Zcash vs Monero: Optional Privacy, Mandatory Privacy, and What Each One Costs

Most comparisons of these two assets stop at "Monero is private by default, Zcash is private if you ask." That is true, and it is where the interesting part starts rather than ends.

Privacy in a public ledger is not a feature you either have or lack. It is a claim about what an observer can reconstruct, and that claim rests on cryptography, on other users' behaviour, and on whether you can still get the asset onto and off an exchange. Zcash and Monero make opposite choices on the first two, and those choices produced measurably different outcomes on the third.

The twelve months to August 2026 tested both designs in public. One of them shipped an emergency hard fork to contain a bug that could have let someone print money invisibly. The other is still waiting on the upgrade meant to fix its best-known weakness, while running with less regulated exchange access than it had three years ago. Neither of those is a reason to dismiss either asset — but they are the reasons to understand what you are choosing between.

The choice everything else follows from: who has to be private

Monero has one transaction type. Every output pays to a stealth address, so the recipient's public address never appears on chain. Every amount is hidden by RingCT. Every spend is signed as one of 16 possible inputs — the real one plus 15 decoys — a ring size that has been mandatory since the network upgrade of 13 August 2022. There is no transparent Monero transaction to compare against, because the protocol does not define one.

Zcash has two worlds and a door between them. Transparent addresses (t-addr) behave like Bitcoin addresses: fully public sender, receiver, and amount. Shielded addresses spend inside a pool where a zero-knowledge proof attests that the transaction is valid without revealing its contents. Privacy is a choice made per transaction.

That choice has a measurable outcome. As of 11 August 2026, the Zcash shielded pool held 4,366,145 ZEC against a circulating supply of 16,870,101.73 ZEC — about 26% shielded, and roughly 12.5 million ZEC sitting in the open.

Here is why that ratio matters more than it first appears, and it is the single most useful thing to understand about optional privacy.

A shielded transaction is anonymous relative to the set of transactions it could be confused with. When privacy is mandatory, that set is every transaction on the chain, because there is no other kind. When privacy is optional, the set is only the shielded activity — and worse, the edges of the pool leak. Value that enters from a transparent address and leaves to a transparent address a short time later, in a recognisable amount, can often be linked by timing and value correlation without breaking any cryptography at all. The proof system is not what fails there; the usage pattern is.

So a Zcash user's privacy depends on two things a Monero user never has to think about: whether they personally chose the shielded path at every step, and how many other people are inside the pool with them. Monero removed the user's ability to get this wrong. Zcash kept the flexibility and, with it, the responsibility.

What each design actually hides, and what leaks anyway

Neither asset hides everything, and the gaps are different. This table compares the three cases a reader actually encounters — because most ZEC activity is transparent, "Zcash" is not one column.

Two rows deserve a note.

Disclosure runs in opposite directions. Zcash lets you hand a counterparty a full viewing key, which reveals both incoming and outgoing activity for an address without granting spend authority; an incoming viewing key reveals less. Monero's private view key is weaker as an audit tool: it reveals incoming payments, and the project's own documentation notes that outgoing transactions cannot be reliably viewed, so a balance shown from a view key alone should not be relied on. If you ever need to prove your holdings or your history to an accountant, an auditor, or a tax authority, Zcash gives you a cleaner instrument.

Neither one hides your IP address. Both leak network metadata to a passive observer unless you route through Tor or i2p. This is the most commonly overlooked hole in both systems, and it is a wallet configuration problem rather than a protocol one.

Two cryptographic bets, two ways to fail

The cryptography is where the comparison stops being a feature list and starts being a risk choice.

Zcash uses zero-knowledge proofs. A proof asserts that a hidden transaction obeys the rules — inputs cover outputs, the spender owns the note, nothing is double-spent — and the network verifies the proof rather than the transaction. The proofs are small and cheap to verify, and Zcash's Orchard pool removed the trusted-setup requirement that its earlier pools carried.

The bet is that the circuit encoding those rules is correct. If it is not, the property that breaks is soundness: a false statement can be proven true. In a shielded pool, that means someone could potentially create value that was never funded, and because the pool is opaque, no observer could see it happening by looking at the chain. The failure is silent by design.

