Zcash (ZEC): UTXO Chain with Halo2 zkSNARK Shielded Pools
Zcash (ZEC) launched 2016-10-28 as the first production zkSNARK-based privacy coin. It is a UTXO chain secured by Equihash Proof-of-Work, with three transaction pools — transparent (t-addr), Sapling (zs-addr), and Orchard Unified (u-addr) — letting users selectively shield value behind Halo2 zero-knowledge proofs. Zcash has no general-purpose smart contracts and a minimal $1.47M on-chain TVL, but holds an architectural niche no other Layer 1 fills: production-grade shielded payments with no trusted setup.
Zcash is not trying to be Ethereum, Solana, or even Bitcoin. It is a single-purpose privacy money layer. The chain runs Equihash PoW with a 75-second target block time and waits roughly 30 confirmations — about 2,250 seconds, or 37.5 minutes — before a transfer is considered economically final. Throughput sits around 5 typical TPS with a 25 TPS theoretical ceiling, deliberately small because every shielded transfer carries a zero-knowledge proof. What you get in exchange is real cryptographic confidentiality: amounts, sender, and receiver are hidden inside the Orchard shielded pool, secured by Halo2 — a recursive SNARK with no trusted setup, activated in the NU5 upgrade on 2022-05-31. The chain serves a narrow but unreplaceable audience: holders who treat ZEC as private digital cash, journalists and dissidents needing audit-resistant payments, and institutions exploring selective-disclosure compliance via viewing keys. It is not a smart-contract platform, not a DEX home, and has effectively zero DeFi TVL. For cross-chain users, the relevant fact is that ZEC sits outside EVM, outside Cosmos IBC, and outside most bridge networks — moving it in or out requires either a centralized exchange or a non-custodial cross-chain swap router that supports the UTXO model. AllSwap routes ZEC through intent-based liquidity, treating Zcash as a native settlement endpoint rather than a wrapped synthetic.
About Zcash
Zcash launched on 2016-10-28 as a fork of the Bitcoin codebase, but its design intent was opposite to Bitcoin's radical transparency. Founders Zooko Wilcox and the Electric Coin Company set out to fix Bitcoin's surveillance problem by embedding zero-knowledge proofs at the protocol layer. The original launch used the Sprout shielded pool, which required a multi-party trusted setup ceremony — a notable cryptographic risk that took six years to fully retire. The chain has since gone through Sapling (2018, much cheaper shielded transactions), NU5 (2022-05-31, Orchard pool + Halo2 with no trusted setup) and NU6 (2024-11-23, activated alongside the second halving). Today the Sprout pool is deprecated and Orchard is the recommended shielded standard.
Consensus is Equihash Proof-of-Work under Nakamoto rules. Equihash is a memory-hard mining algorithm chosen to resist ASIC centralization, though ASIC miners eventually arrived and now dominate hashrate. Blocks target 75 seconds — about 8x faster than Bitcoin — and economic finality is conventionally treated as 30 confirmations, roughly 2,250 seconds or 37.5 minutes. This is far slower than any BFT chain in the peer set, but it is the price of probabilistic PoW security inherited from the Bitcoin lineage. Block reward followed Bitcoin-style halvings; the second halving in November 2024 cut issuance and bundled in NU6 protocol changes.
Zcash's virtual machine is, strictly speaking, not a VM at all — the chain uses an extended UTXO model with three transaction pools. Transparent transactions behave like Bitcoin (t-addresses, fully public). Sapling shielded transactions use BLS12-381-based Groth16 proofs. Orchard, the current-generation pool, uses Halo2 — a recursive zkSNARK over the Pallas/Vesta curve cycle that requires no trusted setup, eliminating the historical Sprout/Sapling ceremony risk. Unified Addresses (u-addresses) combine multiple receiver types in one string, letting senders auto-select the most private pool the recipient supports. There is no general smart contract layer, no EVM, no DeFi composability — and that simplicity is intentional. Less surface area means a smaller cryptographic attack window.
