Privacy coins: the trade-off between anonymity and control

Invisibility protects users, but it can also conceal errors

In June 2026, a vulnerability was identified in Zcash’s shielded transaction system for the second time in seven years. The flaw could have enabled the creation of counterfeit coins without leaving verifiable traces. No attack was detected, but the episode brought one of the structural contradictions of privacy coins back into focus: when a protocol is designed to shield transactions from public scrutiny, anomalies can also become difficult, or even impossible, to reconstruct.

Privacy coins emerged from an attempt to transfer one of cash’s defining properties into the digital world: the ability to exchange value without making the identities of the parties, the amounts involved and the history of the transactions publicly visible. Monero and Zcash are the most advanced applications of this idea, but they also reveal the trade-off it entails: the more effectively a protocol protects users’ information, the harder it becomes to verify its proper functioning from the outside. Privacy therefore affects not only the traceability of payments, but also the ability to identify anomalies and reconstruct their consequences.

Cypherpunk roots

Privacy coins are the result of a debate that began long before the creation of Bitcoin. Their origins can be traced back to early research into electronic money in the 1980s and, later, to the cypherpunk movement, which regarded cryptography not only as a technical discipline but also as a tool for protecting communications, identities and transactions from governments and large centralised infrastructures.

One of the main precursors was David Chaum, an American cryptographer and computer scientist widely regarded as one of the pioneers of digital money. In 1982, he described so-called blind signatures, a technique that allows a party to sign and validate information without knowing its contents.

When applied to payments, the mechanism allowed a bank to issue a digital monetary unit without being able to link it, when spent, to the person who had previously withdrawn it. The intermediary continued to guarantee the issuance and validity of the money, but lost the ability to reconstruct the user’s entire payment history.

Chaum attempted to turn this research into a commercial system by founding DigiCash in 1989. The company developed eCash, a system piloted from the mid-1990s in which users could withdraw digital equivalents of banknotes from their bank and spend them without the institution being able to associate the payment with the previous withdrawal.

Unlike later crypto-assets, eCash did not eliminate the issuing bank and did not rely on a distributed ledger. Instead, it sought to reproduce in the digital world one of cash’s defining properties: the ability to make a payment without automatically creating a complete and permanent record of the identities of the parties involved.

Chaum’s contribution was decisive because he identified, well in advance, a problem that would later re-emerge with blockchains. A digital payment produces data that can be stored, aggregated and analysed over time. Without specific cryptographic protections, electronic money can therefore be significantly more traceable than physical cash.

In the 1990s, this approach was taken up by the cypherpunk movement. Privacy was not seen as a simple individual preference, but as a property to be embedded directly into protocols: protection that depends on the discretion of an intermediary can be withdrawn, whereas protection guaranteed by cryptography becomes part of the system’s architecture.

What privacy coins are

Privacy coins are crypto-assets whose protocols incorporate cryptographic tools designed to reduce transaction traceability. They aim to conceal, or make difficult to correlate, three key pieces of information: who is spending, who is receiving the funds and how much is being transferred.

They do not, however, form a technically homogeneous category. Some protocols automatically shield all transactions; others allow users to choose between public and private transactions; others still do not conceal the data directly, but combine multiple payments to make financial flows harder to reconstruct.

A central concept is unlinkability, meaning the impossibility, or at least the difficulty, of establishing that different transactions belong to the same entity. The absence of a user’s name does not in itself guarantee genuine privacy. If an observer can link addresses, amounts, timestamps and recurring behavioural patterns, they may still reconstruct a financial profile and later attempt to associate it with a real identity.

Monero, Zcash and Dash represent three distinct models. Monero applies privacy by default and does not allow fully transparent transactions. Zcash, by contrast, maintains both a public and a shielded component, leaving users to choose their preferred level of disclosure. Dash uses PrivateSend, a system that combines funds from multiple users to obscure their origin, but does not cryptographically conceal every component of the transaction.

