Privacy coins hide details that a public ledger normally exposes. Monero does it by default on every transaction, using ring signatures to obscure the sender, stealth addresses to obscure the recipient and RingCT to hide the amount. Zcash uses zero-knowledge proofs instead, and privacy applies only when funds stay in its shielded pools. Both carry real regulatory limits, and neither protects details that an exchange or wallet already knows about you.
Why would anyone want a private ledger?
Public blockchains are transparent, which gives ordinary users a real privacy problem. On a standard blockchain, anyone can look up an address on an explorer and see its balance and history. Once one payment links an address to a name, everything else at that address becomes readable.
The legitimate reasons for wanting financial privacy are mostly mundane:
- An employer pays salaries and does not want staff to see each other's pay.
- A business does not want competitors reading its suppliers, prices and cash position.
- A donor gives to a sensitive cause and fears retaliation.
- Someone holding a large balance does not want to advertise it to thieves.
There is also fungibility, the idea that every unit is interchangeable. If coins carry a visible history, some can be treated as "tainted" through no fault of the current owner.
Regulators see the other side. The same features can hide the proceeds of crime, which is why FinCEN's 2019 guidance and EU law address these coins directly. This article explains how the technology works. It is not advice on legal compliance, and privacy technology does not change anyone's tax or legal obligations.
How does a Monero transaction work?
Monero combines three techniques so that the sender, receiver and amount are hidden on every transaction. Here is what happens when Alice pays Bob 5 XMR, Monero's coin:
- Bob's address never appears on-chain. Alice's wallet uses Bob's public address to create a stealth address, a random one-time destination for this payment alone. Bob's wallet scans the chain and recognizes outputs meant for him. Two payments to Bob look unrelated to an observer.
- Alice's coin hides among decoys. Her wallet picks 15 other outputs from the chain and signs with a ring signature, a signature that proves some member of a group signed without revealing which one. Monero's ring size has been 16 since an August 2022 upgrade.
- The network blocks a double spend. Each transaction includes a key image, a value derived from the real output's private key. Nodes reject any key image they have seen before, without learning which of the 16 outputs it came from.
- The amount stays hidden. RingCT, short for Ring Confidential Transactions, conceals the 5 XMR behind cryptographic commitments. Nodes can still check that inputs equal outputs and no coins were created. RingCT launched in January 2017 and became mandatory after September 2017.
The ring offers a useful worked example. If all 16 members looked equally likely, an observer guessing the real one would be right 1 time in 16, or 6.25%. Real analysis can beat that when decoys look different from real spends. A 2018 study of the early chain found that about 62% of inputs with mixins could be traced by elimination, and that the newest input was the real one about 80% of the time. Monero has since raised its ring size and now draws decoys using a gamma distribution, but this is why a ring is a probabilistic hiding place and not a mathematical wall.
Developers are testing a replacement called FCMP++ (full-chain membership proofs), which would hide a spend among all eligible outputs on the chain instead of 15 decoys. In October 2026 it was still on a test network with no mainnet date, so ring size 16 is what Monero uses.
Monero also has a selective disclosure tool. A private view key lets a chosen person, such as an accountant, see incoming payments without being able to spend. It does not reliably show outgoing payments.
How does Zcash work?
Zcash takes a different route: instead of hiding a real coin among decoys, a shielded transaction proves it is valid while revealing almost nothing. It relies on zk-SNARKs, a compact form of zero-knowledge proof. The sender proves that the coins exist, are owned by them, have not been spent and that the math balances. Zcash describes shielded transactions as fully encrypted on the blockchain yet still verifiable under consensus rules.
Zcash also has transparent addresses, which work like Bitcoin addresses and offer no privacy. That creates four kinds of transaction:
| Type | From | To | What the public sees |
|---|---|---|---|
| Private | Shielded | Shielded | Neither address nor amount, only the fee |
| Shielding | Transparent | Shielded | Sender's address and the amount |
| Deshielding | Shielded | Transparent | Recipient's address and the amount |
| Public | Transparent | Transparent | Both addresses and the amount |
Value sits in separate pools, and every entry to or exit from a shielded pool is visible. That lets anyone track each pool's total without seeing individual balances. Viewing keys let a holder show their activity to an auditor or tax preparer without giving up spending power.
The zk-SNARK design carries a particular risk. Early versions needed a trusted setup, a ceremony whose secret randomness could be used to forge proofs if it survived. Zcash ran multi-party ceremonies for its Sprout and Sapling pools. The Orchard pool, added in May 2022, uses Halo 2, which needs no such ceremony.