Economically, ZEC is a fixed-supply asset capped at 21,000,000 — matching Bitcoin's hard cap. A portion of block rewards was historically routed to the Electric Coin Company, Zcash Foundation, and Major Grants under the Dev Fund, with the allocation renegotiated at each halving. The native token serves three functions: gas for transactions, miner subsidy, and the unit of account inside shielded pools. There is no staking yield — PoW chains do not have one — and no native lending market. On-chain TVL sits at $1.47M, effectively zero by DeFi standards, because Zcash has no programmable layer for liquidity protocols to deploy on. That is the deliberate trade: privacy and simplicity over composability.
Zcash technical parameters
Zcash's technical stack is unusual in the L1 landscape because it makes the opposite choice from every chain launched after 2017: no general smart contracts, no PoS, no BFT finality. Instead it doubles down on UTXO + zero-knowledge cryptography. Understanding Zcash means understanding why that trade was made and what the numbers — 75-second blocks, 2,250-second finality, 5 TPS typical — actually mean in practice.
| Consensus | PoW (Equihash, Nakamoto consensus) |
|---|---|
| VM | UTXO + Halo2 zkSNARK shielded pool (no general smart contracts) |
| Block time | 1.3 min |
| Finality | 37.5 min |
| TPS | 5 typical / 25 max |
| Gas token | ZEC |
| Launched | 2016-10-28 |
| Token standard | ZEC (transparent + Sapling + Orchard shielded pools) |
| Address | Transparent (t-addr) / Sapling (zs-addr) / Orchard Unified (u-addr) |
Consensus mechanism
Zcash runs Equihash Proof-of-Work under Nakamoto consensus, the same probabilistic-finality model Bitcoin pioneered. Miners race to find a hash satisfying the current difficulty target; the longest valid chain wins. Equihash differs from Bitcoin's SHA-256 in that it is memory-hard — solving it requires roughly 144 MB of RAM, originally chosen to keep mining accessible to consumer hardware. In practice, dedicated Equihash ASICs (from Bitmain, Innosilicon and others) emerged within about 18 months of launch and now dominate hashrate, so the egalitarianism argument no longer holds. Blocks target 75 seconds, meaning new transactions confirm in roughly half the time of an LTC block and one-eighth the time of a BTC block. Finality is probabilistic: a transaction is conventionally considered safe after 30 confirmations, about 2,250 seconds (37.5 minutes). This is far slower than the sub-second finality of Sui, Aptos, or Hyperliquid, but it provides PoW security guarantees — reversing a confirmed transfer requires an attacker to outpace the entire honest hashrate from 30 blocks back, an enormous economic cost. The chain has no slashing, no validator set, no committee, and no liveness assumption beyond miners earning fees and subsidy.
Performance context
Five TPS typical, 25 TPS theoretical maximum — these are small numbers, and they are small for a reason. A shielded Orchard transaction carries a Halo2 zkSNARK proof in the megabyte range and takes seconds to generate on consumer hardware. The chain is bandwidth-limited not by consensus but by the cost of carrying proofs and the cost of verifying them at every full node. Compare this to Solana's 3,000 typical TPS or even Bitcoin's 7 TPS, and Zcash sits in the smallest cohort. But the question is not how many memes-per-second the chain can route — it is whether a shielded private transfer settles. For that use case, 5 TPS is sufficient: privacy payments are not high-frequency. The cost of a shielded transfer is also non-trivial — fees are low in absolute ZEC terms, but proof-generation time and storage bloat are the real costs. Anyone evaluating Zcash on raw throughput is evaluating the wrong axis.
Zcash ecosystem map
Zcash's ecosystem looks nothing like an EVM chain's. There are no DEXes deployed on it, no lending protocols, no perpetuals venues — because there is no smart contract layer for them to deploy on. The honest map of the ZEC ecosystem is wallets, shielded-pool tooling, exchange integrations, and the protocol research community itself. On-chain TVL sits at roughly $1.47M, effectively a rounding error compared to any DeFi L1.
Wallet
Zashi is the Electric Coin Company's flagship mobile wallet, shipping Orchard-first UX with Unified Addresses by default. Ywallet supports cross-pool sweeping and shielded sync optimizations. Zecwallet (legacy) remains in use, and hardware-wallet support via Ledger and Trezor covers the transparent-address custody path.