Monero uses ring signatures plus RingCT: older, simpler, better-understood constructions with no circuit to get wrong in that way. The bet there is different. A ring hides your real input among a finite, publicly known number of decoys — 15 of them. That is a quantifiable amount of privacy, and quantifiable in the wrong direction: statistical analysis of decoy selection, of spent outputs elsewhere in the chain, and of transaction patterns can narrow a ring below its nominal size. Worse, the exposure is retroactive. A transaction signed today with today's ring is fixed on chain forever, and every future improvement in analysis applies to it. Monero's older transactions, signed with smaller rings under weaker rules, are meaningfully more analysable now than when they were made.

Summarised: Zcash accepts a small chance of a catastrophic, invisible cryptographic failure in exchange for an unbounded anonymity set. Monero accepts a bounded anonymity set that erodes with time in exchange for having no such circuit to break. In 2026, the first of those two risks stopped being theoretical.

The 2026 test case: Zcash's Orchard bug and what a turnstile is for

On 29 May 2026, researcher Taylor Hornby of Shielded Labs found a soundness bug in the Orchard Action circuit — specifically in its variable-base scalar multiplication gadget. The Zcash Improvement Proposal documenting the response states that the vulnerability "could have allowed balance violation and theft of funds."

The response was fast and drastic:

The migration itself illustrates the leak-at-the-edges point from earlier in this article. A pool-crossing transfer necessarily reveals the net amount crossing, so the migration specification has wallets break the balance into canonical denominations, restructure notes with shielded self-transactions first, and broadcast the crossings at randomised intervals anchored to shared network-wide heights. All of that machinery exists to stop an observer clustering the crossings back into one wallet's balance — work that is unnecessary inside a pool and unavoidable at its boundary.

The device doing the accounting work there is called a turnstile. Since a shielded pool's contents cannot be audited by inspection, Zcash's consensus rules instead audit its boundary: a block that would push the sum of chain value pool balances above the protocol maximum must be rejected. You cannot see inside the pool, but you can count what goes in and what comes out. Sealing Orchard and metering its exit converts an unverifiable interior into a verifiable ledger entry — which is exactly the compensating control an opaque system needs.

How the market priced it

Figure 1 plots ZEC's daily closes with both moments marked. Read it in three passes.

First, the run-up: ZEC closed September 2025 at $74.32 and finished October 2025 at $404.54, peaking at a $699 close on 16 November 2025. Whatever you conclude about the bug, it landed on an asset that had already repriced by roughly nine times in seven weeks.

Second, the break. ZEC closed at $620 on 3 June 2026, the day the corrected-circuit fork activated. It closed at $459 on 4 June and $389 on 5 June — down about 37% in two closes, with an intraday low of $250 on 5 June that a closing-price chart does not show. Set that against the market backdrop honestly: Bitcoin fell over the same days too, from about $71,400 on 1 June to about $61,100 on 5 June, roughly 14%. A broad risk-off move was underway, and ZEC fell around two and a half times as far as the market on a closing basis. The bug is not the whole explanation, and it is clearly a large part of it.

Third, the resolution. The Ironwood activation on 28 July 2026 is the second marker, and it is unremarkable on the chart — ZEC closed at $466 that day, inside the range it had been trading for weeks. The market had already priced the repair during June and July; the upgrade itself was not the news. That sequence is the normal shape of a protocol incident: violent repricing at disclosure, slow recovery as the fix becomes credible, nothing much on the day it ships.

There is no companion chart for XMR in this article, and the reason is itself one of the findings below: Monero has no market on the exchange that supplies CoinBeaver's price data, because it was delisted from it in February 2024. The Binance XMR/USDT pair is frozen at its final February 2024 print. An absent chart is the honest rendering of an absent market.

Monero's pending answer: FCMP++ has not shipped

The bounded-ring-size problem has a known fix in progress. Full-Chain Membership Proofs — FCMP++ — replaces the 16-member ring with a proof of membership in the entire set of chain outputs, which would give Monero the unbounded anonymity set that zero-knowledge designs get by construction, without adopting a shielded-pool architecture.

