Join the hunt for $12,000,000+ in NEXO Tokens!

Learn More

Zcash Privacy Back in Question after User Traces Shielded Transaction

Twitter user MoneyKnowledge0 challenged "friendly attackers" to trace his private Zcash transaction.

coinbase delists zcash at banks request

Key Takeaways

  • A simple Zcash transaction was traced in real-time this week.
  • This does not show that Zcash's privacy model has failed; rather, it shows that some Zcash transactions are easy to trace.
  • However, Zcash's privacy has been called into question due to large-scale tracing efforts from Carnegie and Chainalysis.

Share this article

During a Zcash community challenge, one user, Brian Deep, was able to trace a ZEC transaction from another user, MoneyKnowledge0, back to its source in less than three days. The event revealed critical misunderstandings among users and the privacy of the network.

How the Transaction Was Traced

Zcash relies on two types of addresses: shielded addresses (z-addresses) and transparent addresses (t-addresses).

In this case, MoneyKnowledge0 made a donation from his shielded address to a recipient’s shielded address. From there, Brian Deep was able to determine which transparent address MoneyKnowledge0 used to fund his original shielded address.

The transaction was easy to trace because MoneyKnowledge0 made each transaction over a very short period. Deep reportedly told MoneyKnowledge0 to “divide funds and make longer breaks between transactions” for better privacy.

As such, the traceability of MoneyKnowledge0’s transaction is arguably user fault, not a problem of Zcash itself.

Though MoneyKnowledge0 called Deep’s success a “lucky guess,” he awarded $100 worth of ZEC to the friendly attacker for his work.

Zcash CEO Weighs In

Zooko Wilcox, CEO of Zcash, commented on the matter by noting that “pass through” privacy methods do not work, and that shielded fund storage is what provides privacy.

According to Wilcox, longer gaps between transactions provide little benefit. Instead, users who want privacy should store their funds in Zcash’s shielded pool.

If MoneyKnowledge0 had used the shielded pool for storage, the transaction “[wouldn’t] be linkable going solely from information in the blockchain,” Wilcox says.

ZEC’s Privacy Issues

This is not the first time that Zcash’s privacy has been questioned.

In May, Carnegie Mellon University suggested that more than 99% of users fail to use ZEC’s privacy and shielding features. Chainalysis, a data analytics firm, also suggested that it was able to trace most Zcash and Dash transactions in June.

As of July 2020, just over 11% of ZEC transactions are shielded, according to Zchain’s Zcash block explorer.

Zcash could encourage users to use shielded addresses through “on-by-default” or mandatory privacy, as seen in other privacy coins like Monero. Although Zcash developers have considered on-by-default privacy since 2018, the feature has not yet been put in place.

Share this article