Guide · November 3, 2026 · 10 min read

Monero vs Zcash: which privacy coin is really private?

Private by default or private by choice: how each one hides a payment, where each one leaks, and what 2026 changed

Short answer: Monero is private by default. Every transaction hides who paid, who was paid and how much, so every user blends into the same crowd. Zcash is private by choice. Its shielded transactions use stronger cryptography than Monero’s, but transparent transactions, which are as public as Bitcoin’s, are still allowed and still common, and each one that touches the shielded pool can leak. If you want privacy without having to think about it, Monero is the safer choice. Zcash can be as private or more, provided you stay entirely in its shielded pool.

Both are serious projects, built by people who care about financial privacy, and both had a difficult year. Here is how they differ, point by point, and what that means in use.

Monero and Zcash at a glance

	Monero (XMR)	Zcash (ZEC)
Privacy	Always on, for every transaction	Optional: shielded or transparent
Hides	Sender, receiver, amount	Sender, receiver, amount and memo, when shielded
How	Stealth addresses, ring signatures, RingCT	Zero-knowledge proofs (zk-SNARKs)
Who you hide among	15 decoys per input today; the whole chain after FCMP++	Everyone in the same shielded pool
Share of private activity	All of it	About 29% of the supply shielded, end of September 2026
Trusted setup	None	None for its current pools; the older ones needed one
Block time	2 minutes	75 seconds
Supply	No cap: 0.6 XMR per block, forever, since 2022	21 million cap, halving every four years
Mining	RandomX, made for ordinary computers	Equihash, dominated by dedicated machines
Development funding	Donations	A share of every block reward
Big exchanges	Mostly delisted	Widely listed, often for transparent use only

How does Monero hide a transaction?

Monero uses three techniques together, on every transaction, with no way to turn them off:

Stealth addresses hide the receiver. You publish one address, but every payment to it lands on a new one-time address that only your wallet can recognise. Nobody looking at the chain can tell that two payments went to the same person.
Ring signatures hide the sender. Each coin you spend is signed together with 15 others taken from the chain, so an observer sees 16 possible origins and can’t tell which one is real.
RingCT hides the amount. The blockchain only shows commitments to the amounts, with a short proof (Bulletproofs+) that nothing was created out of thin air.

Monero also sends new transactions through the network with Dandelion++, which makes it harder to tell which computer a transaction started from. And because privacy is mandatory, Monero has no “private users” and “public users”: an exchange’s withdrawals look exactly like yours.

The weak point is the ring. Sixteen is a small crowd, and decoys can sometimes be ruled out statistically, for example when they are too old or too young to be likely. Monero’s planned answer is FCMP++, full-chain membership proofs, which replace the 16-member ring with a proof that the coin is one of all the outputs on the chain. As of this writing FCMP++ runs on a public test network. It is not live, and no date is set for the main network: a developer’s draft plan mentions around March 2027, and says it isn’t binding.

How does Zcash hide a transaction?

Zcash uses zero-knowledge proofs. A shielded transaction carries a mathematical proof that it is valid, that the coins exist and aren’t spent twice, without showing what they are, where they came from or where they go. In the shielded pool, there are no decoys: the coin you spend could be any coin in the pool. On paper, that is a bigger crowd than Monero’s ring of 16.

But Zcash keeps two kinds of addresses:

Transparent addresses (starting with t) work like Bitcoin’s. Everything is public: sender, receiver, amount.
Shielded addresses hide all three. They have been rebuilt several times, as successive “pools”: Sprout in 2016, Sapling in 2018, Orchard in 2022, and Ironwood since July 2026. Modern wallets give one “unified” address that covers the kinds a wallet supports.

Moving coins from a transparent address into a pool is called shielding; out of it, deshielding. Inside the pool, Zcash is very private. At its edges, it is as public as Bitcoin.

Why does “by default” matter so much?

Privacy is a crowd. You are hidden only among the people doing the same thing as you. In Monero, that is everyone. In Zcash, it is the people in the shielded pool, and how much they use it.

