PoW privacy chain
Zcash ZEC
Zcash is a PoW privacy chain with a dual-pool architecture (transparent ECDSA addresses and shielded Orchard/Sapling addresses using ECC-based zk-SNARKs and RedDSA spend authorization). As of 2026-05-31, no production quantum protection exists on any layer. All spend authorization — both transparent (ECDSA/secp256k1) and shielded (RedDSA/RedPallas over Pallas/Jubjub curves) — is quantum-vulnerable. The Halo 2 proving system eliminates the trusted setup but retains elliptic-curve assumptions; a cryptographically-relevant quantum computer could forge spending proofs and compromise supply integrity. Approximately 30% of circulating ZEC is in shielded pools (itself still ECC-vulnerable), while ~70% remains in transparent addresses with the same exposure profile as Bitcoin. Zcash scores well on risk assessment: the protocol specification formally documents all cryptographic primitives, the quantum threat is publicly acknowledged across official and third-party sources, and pool-level value-at-risk data is publicly available. The NU7 testnet launched on 2026-05-22 with Orchard Quantum Recoverability (QR) components in code review, and quantum-recoverable wallets were announced for June 2026. A full PQC transition via Project Tachyon is targeted for late 2026 to 2027. ML-KEM and ML-DSA have been identified as candidate algorithms. However, all of this is roadmap and testnet — not mainnet protection. The critical blocker (active spend authorization entirely ECC-only) caps the score at 40; the raw factor score of ~19.6 is the binding constraint. The score of 20 reflects genuine and serious preparedness work without crediting roadmap promises as production protection.
Quantum Risk AssessedPQ-RoadmappedPQ-Recoverable
Category breakdown
QRI Factors
Algorithm & Implementation Assurance
4.8 / 20
Migration Mechanism, Governance & Ecosystem Coordination
1.65 / 15
Migration Status & Value-at-Risk
2.25 / 25
Production Cryptographic Protection
2.81 / 35
Security Assessment & Evidence Preparedness
8.1 / 5
Critical Quantum Blockers
- Active production spend authorization remains entirely ECC-based (ECDSA on transparent addresses, RedDSA/RedPallas on shielded addresses) with no PQC or hybrid-PQC path on mainnet as of 2026-05-31. Cap: 40.
- Users can still create new quantum-vulnerable accounts by default across both transparent and shielded pools. Cap: 60.
- Halo 2 proof soundness and note encryption in Orchard rely on elliptic-curve discrete-log hardness; a sufficiently powerful quantum computer could forge spending proofs or compromise supply integrity. Cap: 60.
- No independent audit exists for any PQC or quantum-recoverability component. The Orchard Quantum Recoverability PRs were in review as of evaluation date; no audit of the QR construction has been published. Cap: 92 (not binding given lower caps above).
Key Risks
- All transparent-address ZEC (approximately 70% of circulating supply) is controlled by ECDSA keys with the same quantum exposure as Bitcoin; public-key exposure on spend makes these funds directly vulnerable to Shor's algorithm once cryptographically-relevant quantum hardware exists.
- All shielded-pool spend authorization (RedDSA over Pallas/Jubjub) is ECC-based and quantum-vulnerable; a quantum adversary could derive spending keys from public authorization keys exposed during transactions.
- Halo 2 proof soundness relies on elliptic-curve discrete-log hardness; quantum compromise of this assumption could allow forged spending proofs, enabling unauthorized fund draining or undetected ZEC inflation — a supply-integrity risk unique to shielded chains.
- Note encryption in Orchard uses ECC key agreement (KA^Orchard); harvest-now-decrypt-later attacks could retroactively compromise the confidentiality of all shielded transactions recorded before a PQC upgrade.
- Approximately 70% of circulating supply remains in quantum-vulnerable transparent addresses with no migration deadline or enforcement mechanism currently active on mainnet.
- The Tachyon/NU7 PQC upgrade is targeted for late 2026 to 2027 but is not guaranteed; the NU7 mainnet launch date is unconfirmed, and the full post-quantum transition depends on successful completion of ZIPs, security audits, and community governance approval.
- No independent cryptographic audit of the Orchard Quantum Recoverability construction or any proposed PQC algorithm integration has been published as of the evaluation date.
