Zcash protocol
Zcash is the first widely deployed cryptocurrency to offer fully private payments using zero-knowledge proofs. Launched in October 2016, it grew out of the academic Zerocash paper (2014) by a team including Eli Ben-Sasson, Alessandro Chiesa, Matthew Green, Ian Miers and Eran Tromer. Its key idea is a dual-address system: transparent t-addresses behave like Bitcoin, while shielded z-addresses live in a pool where sender, receiver and amount are concealed behind a zk-SNARK. Coins can move freely between the two worlds, which gives users a choice but also makes privacy optional rather than default.
The protocol has evolved through three generations of shielded technology, each a major upgrade. Sprout (2016) was the original, using the BCTV14 proof system; it was correct but slow and memory-hungry, and its trusted setup required an elaborate multi-party 'Ceremony' to generate the parameters such that no single participant learned the toxic-waste secret that could forge coins. Sapling (2018) replaced it with Groth16 proofs over the BLS12-381 curve, cutting proving time from minutes to well under a second and memory to a few hundred megabytes, making shielded transactions practical on phones; it also split keys into spending, full-viewing and incoming-viewing keys for selective disclosure. Orchard (2022, activated in the NU5 upgrade) introduced the Halo 2 proving system, which removes the per-circuit trusted setup entirely via recursive proof composition over the Pallas/Vesta curve cycle.
Mechanically, a shielded Zcash transaction maintains a Merkle tree of note commitments and a set of spent nullifiers. Spending proves in zero knowledge that you own a note whose commitment is in the tree and publishes its nullifier to prevent double-spending, while creating new note commitments for the recipients. Transparent transactions, by contrast, are simply auditable Bitcoin-style transfers. Zcash also has a defined monetary policy with a 21-million cap mirroring Bitcoin and, in its early years, a 'Founders' Reward' (later a development fund) directing a slice of block rewards to the developing organisation.
The honest critique is adoption. For most of Zcash's history the majority of activity has been transparent, leaving the shielded anonymity set smaller than the cryptography could support, and many exchanges only support t-addresses. Upgrades such as unified addresses and a push toward shielded-by-default wallets aim to fix this, because the strength of zero-knowledge privacy is ultimately bounded by how many people actually use the shielded pool.
A privacy-conscious user shields 10 ZEC from a t-address into the pool, waits, then sends z-to-z payments over weeks, finally deshielding to a brand-new t-address. On-chain, the shield and the deshield are visible, but the internal z-to-z flow — who paid whom and how much — is hidden by SNARKs, provided the amounts and timing are not trivially correlated.
Shield in, transact privately, deshield out — privacy holds only for the z-to-z middle.
A common misconception is that holding ZEC is automatically private. It is not: value sitting in a t-address is as transparent as Bitcoin. Privacy only applies while funds are inside the shielded pool, and round-tripping in and out can leak via timing and amounts.