19%) sign blocks via Equihash PoW; no signature scheme upgrade applies. N/A-equivalent under privacy-focused-chain rubric → score 0 (cannot earn PQ-key-adoption credit on a PoW chain).
VOIDED to 0 per v3.1 (5a = 0). Pre-void: ECC Q4 2025 roadmap published; Tachyon project page published. No PQ-specific dated milestone with enforcement mechanism (no NU activation height assigned to any PQ feature).
Announced PQC (trailing 12mo): Tachyon project page, blog, ECC Q4 2025 roadmap (no PQ items), ZCG formal-verification grant (defensive, not PQ), Bitfinex education article. Count ~5-6 mentions, mostly research-framed. Shipped PQC: 0 bytes signed under named PQ primitive on mainnet. Net: 11/15, Zcash is honest-research-framed, not narrative-only.
Undisclosed (no PQ signature scheme selected).
6 Supply Chain Vendor Readiness weight 18% 12 / 100
Top-3: Zashi (ECC; iOS/Android, primary), YWallet (Zcash + Ycash), Keystone hardware (Q4 2025 multisig integration). Ledger supports transparent ZEC only. None of Zashi, YWallet, or Keystone have a published PQC roadmap. Q4 2025 ECC roadmap focuses on transparent-address rotation and multisig; no PQ items.
Top: THORChain (native ZEC swaps activated 2026-04-24, non-custodial). No mainstream wrapped-ZEC bridge in production. THORChain has no published PQC roadmap. Zcash-Thorchain integration grant funded by ZCG.
Top: Coinbase Custody (transparent ZEC), Kraken, Binance, Anchorage. None publish ZEC-specific PQ MPC plans. Coinbase Quantum-Safe Custody efforts apply to BTC/ETH narratives; no Zcash-specific.
RPC: ZF-operated zebrad nodes, ECC-operated zcashd nodes (deprecated), wallet-bundled servers. No major Infura/Alchemy-class third-party RPC. HSM: Ledger transparent-only. No TEE attestation chains specific to Zcash. No PQC roadmap from any.
7 Governance & Coordination weight 5% 34 / 100
PoW Equihash. Top mining pools: ViaBTC ~31-32%, F2Pool ~16-19%, 2Miners ~7%, Antpool ~5%. ViaBTC has historically exceeded 51% (2024 reporting). Nakamoto coefficient ≈ 2-3 by hash rate. Concentration risk material.
Eight Network Upgrades smooth pre-2026. NU6 shipped 2024-11-23 with new dev-fund Lockbox model. NU6.1 planned 2025-11-23. NU7 in candidate selection. Post-ECC-resignation (Jan 2026) coordination capacity reduced; NU7 timeline uncertain.
Historically: ECC (CEO Josh Swihart through 2026-01-07), Zcash Foundation, Zcash Community Grants. 2026-01-07: entire ECC dev team resigned in governance clash with Bootstrap nonprofit board. ECC is regrouping under new architecture. Zcash Foundation now sole steward of trademark; Shielded Labs leads Crosslink work; QEDIT leads ZSA work. Coordination is multi-org; named-lead-with-public-mandate is partially fulfilled but disrupted.
Multiple historical dev-fund disputes (2020 ZIP-1014 vote). 2026-01 ECC mass resignation is a significant adversarial-internal-coordination event. Zcash has not coordinated a crypto change under active external attacker pressure.
None published. No quantum tripwire, no rate-limiting Hourglass equivalent, no canary cell embedded in consensus.
X + Y vs Z, when does the math turn against you?
v3.1 demotes the X+Y vs Z timing test to a secondary signal, the headline output is Migration Stage. The timing test still answers the question: can this chain finish migrating before the threat lands?
Verdict
X_priv (forever for already-on-chain ciphertexts) + Y reaches post-2030, Crisis Zone (vs Z10 2030); Outside risk window (vs Z25 2035)
Z-compliance
Outside compliance window, NIST IR 8547 2030 / 2035 deprecation/disallowance; Y > 2030 likely
Source-disagreement disclosure
v3.1 requires every chain card to publish material divergences among authoritative sources, plus the delta-QRI under alternative weighting.
Public market commentary (Bitget, Motley Fool, AInvest) frames ZEC as 'quantum-resistant'. This is inaccurate: Halo 2 IPA over Pasta is Shor-broken via DL on Pallas/Vesta; Sapling Groth16+BLS12-381 is Shor-broken via pairings; note encryption is HNDL-vulnerable. The retail 'quantum-resistant' narrative diverges from Bitfinex's own honest framing ('not yet fully quantum-resistant', 2025-11-24) and from Tachyon design rationale. LayerQu evaluation aligns with primary sources.
Re-weighting Dim 3 to 30% Anonymity / 5% Confidentiality (heavier-Anonymity view) → contribution 9.5 → 12.3 / 1.9 → 0.4; net QRI ≈ 28-29. Modest swing.
Delta-QRI under alternative weighting
Under Anonymity-heavier alternative weighting, QRI shifts to 28-29; band unchanged.
Announcement-to-shipped ratio
Announced: 5. Shipped: 0. Ratio: 0.
Tag: none, research-honest framing, no deduction. Treated as research-framed, not narrative-only (no missed-mainnet promises, no token-pumping language from foundation).
Peers in the privacy-focused chain profile
9 chains closest to Zcash by Stage then QRI.