- The quantum-recoverable wallet design (June 2026 target) provides a migration pathway but does not itself constitute quantum resistance; funds remain ECC-vulnerable until a full protocol upgrade is activated on mainnet.
- Exchange and custodian infrastructure predominantly uses transparent addresses; no exchange migration attestations or PQC custody paths exist as of the evaluation date.
- Sprout pool deprecation (planned for NU7) will burn remaining Sprout funds at activation height, creating a user-action deadline, but this addresses legacy pool cleanup rather than quantum protection.
- Governance fragmentation risk: the ECC development team resigned in early 2026; while the Zcash Foundation and ZODL have continued development, the organizational transition introduces execution risk for the PQC roadmap timeline.
Evidence record
Claims and Caveats
Transaction / Spend Authorization
Spend authorization / transaction signatures are PQC or hybrid-PQC on mainnet
Claim: All spend authorization on Zcash mainnet as of 2026-05-31 uses classical ECC: ECDSA/secp256k1 for transparent addresses and RedDSA (Schnorr-variant) over Pallas/Jubjub curves for Orchard/Sapling shielded addresses. No PQC or hybrid-PQC spend authorization exists on mainnet.
Coverage basis: Mainnet proof + official protocol specification (NU6.1) + independent technical analysis
Implementation score: 0 · Evidence confidence: 0.9
Quantum blocker: Active production spend authorization remains entirely ECC/BLS/Schnorr/EdDSA-only. Cap: 40.
Transparent addresses use ECDSA identical to Bitcoin. Shielded Orchard addresses use RedDSA (rerandomizable Schnorr) over the Pallas curve. Both are quantum-vulnerable via Shor's algorithm. Quantum-recoverable wallet (targeting June 2026) and NU7 testnet QR components are in development but not on mainnet as of evaluation date.
Transaction / Address Design
Account, address, public-key exposure, and key-derivation design avoids quantum-vulnerable ownership paths or supports PQ/hybrid accounts
Claim: Both transparent (t-address, ECDSA public key exposed on spend) and shielded (z-address, ECC-based key derivation) address types are quantum-vulnerable. No PQ or hybrid address type exists on mainnet.
Coverage basis: Mainnet proof + official protocol specification
Implementation score: 0 · Evidence confidence: 0.9
Quantum blocker: Users can still create new quantum-vulnerable high-value accounts by default. Cap: 60.
Transparent addresses expose the public key on first spend (same as Bitcoin). Shielded Orchard addresses derive keys via ECC operations over Pallas/Jubjub. Unified Addresses route to the most private available pool but that pool remains ECC-based. No PQ address format exists or is scheduled for mainnet before NU7.
Consensus
Consensus-critical authentication is PQC or hybrid-PQC where applicable, including validator signatures, VRFs, randomness beacons, threshold signatures, or block certificates
Claim: Zcash uses Equihash proof-of-work consensus with no validator signatures, validator set, VRF, or finality signatures. There is no consensus-authentication layer requiring PQC migration.
Coverage basis: Protocol design — PoW chain architecture
Implementation score: 1 · Evidence confidence: 0.9
Crosslink (hybrid PoW/PoS with staking finality) is under development by Shielded Labs with testnet expected in 2026. If activated, validator authentication would become applicable and would require separate PQC assessment. This subfactor should be re-evaluated if Crosslink activates on mainnet.
State Integrity / Privacy Layer
State-integrity mechanisms are quantum-safe where applicable, including commitments, nullifiers, accumulators, script authorization, supply-binding mechanisms, and bridge verification
Claim: Zcash's state-integrity mechanisms — Pedersen commitments (Sapling), Sinsemilla commitments (Orchard), nullifiers, and the Halo 2 proof system — all rely on elliptic-curve discrete-log hardness and are quantum-vulnerable. A quantum adversary could forge spending proofs, enabling unauthorized fund draining or undetected ZEC inflation.
Coverage basis: Mainnet proof + official protocol specification + independent technical analysis
Implementation score: 0 · Evidence confidence: 0.9
Quantum blocker: Quantum attack can plausibly break supply integrity, state binding, or asset ownership in a critical layer. Cap: 60.
Halo 2 eliminates the trusted setup requirement but does not eliminate elliptic-curve assumptions. The Pallas curve used in Orchard is vulnerable to Shor's algorithm. Quantum compromise of proof soundness would allow forged proofs — a supply-inflation risk unique to shielded chains. Research into lattice-based commitments and hash-based signatures (SPHINCS+) is ongoing but no mainnet implementation exists.