Infrastructure
Lightwalletd is the canonical light-client backend, letting mobile wallets sync Sapling and Orchard blocks without running a full node. zcashd is the reference implementation; Zebra is the ZF-maintained Rust full node providing implementation diversity — a meaningful defense against single-codebase consensus bugs.
Infrastructure
Halo2 — the proof system activated in the NU5 upgrade (2022-05-31) — is itself a major piece of cryptographic infrastructure now reused outside Zcash, including by other zk-rollup projects. NU6 (2024-11-23) bundled protocol changes alongside the second halving and refined the Dev Fund allocation model.
Bridge
Zcash has no native general-purpose bridge — the lack of smart contracts and the UTXO model make standard lock-mint bridge designs awkward. Cross-chain liquidity is served by exchange-routed paths and intent-based non-custodial cross-chain swap routers that treat ZEC as a native settlement endpoint rather than a wrapped synthetic.
Zcash vs peers
The peer category is 'Privacy chains', and the data set contains only two members: Zcash (zec) and Aleo (aleo). They take radically different approaches to the same problem, which makes the comparison sharp.
| Chain | Block | Finality | TPS | TVL |
|---|---|---|---|---|
| Zcashcurrent | 1.3 min | 37.5 min | 5 | $1.47M |
| Aleo | — | — | — | $0.00 |
Comparison insights
- Production maturity: Zcash launched 2016-10-28 and has nearly ten years of mainnet operation, three major upgrades (Sapling, NU5, NU6), and a working Orchard pool used by real wallets. Aleo launched its mainnet on 2024-09-19 and is roughly 20 months old as of this writing. ZEC has the operational track record; Aleo has the modern design space.
- Architecture: Zcash is UTXO + shielded pools with no general smart contracts. Aleo runs snarkVM, a zkSNARK-native execution environment with the Leo programming language, aiming to make every transaction a zero-knowledge proof of an arbitrary program. Aleo is therefore programmable in a way Zcash explicitly is not. The trade-off is complexity: a programmable zk runtime is a much larger attack surface.
- Consensus: ZEC uses Equihash PoW under Nakamoto consensus — probabilistic finality, no validator set, no slashing. Aleo combines AleoBFT (Bullshark/Narwhal DAG-based PoS) with a coinbase puzzle for issuance. Aleo's finality model is BFT-style, while Zcash's is probabilistic; that means Aleo can theoretically settle faster but adds a validator-set trust assumption Zcash does not have.
- Performance and benchmarks: Zcash publishes 5 typical TPS and 25 theoretical max. Aleo's typical TPS is not yet publicly benchmarked, and its theoretical ceiling is cited at 20,000 TPS — a number reflecting design ambition rather than measured mainnet throughput. Block time and finality numbers for Aleo are not yet stable enough to quote directly.
- Liquidity and adoption: Zcash carries $1.47M of on-chain TVL and Aleo carries effectively $0 TVL. Both are minimal by DeFi standards, which is consistent with privacy chains not optimizing for DeFi composability. The relevant adoption metric is shielded-pool usage and exchange listings, not lending markets.
Zcash timeline
Zcash mainnet launched on 2016-10-28 as a fork of Bitcoin's codebase, with Zooko Wilcox and the Electric Coin Company shipping the first production zkSNARK shielded pool — Sprout. The Sprout launch required a multi-party trusted setup ceremony, a known cryptographic risk that has since been completely retired. The Overwinter and Sapling network upgrades in 2018 introduced a much more efficient shielded pool using BLS12-381 Groth16 proofs, reducing shielded transaction cost by orders of magnitude and making mobile shielded wallets practical for the first time. The NU5 upgrade on 2022-05-31 was the most significant protocol change in Zcash's history — it introduced the Orchard shielded pool secured by Halo2, a recursive zkSNARK over the Pallas/Vesta curve cycle that requires no trusted setup at all. Halo2 also enabled Unified Addresses, which bundle multiple receiver types into a single string. The NU6 upgrade activated on 2024-11-23 alongside the second Bitcoin-style halving, cutting block subsidy and refining the Dev Fund allocation among the Electric Coin Company, Zcash Foundation, and Major Grants program. Throughout this history, Zcash has been honest about a recurring set of constraints: shielded-pool usage has historically been a minority of transactions because transparent transfers are cheaper and faster, ASIC mining centralized hashrate against original design intent, and the chain has never developed a smart-contract ecosystem because that was never the goal. There have been no major consensus-level exploits or chain halts of the kind that affected high-throughput L1 peers — the simplicity of the UTXO + PoW design has been a security feature in practice. The ongoing debate inside the Zcash community is whether to migrate to PoS, how aggressively to push shielded-by-default, and how to grow shielded-pool adoption against centralized-exchange listing pressure that often requires transparent addresses.