As of 11 August 2026 it is not live. Two independent checks agree:

• The Monero network reports consensus hard-fork version 16, the version in force since the August 2022 upgrade. An FCMP++ activation would require a further consensus version.
• The fcmp++ hf milestone in the Monero repository stands at 24 closed issues against 15 open, a little over half complete, with active commits in August 2026 and no due date set.

This matters for how you read the comparison. Monero's roadmap answer to its main cryptographic criticism is real, well-specified, and unfinished. Any article claiming FCMP++ activated in January 2026 — and several currently do — is wrong. Check the consensus version yourself before believing a privacy claim that depends on the upgrade.

Where you can actually buy and hold each one

This is the difference that changes a reader's day, and it runs strongly one way.

Binance delisted XMR on 20 February 2024 at 03:00 UTC, alongside three other assets, citing its periodic review standards. Kraken then removed XMR across the European Economic Area: trading and deposits halted on 31 October 2024, withdrawals closed on 31 December 2024, and any XMR still held after that was converted to Bitcoin at market rate and returned to clients by 6 January 2025.

That last detail deserves emphasis, because it is a risk most holders never price. European clients who did not act did not lose their money — but they did wake up holding a different asset than the one they chose, at a price they did not pick. Custody risk on a delisting-prone asset is not only "can I sell?", it is "can the venue convert my position for me?" If you hold a privacy asset on an exchange in a tightening jurisdiction, self-custody is not a philosophical preference; it is the mechanism that keeps that decision yours. Crypto custody explained and hot vs cold wallets cover the practical setup.

Zcash went the other way. It remained listed on large regulated venues, and in November 2025 Gemini became the first regulated exchange to support shielded ZEC withdrawals rather than transparent-address-only withdrawals — at the time, to the Sapling and Orchard pools. Since NU6.3 forbids new value entering Orchard, shielded withdrawals must now target Ironwood instead.

XMR is emphatically not unavailable. It still trades on Kraken outside the EEA and on a number of other venues, it has active atomic-swap and decentralised routes (DEX vs CEX explains what changes when you leave a centralised venue), and its liquidity on the venues that kept it is real: on 11 August 2026 Kraken's XMR/USD 24-hour volume was in the same range as its ZEC/USD volume. The asymmetry is not liquidity. It is regulated access, and specifically the number of jurisdictions where a compliant on-ramp exists.

What the EU rule arriving in July 2027 actually says

Regulated access is about to narrow further in one large market, and the detail that matters is a definition rather than a headline.

Article 79 of the EU Anti-Money Laundering Regulation prohibits credit institutions, financial institutions, and crypto-asset service providers from keeping anonymous accounts, or any account "otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins." The Regulation applies from 10 July 2027.

Now the definition. Article 2(25) defines anonymity-enhancing coins as crypto-assets with built-in features designed to make transfer information anonymous — "either systematically or optionally."

Those last three words are the reason this section exists. The common assumption is that Zcash escapes this class because its privacy is opt-in and its transparent addresses look like Bitcoin's. The Regulation's own definition anticipates that argument and closes it: optional counts. Whether a given regulated venue responds by delisting ZEC, by supporting only transparent addresses, or by restricting shielded withdrawals is a business and supervisory question that is genuinely unsettled — but a reader planning around "Zcash is the compliant one, so nothing changes for it" is planning around a distinction the text does not draw.

Two things this rule does not do: it does not make owning either asset illegal, and it does not reach self-hosted wallets where the provider has no access to or control over the wallet. It constrains regulated intermediaries, which is precisely where most people's on-ramp, off-ramp, and custody live. EU readers weighing venues should read it alongside our EU exchange guide.

Issuance: a halving schedule against a permanent tail

The monetary designs diverge as sharply as the privacy designs, and the trade-off is the same one every proof-of-work chain faces: a hard supply limit is attractive to holders and eventually leaves security paid for by fees alone.

Zcash halves. The block subsidy dropped to 1.5625 ZEC at the November 2024 halving, the next halving is scheduled for 23 November 2028 under current consensus rules, and total supply is capped outright as a consensus rule — a block that would push the sum of chain value pool balances past the protocol maximum must be rejected. Since November 2024 the subsidy has also been split three ways: 80% to miners, 8% to Zcash Community Grants, and 12% into an in-protocol "lockbox" that accumulates pending an agreed disbursement mechanism. A separate proposal, ZIP 234, would replace discrete halvings with a smoothed issuance schedule.