Privacy / Proof Layer
Privacy and proof layers are quantum-safe where applicable, including ZK proof assumptions, note encryption, viewing keys, stealth addresses, and shielded state
Claim: Zcash's zk-SNARK proof systems (Groth16/BN-254 for Sapling, Halo 2/Pallas for Orchard) and note encryption (ECC key agreement) are quantum-vulnerable. Harvest-now-decrypt-later attacks could retroactively compromise shielded transaction confidentiality.
Coverage basis: Mainnet proof + official protocol specification + independent technical analysis
Implementation score: 0 · Evidence confidence: 0.9
Symmetric note encryption components (ChaCha20-Poly1305) have partial quantum resistance (Grover's algorithm halves effective key length but does not break 256-bit symmetric keys). The critical vulnerability is in the public-key components: ECC key agreement for note encryption and ECC-based proof soundness. Project Tachyon's Oblivious Synchronisation aims to remove ciphertexts from the blockchain entirely, which would address harvest-now-decrypt-later, but this is a roadmap item.
P2P / Network
P2P transport, node identity, and peer authentication are PQC, hybrid-PQC or all asset-spending authorization is PQ-signed on device and network identity is not consensus, spend, bridge, or custody-critical
Claim: Zcash P2P node identity uses classical cryptography, but P2P identity is not consensus-critical, spend-critical, bridge-critical, or custody-critical in the PoW architecture. Asset spending authorization is performed on-device and submitted as signed transactions; P2P identity does not gate fund access.
Coverage basis: Protocol design — PoW chain P2P architecture
Implementation score: 1 · Evidence confidence: 0.75
Evidence confidence is 0.75 (public code, no independent audit of P2P layer specifically). The Z3 stack (Zebra + Zaino + Zallet) includes built-in Tor support, which provides additional transport-layer privacy but does not affect the quantum-readiness assessment of this subfactor.
Wallet / Custody
Critical wallet, custody, and signing workflows support the production PQ/hybrid path or are protected by native satisfied-by-design controls
Claim: No PQC or hybrid-PQC wallet or custody path exists on mainnet. The Zodl/Zashi wallet defaults to shielded transactions (Orchard) but these remain ECC-based. Quantum-recoverable wallets are announced for June 2026 but not shipped as of evaluation date.
Coverage basis: Official announcements + mainnet state
Implementation score: 0 · Evidence confidence: 0.9
ZODL announced quantum-recoverable wallets targeting June 2026 at Consensus Miami (May 8, 2026). These wallets will provide a migration pathway but do not themselves constitute quantum resistance — funds remain ECC-vulnerable until NU7 activates on mainnet. Coinbase Custody and BitGo reportedly added ZEC support in 2025 but no PQC custody path exists.
Security Assessment
Public cryptographic inventory of critical public-key mechanisms
Claim: The Zcash Protocol Specification (NU6.1, v2025.6.3) formally documents all cryptographic primitives including ECDSA/secp256k1 (transparent), RedDSA/Pallas (Orchard spend auth), Groth16/BN-254 (Sapling proofs), Halo 2/Pallas (Orchard proofs), Pedersen/Sinsemilla commitments, and ECC key agreement for note encryption.
Coverage basis: Mainnet proof + official documentation (200+ page protocol specification)
Implementation score: 1 · Evidence confidence: 0.9
The protocol specification is one of the most comprehensive in the blockchain space. It has been audited by NCC Group and QEDIT for prior upgrades. The inventory is complete and publicly accessible.
Security Assessment
Public quantum threat model covering attack assumptions, affected assets, and affected layers
Claim: Multiple official and third-party sources document Zcash's quantum threat model: transparent ECDSA exposure (identical to Bitcoin), shielded ECC spend authorization vulnerability, Halo 2 proof soundness vulnerability, note encryption vulnerability, and harvest-now-decrypt-later risk for shielded transactions.
Coverage basis: Official documentation + independent technical analysis + public discourse
Implementation score: 1 · Evidence confidence: 0.9
The threat model is well-documented across official ECC/ZF communications and independent analyses. The CoinDesk research piece explicitly identifies the Pallas curve vulnerability and proof-soundness risk. The Bitfinex blog post distinguishes between symmetric (partially resistant) and public-key (fully vulnerable) components.