There are also smaller protocols, such as Bytecoin and Horizen, but Monero and Zcash remain the two main reference cases in terms of technical sophistication, market relevance and influence on the debate surrounding financial privacy.

A marginal segment of the market

The technical and philosophical relevance of privacy coins far exceeds their economic weight. In mid-July 2026, Zcash had a market capitalisation of approximately $9.2 billion, Monero around $6.2 billion and Dash roughly $440 million. Together, the three largest privacy coins were worth just over $15.8 billion, compared with a total crypto-asset market capitalisation of between $2.2 trillion and $2.3 trillion.

Their combined weight therefore remained below 1% of the total market. Zcash and Monero retained a significant presence among the leading crypto-assets, ranking approximately eleventh and sixteenth by market capitalisation respectively, while Dash was considerably smaller. Privacy coins are therefore marginal in quantitative terms, but central to the issues they raise: fungibility, financial surveillance, regulatory compliance and the verifiability of the monetary supply.

How they differ from Bitcoin: transparency and traceability

Bitcoin is often described as “anonymous”, but the technically more accurate term is “pseudonymous”. Transactions are not directly associated with a legal identity, but they are recorded publicly and permanently on the blockchain.

Each transaction uses unspent outputs created by previous transactions as inputs and generates new outputs that allocate funds to recipients. These data, together with the addresses involved and the amounts transferred, remain publicly accessible.

Addresses are cryptographic strings and do not contain the holder’s name. Their activity can nevertheless be observed and aggregated over time. When at least one address is linked to a person or organisation, for example through an exchange that applies customer identification procedures, it becomes possible to reconstruct a significant portion of the associated flows.

On-chain forensic analysis does not focus only on individual addresses, but seeks to reconstruct the relationships between them. Using heuristics and behavioural models, specialised firms identify clusters of addresses likely to be controlled by the same entity and detect recurring patterns in financial flows. Privacy coins intervene at precisely this level, seeking to break the observable link between sender, recipient and transferred amount.

How privacy works: Monero, Zcash and Dash compared

Monero builds its privacy model around three tools used together. Ring signatures protect the sender by placing the output actually being spent within a set of decoy outputs: the network can verify that one of them has been legitimately used without identifying which one. Stealth addresses protect the recipient by generating a one-time address for each payment that cannot be directly linked to other funds received by the same user. RingCT, short for Ring Confidential Transactions, conceals the amounts, allowing the protocol to verify the balance between inputs and outputs without revealing their values.

Monero’s privacy therefore derives from the simultaneous protection of sender, recipient and amount. Because these mechanisms are mandatory, all transactions contribute to the same anonymity set: the broader and more homogeneous that set, the harder it becomes to isolate the real transaction.

Zcash adopts a different model based on zk-SNARKs, zero-knowledge proofs that make it possible to demonstrate the validity of a transaction without revealing the underlying data. The protocol can therefore verify that the sender owns the funds, is authorised to spend them and has not created new money, while keeping addresses and amounts hidden.

Unlike Monero, however, Zcash distinguishes between transparent and shielded addresses. Transactions can be public, private or transfer funds between the two components of the protocol. This flexibility broadens the range of possible use cases, but it can also provide additional information for correlating transactions, particularly through the analysis of amounts and the timing of movements into and out of the shielded pool. Viewing keys also allow the holder to selectively disclose transaction data to an auditor or authority.

Dash instead uses PrivateSend, a variant of CoinJoin. This technique combines the inputs and outputs of multiple users within a single transaction, making it more difficult to reconstruct the correspondence between senders and recipients. The data remain public, but their interpretation becomes more uncertain.

PrivateSend therefore increases uncertainty in flow analysis, but does not cryptographically conceal all components of the transaction through proofs equivalent to those used by Monero and Zcash. It is therefore better described as an obfuscation mechanism than as a complete shielding of transaction data.

The distinction between mandatory and optional privacy is substantial. In Monero, privacy is a uniform property of the ledger; in Zcash, it depends on users’ choices and on the level of activity within the shielded pool. The less the shielded pool is used, the narrower the set in which an individual transaction can blend.