- 2016-10-28launchZcash mainnet launch
- 2022-05-31upgradeNU5 upgrade — Halo2 + Orchard shielded pool
- 2024-11-23upgradeNU6 upgrade activated alongside 2nd halving
Developer reference
Zcash is a UTXO chain, so developer mental models from Bitcoin transfer directly while EVM intuitions do not. There is no public official RPC URL — the project does not run hosted RPC infrastructure; developers run zcashd (the C++ reference client) or Zebra (the Rust full node maintained by Zcash Foundation), both of which expose a Bitcoin-compatible JSON-RPC interface. For lightweight wallet integration, the canonical backend is lightwalletd, which serves Sapling and Orchard block ranges to mobile clients. The primary block explorer is blockchair.com/zcash. Address formats are three-tier: transparent t-addresses (Bitcoin-style), Sapling zs-addresses, and Orchard Unified u-addresses that can wrap multiple receiver types. Protocol specifications live at zips.z.cash (Zcash Improvement Proposals). The library stack centers on librustzcash and the zcash-rust workspace for proof generation, address parsing, and note encryption. There is no Solidity, no general smart contract API, and no native bridge SDK — cross-chain integration runs through exchange APIs or non-custodial cross-chain swap routers that speak the UTXO model directly. Hardware wallet support covers transparent addresses on Ledger and Trezor; shielded-pool hardware support is more limited.
Assets swappable on Zcash
Grouped by category. Click any asset to open its swap page for a live quote.
Majors
1 assets
Zcash settle-time comparison
Shorter bars mean faster confirmations. Real settle time also depends on network congestion — figures are indicative.
Zcash asset coverage comparison
Longer bars mean more assets are swappable on that chain.
Zcash FAQ
01Is Zcash actually decentralized?
Mining is decentralized in the Nakamoto sense — anyone can mine Equihash and the longest valid chain wins — but in practice ASIC manufacturers (Bitmain, Innosilicon) dominate hashrate, mirroring Bitcoin's centralization profile. Protocol governance runs through the Electric Coin Company, Zcash Foundation and Zcash Community Grants, with Dev Fund allocation renegotiated at each halving.
02What is Zcash's finality time?
Finality is probabilistic, not absolute. Block time targets 75 seconds, and economic finality is conventionally treated as 30 confirmations — about 2,250 seconds (37.5 minutes). This is much slower than BFT-finality chains like Sui or Aptos but provides PoW security guarantees inherited from Bitcoin lineage.
03Does Zcash support smart contracts or DeFi?
No. Zcash is a UTXO chain with three shielded pools (transparent, Sapling, Orchard) and no general-purpose smart contract layer. There is no EVM, no Move VM, no WASM runtime. On-chain TVL is roughly $1.47M, effectively zero, because there are no DeFi protocols to deploy. That simplicity is intentional — less attack surface, smaller cryptographic footprint.
04What is the difference between transparent and shielded Zcash transactions?
Transparent (t-addr) transactions are fully public, behaving like Bitcoin — amounts, senders and receivers are visible on-chain. Shielded transactions in the Sapling (zs-addr) and Orchard (u-addr) pools hide amounts, sender and receiver inside a zkSNARK proof. Unified Addresses let senders auto-select the most private pool the recipient supports.
05Is Zcash quantum resistant?
Not currently. Halo2 — the Orchard pool's proof system — relies on the discrete-log assumption over the Pallas/Vesta curve cycle, which is vulnerable to large-scale quantum computers. The shielded transaction graph would also be unwound if the underlying commitment scheme broke. Post-quantum migration is a long-term research topic for the Zcash protocol team but no production transition is currently scheduled.