That crowd has grown fast. According to Blockworks’ Q3 2026 report, about 29% of all ZEC sat in shielded pools at the end of September 2026, against about 18% in October 2025, and over half of all transactions (52.7%, outside mining rewards) touched a shielded pool during the quarter. It is the strongest Zcash shielded usage has ever been. It still means that most of the supply, and nearly half of the activity, is public.

The edges leak in ways that are easy to miss. If you shield 3.14159 ZEC from your exchange account and someone deshields 3.14159 ZEC to another exchange an hour later, the pool’s mathematics doesn’t matter: the amounts and the timing give it away. A 2018 study of Zcash (Kappos and others, USENIX Security) linked most of the coins going into and out of the shielded pool of the time this way, largely because of how miners and the founders moved their rewards. Today’s wallets avoid the worst of it, but no wallet can protect a user who withdraws to a transparent address and spends straight from it.

Monero has had its own study of that kind. In 2018, Möser and others showed that most early Monero transactions could be traced, because many used no decoys at all. Monero then made decoys mandatory, and raised their number several times since. The difference is that a Monero user can’t choose to opt out; a Zcash user can, and often does without knowing it.

Which one has the stronger cryptography?

Zcash, in principle. A zero-knowledge proof hides the sender among the whole pool, not among 15 decoys, and Zcash’s research teams have pushed this field forward for a decade.

Its history comes with a caveat. Zcash’s first two pools depended on a trusted setup: a ceremony that produced secret parameters which had to be destroyed. If someone had kept them, they could have created ZEC from nothing, invisibly. The ceremonies were designed so that one honest participant was enough, and Orchard, in 2022, removed the need entirely with a proof system called Halo 2.

Then came 2026. On 29 May, a security engineer working for Shielded Labs found a flaw in Orchard’s circuit, the code that defines what the proofs check, present since 2022. In theory it allowed counterfeit ZEC that nobody could detect. It was fixed in an emergency release on 1 June, ZEC fell by about 38% in a day when it was announced, and the developers said there is “no definitive way” to prove from cryptography alone that it was never exploited, though they believe it wasn’t. The response was the Ironwood pool, activated in July 2026 at block 3,428,143 (network upgrade NU6.3): Orchard can now only be spent from, never added to, so every coin leaving it is counted at the door and the supply can be checked again.

Monero has been there too. In 2017, a flaw in the CryptoNote code it came from would have allowed unlimited coins to be created; Monero fixed it before anyone used it on its chain, but a coin from the same family was exploited. Hidden amounts have a cost in both coins: nobody can audit the supply by adding up balances, as with Bitcoin. Each coin relies on its proofs being correct, and each has, once, had to show that they nearly weren’t.

How are the networks secured?

Monero is mined with RandomX, designed so that an ordinary computer’s processor competes fairly with specialised hardware. That keeps mining open to anyone, but also makes it possible to rent or redirect a large share of the hashrate. In September 2025, Monero suffered an 18-block reorganisation, the deepest in its history, during a period when the mining pool Qubic claimed a large share of the network; responsibility was never proven. In response, Monero’s researchers proposed temporary checkpoints, published by trusted nodes, against deep reorganisations.

Zcash is mined with Equihash, dominated by dedicated mining machines, a model closer to Bitcoin’s. Its upgrades come through a more formal process, with numbered proposals (ZIPs) and organisations funded by the block reward. Monero has no foundation taking a share of mining rewards: its development is paid by donations, through a community crowdfunding system.

Supply and money: which one holds value?

Zcash copies Bitcoin: 21 million coins at most, with the reward halving every four years, the last time in November 2024. Monero chose a permanent “tail emission” of 0.6 XMR per block from 2022, so that miners are always paid even when fees are low. The supply grows forever, by less than 1% a year, and that percentage falls over time. Whether a cap or a tail is better is an old debate; for private payments, what matters most is that the network stays secure in twenty years.

Where can you buy them, and what about the law?

Zcash is much easier to find. Many big exchanges list Zcash, because they can use its transparent addresses and see every deposit and withdrawal, which is also why buying ZEC from an exchange usually starts on a transparent address. Monero is now mostly found on no-KYC swap services, peer-to-peer markets and atomic swaps from Bitcoin.

