Monero vs Zcash: two privacy models compared

Monero and Zcash both hide payments, but they start from opposite ends. Monero makes privacy a property of every transaction and hides each input among a small set of decoys. Zcash keeps a transparent ledger much like Bitcoin's and adds shielded pools, in which a zero-knowledge proof hides an input among every note the pool has ever held. One has a small set that everybody is in; the other has a large set that only some payments enter.

Monero: small sets, always on

Every Monero input sits in a ring of 16 outputs, every output goes to a one-time address and every amount is a commitment; how Monero privacy works has the detail. Nobody can send a transparent Monero transaction, so the decoys are real outputs of real users. The weakness is the size of the set and the statistics of choosing it: decoys have to be picked to look like the way people actually spend.

Zcash: large sets, opt in

Zcash has had three shielded pools. Sprout came first; Sapling activated at block 419,200 (ZIP 205) and Orchard with the NU5 upgrade at block 1,687,104 (ZIP 252). In a shielded transaction a zk-SNARK proves that the note being spent exists in the pool's note commitment tree and that the values balance, without saying which note or how much. The anonymity set is the whole pool.

Orchard's proofs use Halo 2 on the Pallas and Vesta curves. ZIP 224 notes that Halo 2 does not require a structured reference string, replacing the Groth16 proofs of Sapling, whose parameters came from a setup ceremony. It also notes that a new pool is a separate anonymity set: Orchard started at zero notes, and its set grew only as people moved into it.

The other half of Zcash is the transparent pool. ZIP 316, which defines unified addresses that bundle Orchard, Sapling and transparent receivers into one string, says plainly that transparent addresses do not provide any privacy protection. A payment from a transparent address into a shielded pool, or back out, shows its amount and its transparent end. A 2018 study by George Kappos, Haaroon Yousaf, Mary Maller and Sarah Meiklejohn (arXiv 1805.03180) found that simple heuristics about how coins entered and left the shielded pool could shrink its anonymity set considerably.

Keys and disclosure

Both coins let a holder show their history on purpose. A Monero view key shows incoming payments, and FCMP++ adds outgoing view keys. ZIP 316 separates a full viewing key, which shows payments to and from an address, from an incoming viewing key, which shows only payments to it.

When the cryptography fails

A hidden amount has a cost: if the proof system has a flaw, coins could be counterfeited without the chain showing it. Zcash answers that with ZIP 209, often called the turnstile: a node rejects any block that would make the total value in a shielded pool negative, so no more can leave a pool than went in.

In 2026 Orchard needed that kind of care. Zebra 4.5.3, published on 2 June 2026, carried a soft fork that temporarily disabled Orchard actions (advisory GHSA-jfw5-j458-pfv6), and Zebra 5.0.0 activates the NU6.2 upgrade at block 3,364,600 and re-enables Orchard with a fixed Orchard Action circuit; its notes describe the fix as one for a critical bug in the Orchard pool. Monero has no separate pool to wall off: every output is a commitment, so its supply rests on its range proofs and on review of the code, which is the same question FCMP++ raises for its new proofs, and the reason for its audits.

Side by side

Default. Monero: every transaction is private. Zcash: a transaction is shielded when its sender chooses a shielded pool; transparent transactions stay open.

Anonymity set. Monero: 16 outputs per input, picked by the wallet. Zcash: every note in the pool, proved in zero knowledge, with each pool a set of its own.

Amounts. Monero: always hidden. Zcash: hidden inside a pool, visible where coins cross between transparent and shielded.

Setup. Monero's rings and Bulletproofs+ need no trusted setup, and neither does Orchard's Halo 2; Sapling's Groth16 parameters came from a ceremony.

Next. The FCMP++ upgrade gives Monero an anonymity set the size of its chain, as a shielded pool has, while keeping privacy on for every transaction.