Forged proofs are the danger, because shielded balances cannot be audited directly. On May 29, 2026, researcher Taylor Hornby reported a flaw in the Orchard circuit that, in the words of ZIP 257, "could have allowed balance violation and theft of funds". Developers disabled Orchard and shipped a fix within days. They reported no evidence of exploitation and said the flaw did not affect privacy. Patching could not prove that no counterfeit coins existed, though, so ZIP 258 added a new pool called Ironwood, which activated on July 28, 2026. Orchard can now only be spent out of, and its turnstile accounting limits how much value can leave. This is the core trade-off of hidden amounts: strong privacy makes hidden inflation harder to rule out.
How do Monero and Zcash compare?
| Feature | Monero | Zcash |
|---|---|---|
| Privacy setting | On for every transaction | Optional; depends on the pools used |
| Hides the sender | Ring signatures (16 members) | zk-SNARKs (whole shielded pool) |
| Hides the recipient | Stealth addresses | Shielded addresses |
| Hides the amount | RingCT | Shielded transactions |
| Size of the hiding group | 16 per input today | Other notes in the shielded pool |
| Selective disclosure | View key | Viewing keys |
| Main weakness | Decoys can be analyzed statistically | Mixed usage shrinks the anonymity set |
| Notable incident | 18-block reorganization, September 2025 | Orchard soundness flaw, May 2026 |
Why does default versus optional privacy matter?
Privacy depends on how many other people you could plausibly be, so usage patterns matter as much as the cryptography. That group is called the anonymity set.
Monero's default means every transaction looks alike, and no one stands out by choosing privacy. The cost is that outsiders, including auditors without a view key, cannot inspect flows or balances.
Zcash's optional model gives users and exchanges a transparent route that works like Bitcoin, but it thins the crowd. A shielded pool protects you only as far as others use it. In a Tokenomist reading of the Zcash Dashboard from September 18, 2026, about 4.92 million ZEC, or 29% of supply, sat in shielded pools. The rest was transparent. A 2018 study found that private use of Zcash was possible, but that identifiable usage patterns could shrink the anonymity set considerably.
What is the regulatory status of privacy coins?
The rules below mostly target regulated firms and not individual holders, and access through those firms is shrinking, especially in Europe. Rules differ by country, so ask a lawyer about your own position.
- Delistings. Binance delisted Monero on February 20, 2024, citing its regular review of listed assets. OKX had delisted Monero, Zcash and Dash the month before. Kraken ended Monero trading in the European Economic Area on October 31, 2024, citing regulatory obligations. These were decisions by centralized exchanges, which answer to regulators in each market they serve.
- European Union. Article 79 of the EU's anti-money laundering regulation bars banks, financial institutions and crypto-asset service providers from keeping anonymous accounts, including through "anonymity-enhancing coins". The definition covers coins that anonymize "either systematically or optionally", which reaches both Monero's and Zcash's designs. It applies from July 10, 2027. The article is addressed to those institutions, not to individuals.
- United States. FinCEN's 2019 guidance calls these assets "privacy coins" and says a money transmitter "cannot avoid its regulatory obligations" by using them. US-listed products still exist: Grayscale's Zcash ETF began trading on NYSE Arca on August 25, 2026.
What are the limits and risks?
Privacy coins protect on-chain data, and they do not make a person invisible. The main limits are:
- Known endpoints. An exchange that verified your identity still knows what you bought and where you withdrew it. Hidden on-chain data does not erase those records.
- Consensus attacks. Hiding transactions does not secure the chain itself. In September 2025, the mining pool Qubic withheld blocks and then published a longer chain, replacing 18 Monero blocks. Reports counted about 117 reversed transactions, which Qubic's founder disputed. This is a mining-power risk that small networks face.
- Software and custody. A flaw in a wallet or circuit can undo the guarantees, as Orchard showed. Losing a seed phrase loses funds here too.
- Liquidity. Fewer listings can mean fewer ways to exit a position.
For more on this topic, see our privacy hub.
Key takeaways
- Monero hides the sender, recipient and amount by default, using ring signatures, stealth addresses and RingCT.
- Zcash hides the same details with zk-SNARKs, but only for funds that stay shielded. About 29% of supply was shielded in a September 2026 reading.
- Monero's weakness is statistical analysis of decoys. Zcash's are thinner crowds and the difficulty of auditing hidden supply, as the 2026 Orchard flaw showed.
- Legitimate uses include payroll, business confidentiality, donations and personal safety.
- Major exchanges have delisted these coins in many places, and from July 10, 2027, EU rules bar regulated firms from keeping accounts that use them for anonymity.
- On-chain privacy does not remove tax or legal duties, or the records exchanges keep.
Sources
Get the weekly commit
New blockchain deep dives every week.