The EU’s anti-money-laundering rules, which apply from 10 July 2027, define “anonymity-enhancing coins” as coins with built-in privacy, “either systematically or optionally”. That covers Monero and, read plainly, Zcash too. We set out what that rule does and doesn’t forbid in Will Monero be banned in the EU in 2027? In short: it binds exchanges and banks, not you or your wallet.

Which wallets should you use?

For Zcash, choose a wallet built around the shielded pool. Zodl (formerly Zashi) only spends shielded coins and asks you to shield anything that arrives on a transparent address. Cake Wallet shields incoming transparent coins for you. Both matter more than they sound: most Zcash privacy mistakes start with a transparent balance.

For Monero, any maintained wallet gives you the same privacy on chain, because there is nothing to turn on. Choose one that lets you reach the network privately too, over Tor or through your own node. Biscuit is a Monero-first desktop wallet: it holds Monero next to a few other coins, can connect over Tor, and can turn another coin into Monero with exchange swaps or, from Bitcoin, an atomic swap. It doesn’t hold Zcash; for private payments, it is built around Monero.

So which one should you choose?

You want privacy you don’t have to manage: Monero. Every transaction is private, so mistakes cost less and your payments look like everyone else’s.
You want to pay someone who can’t know your balance: both work, if you use Zcash fully shielded.
You need to show a payment to an auditor or a tax office: both can. Monero has view keys and payment proofs; Zcash has full and incoming-only viewing keys. Zcash’s tools for this are a little more fine-grained.
You need to buy and sell on regulated exchanges easily: Zcash, for now, at the price of starting from a public address, and with the EU’s 2027 rule ahead.
You care most about the strength of the mathematics: Zcash’s shielded pool, today. If FCMP++ ships, the gap narrows a lot.

Our view, as Monero-first wallet makers: the best privacy is the one you get by default, because people make mistakes and adversaries don’t forget them. But a Zcash user who stays in the shielded pool is very well protected, and a Monero user who reuses one address on a public forum isn’t. The coin is only half of it.

Quick answers

Is Zcash really private?

Its shielded transactions are: they hide the sender, the receiver and the amount. Its transparent transactions are fully public, like Bitcoin’s. Zcash is private if you stay shielded, and you have to choose to.

Is Monero untraceable?

No coin is untraceable in every case, but Monero hides the sender, receiver and amount of every transaction. Its main weakness is that a spent coin hides among 16 possible origins; FCMP++, still in testing, would make that the whole chain.

Which is more private, Monero or Zcash?

For most people, Monero, because it is private by default and every user adds to the same crowd. A fully shielded Zcash transaction can be as private or more, but most ZEC is still held on public addresses.

Can I swap Zcash for Monero?

Yes, many no-KYC swap services offer the pair. To keep the privacy of both, send from a shielded Zcash address and receive at a new Monero address in your own wallet.

What was the Zcash Orchard bug?

A flaw found in May 2026 in the circuit of Zcash’s Orchard pool, present since 2022, that could in theory have allowed undetectable counterfeit coins. It was fixed on 1 June 2026; no exploit was found. Zcash then moved to a new pool, Ironwood, with counted exits from Orchard.

When is FCMP++ coming to Monero?

No date is set. It runs on a public test network, and a non-binding developer plan mentions around March 2027. Watch getmonero.org for the official announcement.

Is Zcash banned in the EU?

No. From July 2027, licensed crypto businesses in the EU may no longer hold privacy coins for customers, and Zcash may be covered. Owning it yourself stays legal, like Monero.

Sources

Kappos, Yousaf, Maller and Meiklejohn, An Empirical Analysis of Anonymity in Zcash, USENIX Security 2018
Möser and others, An Empirical Analysis of Traceability in the Monero Blockchain, PETS 2018
ZIP 258, deployment of the NU6.3 network upgrade (Ironwood)
Blockworks, Zcash token holder report, Q3 2026 (shielded supply and transactions)
CoinDesk, 5 June 2026, on the Orchard bug
getmonero.org, the Monero project

Learn more

Questions? Write to us through the contact page.