- https://www.coindesk.com/research/encryption-supremacy-zcash-and-privacy-in-the-age-of-scale
- https://blog.bitfinex.com/education/how-is-zcash-mitigating-the-risks-of-quantum-computing/
- https://www.quantumcanary.org/insights/zcash-quantum-challenges-could-be-looming
- https://bmic.ai/ae/quantum-audit/zcash/
Security Assessment
Public classification of exposed value, exposed accounts, dependent systems, and critical layers
Claim: Pool-level value data is publicly available: approximately 30% of circulating ZEC is in shielded pools (Sapling + Orchard, both ECC-vulnerable), approximately 70% in transparent addresses (ECDSA-vulnerable). No formal risk register with per-category classification has been published, but pool-level data is sufficient for conservative estimation.
Coverage basis: On-chain pool metrics + official and third-party reporting
Implementation score: 0.75 · Evidence confidence: 0.9
Shielded pool supply grew from ~11% in early 2025 to ~30% by May 2026. A formal risk register distinguishing exchange-held, foundation-held, and retail-held value has not been published. Per QRI §7.4, pool-level data with conservative confidence bands is acceptable for privacy-preserving systems. Score reduced from 1.00 to 0.75 to reflect absence of a formal classified risk register.
Security Assessment
Public evidence record supporting the assessment, such as code references, specs, audits, transaction examples, or reproducible analytics
Claim: Zcash has a strong public evidence record: the protocol specification, ZIPs repository, librustzcash source code, Least Authority audit of NU6.1, NCC Group and QEDIT audits of prior protocol versions, and public on-chain pool analytics.
Coverage basis: Published audits + open-source code + official documentation
Implementation score: 0.75 · Evidence confidence: 0.9
Least Authority audited the NU6.1 network upgrade. The protocol specification has been audited by NCC Group and QEDIT for prior versions. No audit of any PQC or quantum-recoverability component has been published. Score is 0.75 rather than 1.00 because the evidence record for the quantum-specific components (QR construction, PQC algorithm selection) is limited to proposals and PRs in review.
Migration Status
Percentage of circulating supply controlled by PQC/hybrid-PQC or otherwise quantum-protected native controls
Claim: 0% of circulating ZEC supply is controlled by PQC or hybrid-PQC native controls. Both transparent (ECDSA) and shielded (ECC-based zk-SNARK) pools are quantum-vulnerable. The 30% shielded pool share reflects privacy adoption, not quantum protection.
Coverage basis: On-chain pool metrics + protocol analysis
Implementation score: 0.05 · Evidence confidence: 0.9
Quantum blocker: Migration coverage cannot be measured for PQC because no PQC migration path exists on mainnet. All value is in legacy vulnerable pools.
Implementation score of 0.05 corresponds to the <25% coverage tier (raw score 1 out of 20 maximum) per QRI §9.3.1. The shielded pool is sometimes incorrectly described as quantum-resistant; it is not — it uses ECC-based proof systems and key agreement. The distinction between privacy and quantum resistance is critical here.
Migration Status
Critical wallets migrated, protected, or inherently PQ-native, including treasuries, exchanges, custodians, bridges, foundations, and major protocols
Claim: No critical wallets (exchanges, custodians, foundations, treasuries) have migrated to or are protected by PQC controls. No PQC migration path exists on mainnet.
Coverage basis: Official announcements + mainnet state
Implementation score: 0 · Evidence confidence: 0.9
Coinbase Custody and BitGo added ZEC support in 2025, but this is classical custody with no PQC path. The Zcash Foundation holds ZEC in its treasury but no PQC protection exists. Exchange infrastructure predominantly uses transparent addresses.
Migration Status
Legacy vulnerable pools/accounts/UTXOs/contracts are identified, measurable, deprecated, migrated, frozen, or proven not to exist by design
Claim: Legacy pools are identified and measurable: transparent pool is fully on-chain observable; shielded pools are measurable at pool level. Sprout pool deprecation (burn at NU7 activation height) is planned. Sapling and Orchard pools remain active and ECC-vulnerable with no deprecation timeline.