Monero does not halve to zero. Its tail emission fixes the block reward at 0.6 XMR from the end of May 2022 onward, explicitly so that miners always have a subsidy and security does not depend on fee markets alone.

Work the arithmetic through, because the conclusion is not the one "no supply cap" suggests. At a two-minute target, 0.6 XMR per block is roughly 432 XMR a day, or about 158,000 XMR a year. Against a supply approaching 19 million, that is under 1% annually — and because the numerator is fixed while the denominator grows, the percentage falls every year without ever reaching zero. Monero is not inflationary in the sense that word usually implies; it is asymptotically disinflationary with a permanent floor. Zcash's terminal state is a fixed supply whose security budget must eventually come entirely from fees.

For holders, the honest framing is that neither design is strictly better. One accepts a small, shrinking, perpetual dilution to keep paying for security forever. The other accepts an eventual reliance on fee revenue to keep a hard cap. Tokenomics explained covers how to read this class of trade-off generally.

Which one fits which reader

Zcash

Monero

The decision rule that follows: if your requirement is that privacy holds by default for every transaction and you are willing to self-custody and use non-mainstream venues, Monero's design does the thing you want and Zcash's does not. If you need selective disclosure, a regulated on-ramp, or the ability to hold the asset through a tightening compliance regime, Zcash's optional model is built for that — provided you actually use the shielded side, and keep using it.

Risks and limitations

Three further limits on everything above. Regulatory status is the fastest-moving variable here and the one most likely to be stale first: delistings have historically arrived with weeks of notice, not years. Exchange availability differs by jurisdiction even within one venue, so check your own account's asset list rather than a general claim. And the shielded-share, price, and milestone figures in this article are dated observations — re-check them before acting, using the primary sources linked in each section.

Conclusion

Zcash and Monero are not competing implementations of the same idea. They are two different answers to the question of who bears the cost of privacy.

Monero puts the cost on everyone, all the time: every transaction is private, every user is a decoy for every other, and the price is a bounded anonymity set, transactions that grow more analysable as analysis improves, and exclusion from a growing share of regulated venues. Zcash puts the cost on the individual: you choose privacy, you get an unbounded anonymity set and clean selective disclosure when you need it, and the price is that most of the network is transparent, your cover depends on other people's choices, and the cryptography carrying your privacy is complex enough that it can break — as it did in mid-2026, with a bug that could have violated supply invisibly and was contained by turnstiles, emergency forks, and a replacement pool.

The 2026 record gives each thesis its evidence and its scar. Zcash's opacity concealed a soundness bug for four years, and its boundary accounting is what let the network prove nothing had actually been stolen. Monero's mandatory privacy is intact and its fix for the ring-size bound is real but unshipped, while its regulated access has narrowed to the point where the largest exchange's price feed for it has been frozen since February 2024.

Choose on the requirement, not the slogan. Privacy by default with restricted access, or privacy on request with an audit trail you control — and in either case, verify the current state of the protocol before you rely on what it promised last year.

Frequently asked questions

Sources and further reading

Primary documentation used for the claims above:

• ZIP 257 — Orchard temporary vulnerability mitigation and NU6.2 and ZIP 258 — NU6.3 deployment
• ZIP 318 — Orchard to Ironwood migration and ZIP 2005 — Ironwood quantum recoverability
• ZIP 209 — Prohibit out-of-range chain value pool balances and ZIP 316 — Unified addresses and unified viewing keys
• ZIP 1015 — Block subsidy allocation for non-direct development funding and Zcash network metrics
• Monero v0.18.0.0 release notes, including the ring size increase to 16
• Moneropedia: tail emission and view keys
• Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation)
• Gemini sets the standard for privacy on CEXs with shielded ZEC withdrawals
• Qubic's claimed majority of Monero hashrate, August 2025

This article is educational. It is not investment advice. Protocol status, exchange availability, and regulatory treatment of privacy assets change quickly and vary by jurisdiction; verify the current position with the primary sources above before acting.