The cost of privacy

A historically significant part of the Monero community belongs to the crypto-anarchist and cypherpunk tradition and considers financial privacy an essential component of individual freedom. From this perspective, the ability of banks, platforms or governments to reconstruct payments and holdings represents a risk regardless of the legitimacy of individual transactions.

The same properties can, however, also be used to shield illicit activity from scrutiny. It is this neutrality of the technology that has made privacy coins particularly controversial: the protocol does not distinguish between a user who is legitimately protecting their financial data and one who is attempting to conceal the origin or destination of funds.

The cost of privacy is not only regulatory. When senders, recipients and amounts are not observable, it becomes more difficult to verify externally whether the monetary supply and the protocol’s accounting rules have been respected.

On a transparent blockchain, imbalances can be identified through direct analysis of the ledger. In a shielded system, validity instead depends on the correctness of the cryptographic proofs and of the code implementing them. If one of these mechanisms contains an error, the network may accept a transaction that appears valid without it being possible to reconstruct all of its consequences afterwards.

Zcash and Monero’s security precedents

Zcash has faced this risk on two occasions. In 2018, a vulnerability was identified in the proving system used for shielded transactions that could have enabled the creation of arbitrary quantities of ZEC, the network’s native asset, without the resulting increase in supply being detectable through blockchain analysis. The flaw was fixed in October of that year and disclosed only in February 2019, after the network had completed the upgrade.

In June 2026, a similar issue emerged in Orchard, the system used by Zcash since 2022 to manage one of the protocol’s shielded components. Again, the vulnerability could have enabled the creation of counterfeit coins without producing a publicly verifiable trace. The developers found no evidence of systematic exploitation, but the shielded nature of the protocol makes it impossible to rule it out completely.

Monero has experienced different vulnerabilities, but they are linked to the same broader problem. In 2017, a flaw inherited from the CryptoNote protocol could have enabled the creation of coins through abnormal handling of outputs. Monero fixed the issue before any exploitation was detected, while Bytecoin, which was based on the same technological family, suffered the unauthorised creation of hundreds of millions of units.

In 2018, the so-called multiple counting bug, also related to the Monero ecosystem, allowed some external systems to count the same transfer more than once. The blockchain did not record multiple payments, but an exchange without the necessary controls could interpret the same transaction repeatedly and credit the user with a balance greater than the amount actually deposited.

Subsequent vulnerabilities in the decoy output selection algorithm also affected Monero. They did not allow the creation of new coins or the direct theft of funds, but made some decoys distinguishable from the output actually being spent. Under certain conditions, an observer could therefore reduce the number of possible senders and weaken the privacy guaranteed by ring signatures.

The Zcash and Monero cases therefore reveal two mirror-image risks. An error can conceal a breach of monetary integrity or make a transaction more visible than the protocol is supposed to allow. In the first case, it becomes impossible to verify with certainty that the supply has not been altered; in the second, the anonymity set on which the user’s privacy depends becomes narrower.

Conclusions

Privacy coins demonstrate that it is possible to verify a transaction without making the sender, recipient and amount public. Monero and Zcash have taken this idea to a high level of sophistication, but their security history also reveals the limits of the model: when the ledger does not expose what happens within it, it becomes harder to distinguish between the absence of anomalies and the inability to observe them.

This issue is particularly relevant when a vulnerability affects the monetary supply. In a shielded protocol, a flaw can enable the creation of unauthorised coins without producing sufficient evidence to determine, even after the issue has been fixed, whether it was actually exploited and to what extent.

Privacy therefore protects users, but it also reduces the amount of information available to monitor the system. Privacy coins do not eliminate the trade-off between privacy and verifiability: they place it in the strength of the cryptographic tools, their correct implementation and the quality of the code review process. When the cryptography or its implementation contains a flaw, opacity ceases to be merely a form of protection and becomes a limit on the very possibility of reconstructing what happened.