Coverage basis: Official protocol documentation + NU7 roadmap
Implementation score: 0.75 · Evidence confidence: 0.9
Sprout pool will be deprecated in NU7 (remaining funds burned at activation height). This is a legacy cleanup measure, not a quantum protection measure. Sapling and Orchard pools are the current active pools and both remain ECC-vulnerable. Score of 0.75 reflects that pools are identified and measurable and one (Sprout) has a deprecation plan, but the primary vulnerable pools (transparent, Sapling, Orchard) have no PQC migration timeline on mainnet.
Migration Mechanism / Governance
Public migration or protection roadmap with sequencing, activation criteria, and dependencies
Claim: A public multi-phase roadmap exists: (1) Quantum-recoverable wallets targeting June 2026; (2) NU7 mainnet with Orchard Quantum Recoverability targeting late 2026; (3) Full PQC transition via Project Tachyon targeting 2027. Sequencing and dependencies are publicly documented via ZIPs and official announcements.
Coverage basis: Official roadmap + ZIP specifications + public announcements
Implementation score: 0.25 · Evidence confidence: 0.6
Implementation score 0.25 (public design/proposal stage) because no mainnet activation has occurred. Evidence confidence 0.60 (formal specification + serious technical proposal) because ZIP 230 and the QR draft ZIP are formal specifications, but no mainnet proof exists. The roadmap is credible and technically detailed but remains unexecuted as of evaluation date.
Migration Mechanism / Governance
User-facing warnings, incentives, deadlines, education, or migration prompts
Claim: ZODL/ECC announced quantum-recoverable wallets at Consensus Miami (May 2026) with public education about the quantum threat. No on-chain migration prompts, deadlines, or incentives exist on mainnet. Sprout deprecation creates a deadline for Sprout holders but not for quantum migration.
Coverage basis: Official announcements + public communications
Implementation score: 0.25 · Evidence confidence: 0.4
Public education exists through conference presentations and blog posts. No on-chain migration prompts or deadlines for quantum migration exist. Evidence confidence 0.40 (official roadmap/proposal level) because the user-facing migration infrastructure is announced but not deployed.
Migration Mechanism / Governance
PQ/hybrid account creation, wallet defaults, transaction paths, or custody paths are default, strongly preferred, mandatory, or complete by design
Claim: No PQC or hybrid-PQC account creation, wallet default, or transaction path exists on mainnet. Zodl/Zashi defaults to shielded (Orchard) transactions, which improves privacy but does not provide quantum protection.
Coverage basis: Mainnet state + official documentation
Implementation score: 0 · Evidence confidence: 0.9
The shielded-by-default wallet behavior (Zodl routing users to Orchard via Unified Addresses) is a privacy improvement but not a quantum-security improvement. Orchard uses ECC-based cryptography. This is a common misconception in public discourse about Zcash's quantum readiness.
Migration Mechanism / Governance
Enforcement mechanism exists, such as deprecation, freeze, disabled legacy signing, restricted withdrawals, unsafe-path blocking, or mandatory migration after a deadline
Claim: Sprout pool deprecation (burn at NU7 activation) is the only enforcement mechanism planned. No enforcement mechanism for quantum migration exists. No deadline for transparent-address or Sapling/Orchard migration to PQC has been set.
Coverage basis: NU7 roadmap + ZIP specifications
Implementation score: 0.25 · Evidence confidence: 0.6
Sprout deprecation is a legacy cleanup, not a quantum migration enforcement. The NU7 v6 transaction format (ZIP 230) requires wallets to support v6 transactions by NU7 activation, which is a soft enforcement for wallet upgrades. No hard enforcement for PQC migration exists or is scheduled.
Migration Mechanism / Governance
Exchange, custody, bridge, wallet, and infrastructure coordination prevents unsafe fallback into vulnerable systems
Claim: NU7 testnet is live with QR components. ZODL is coordinating quantum-recoverable wallet rollout. No exchange or custodian coordination for PQC migration exists on mainnet. No bridge restrictions preventing fallback to non-PQ systems exist.
Coverage basis: Official announcements + testnet evidence
Implementation score: 0.25 · Evidence confidence: 0.6
NU7 testnet launched 2026-05-22 with QR components. Community sentiment polling showed >90% support for Tachyon and Orchard QR. ZODL is coordinating wallet upgrades. However, no mainnet enforcement or exchange coordination for PQC migration exists. Evidence confidence 0.60 reflects testnet-stage coordination.
