Zcash uses zk-SNARKs, a type of zero-knowledge proof. This technique proves a statement is true without revealing why it is true. Early SNARK systems needed a one-time setup that creates a “structured reference string,” a set of public parameters. The secret randomness left over is called “toxic waste.” If anyone rebuilt it, they could forge proofs that still pass verification.
For Zcash, that meant fake coins. A leaked master secret would let an attacker create unlimited counterfeit $ZEC without being detected.
How Did Six People Launch A Coin?
The team split the risk across several people using cryptography.
The Multi-Party Computation Design
Multi-party computation (MPC) lets several parties build one result without anyone seeing the whole secret. Six participants each produced one shard of the key set, each in a separate location with separate hardware.
Zooko Wilcox recruited the group, but the others were not told who else was taking part. Rebuilding the toxic waste needs every shard, so the setup fails only if every participant is compromised.
The Six Participants And The Destroyed Hardware
- Zooko Wilcox, Zcash’s founder, who organized the ceremony
- Peter Todd, Bitcoin Core developer
- Andrew Miller, Zcash advisor
- Peter Van Valkenburgh, researcher at Coin Center
- Derek Hinch
- “John Dobbertin,” revealed in April 2022 to be Edward Snowden. Zooko chose the pseudonym to honor the German cryptographer Hans Dobbertin.
After the ceremony, the machines were destroyed so no leftover data could be read from their memory. Za Wilcox, Zooko’s brother, destroyed one computer used to generate random numbers.
Why Did Critics Call It “Security Theater”?
Not everyone was convinced. Peter Todd later argued that anyone with access to the software used that day could reach everything the ceremony ran on, so it was not truly six independent sources of randomness.
The ceremony’s output powered Sprout, Zcash’s first shielded pool. A shielded pool is the group of private $ZEC that follows one set of privacy rules. Sprout used a proof system called BCTV14, built on the 2016 parameters.
In 2018, engineer Ariel Gabizon found a flaw in BCTV14 that could have allowed unlimited fake $ZEC. The ceremony itself was carried out correctly, but the error sat in the research behind the parameters. The Sapling upgrade replaced BCTV14 and fixed the flaw on October 28, 2018, and the team disclosed it in February 2019.
How Did Zcash Move Beyond The Trusted Setup?
Each new shielded pool reduced reliance on the 2016 event.
Sapling And Powers Of Tau
For Sapling, Zcash ran an open ceremony. Phase 1, called Powers of Tau, drew 87 contributors, and about 90 people took part in total.
Orchard, Halo 2 And Ironwood
Orchard was designed to remove the trusted setup, so no hidden secret is created and no ceremony is needed. Bugs in the circuit itself remain possible, though. In May 2026, researcher Taylor Hornby found that one elliptic-curve multiplication step in Orchard’s zero-knowledge circuit was under-constrained. In plain terms, the circuit did not check that step fully.
Zcash responded with Ironwood. Ironwood is a separate shielded pool that keeps key parts of Orchard’s design, including the Halo 2 proving system. The old Orchard pool now allows withdrawals only.
What Is Happening With Zcash Now?
The ceremony’s legacy is closing out this month.
- NU7 upgrade: NU7 went live on testnet at block 4,465,026 on October 4. It cuts block time from 75 to 25 seconds and disables version 4 transactions. That makes $ZEC left in the old Sprout pool unspendable if it is not moved before activation. A mainnet decision is due October 20, with a November 5 target.
- ETFs: The Winklevoss filing proposes a fund that holds $ZEC directly, uses Gemini as custodian, charges 0.25% a year and would trade on Nasdaq as WINK. Valour also launched a Zcash exchange-traded product in Sweden.
- Shielded use: The share of $ZEC held in shielded pools rose from about 9% in September 2023 to roughly 28%.
- Rankings: $ZEC entered the top 10, pushing out Cardano and Chainlink.
$ZEC traded near $1,332 on October 12, roughly 8% above the previous day. It has rebounded even as investors keep withdrawing money from Grayscale’s Zcash ETF, with weekly ZCSH outflows of $30.72 million.
Conclusion
The 2016 ceremony let Zcash launch private payments with zk-SNARKs, using six shards so that one honest participant kept the system safe. Sapling widened that trust to about 90 people. Orchard and now Ironwood use Halo 2, which needs no trusted setup. With NU7, Zcash is retiring the Sprout pool the ceremony created.
- Coin Bureau: What is the ZCash Ceremony?
- CoinOtag: What Is the Zcash Ceremony?
- Spark Glossary: Trusted Setup
- BIT Knowledge Hub: Zcash
- BloFin Academy: The Zcash Trusted Setup Explained
- CoinDesk: Zcash and the Art of Security Theater
- Peter Todd talk transcript: Cryptographic hocus-pocus meaning nothing
- a16z crypto: On-Chain Trusted Setup Ceremony
- Kryptex: Zcash ($ZEC) overview
- The Block: Zcash activates Ironwood upgrade
- KuCoin: Zcash Ironwood NU6.3 Goes Live
- ChainCatcher: Zcash activated NU7 on testnet
- The Block: Winklevoss group seeks to launch Zcash ETF
- Hipther: Blocks & Headlines, September 29
- HackerNoon: Soda Labs report citing 21Shares data
- CoinTurk News: Zcash, Monero and Hyperliquid join top 10
- CryptoTicker: Zcash $1,332, the only weekly gain in the top ten
- Invezz: Zcash price tops $1,300 despite $124M ETF outflows