Algorithm & Implementation Assurance
Uses NIST-standardized, standards-track, or broadly reviewed PQC/hybrid-PQC algorithms appropriate to the use case
Claim: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) have been identified as candidate algorithms for Zcash's PQC transition and are under active testing. No NIST-standardized PQC algorithm has been deployed on mainnet. Research into SPHINCS+ and lattice-based commitments is ongoing.
Coverage basis: Official roadmap + public research
Implementation score: 0.25 · Evidence confidence: 0.6
ML-KEM and ML-DSA are NIST-standardized (FIPS 203/204). Their identification as candidates is a positive signal. However, no formal ZIP specifying their integration parameters has been published as of the evaluation date. The Tachyon upgrade description mentions 'full post-quantum privacy' as a side-effect of the scalability redesign, but the specific PQC algorithm choices for spend authorization and proof systems are not yet finalized in a published ZIP.
Algorithm & Implementation Assurance
Independent cryptographic and implementation audit exists
Claim: Independent audits exist for the current ECC-based protocol: Least Authority audited NU6.1; NCC Group and QEDIT audited prior protocol versions. No independent audit of any PQC or quantum-recoverability component has been published. A quantum-resilience audit was referenced as scheduled for late 2025 but no published report has been identified.
Coverage basis: Published audit reports
Implementation score: 0.25 · Evidence confidence: 0.6
Quantum blocker: No independent audit exists for the claimed quantum-ready or quantum-recoverable system. Cap: 92 (not binding given lower caps from other blockers).
The existing audits (Least Authority NU6.1, NCC Group, QEDIT) cover the classical ECC-based protocol and are high quality. They do not cover any PQC or QR components. The Orchard QR security proofs were agreed upon in late April/early May 2026 and PRs are in review, but no external audit has been published. Score 0.25 reflects that serious audit infrastructure exists for the classical system and audits are planned/referenced for PQC components.
Algorithm & Implementation Assurance
Open-source, reproducible implementation
Claim: Zcash is fully open-source across all primary repositories (zcash/zcash, zcash/zips, zcash/librustzcash). The protocol specification is publicly available. Builds are reproducible.
Coverage basis: Public GitHub repositories + protocol specification
Implementation score: 1 · Evidence confidence: 0.9
All core Zcash code is open-source under MIT/Apache licenses. The protocol specification is a formal, publicly accessible document. The transition from zcashd (deprecated 2025) to Zebra (Rust) improves code quality and auditability.
Algorithm & Implementation Assurance
Parameter agility and future upgrade path are documented
Claim: Zcash's ZIP process and modular architecture (separate pools, versioned transaction formats, Halo 2 designed for proof system replaceability) provide a documented upgrade path. ZIP 230 (v6 transaction format) is designed to accommodate future PQC extensions.
Coverage basis: ZIP specifications + protocol design documentation
Implementation score: 0.75 · Evidence confidence: 0.9
The ZIP process provides a formal mechanism for protocol upgrades. ZIP 230 explicitly notes forward compatibility for future extensions. Halo 2's recursive proof architecture was designed with replaceability in mind. Score 0.75 rather than 1.00 because specific PQC parameter agility (algorithm selection, key size parameters, hybrid construction parameters) has not been formally specified in a published ZIP.
Algorithm & Implementation Assurance
Side-channel, fault-injection, state-management, hardware-wallet, HSM, or custody implementation risks are considered
Claim: librustzcash includes some side-channel mitigations (constant-time operations, zeroization). The FROST v3.0.0 release includes stronger zeroization. No specific PQC side-channel analysis has been published. Hardware wallet support for shielded transactions is limited.
Coverage basis: Open-source code review + FROST v3 release notes
Implementation score: 0.25 · Evidence confidence: 0.6
FROST v3.0.0 includes stronger memory zeroization. The Zebra v4.4.1 release included memory allocation fixes during block deserialization. These are positive signals for implementation security hygiene. However, no specific PQC side-channel analysis (lattice-based signature timing attacks, etc.) has been published. Hardware wallet support for shielded ZEC remains limited, which is a custody risk.
Report metadata
Generation Details
Project website Source repositorySource repositorySource repository