Private economies,
settled in ZEC

Zcash is the closest thing to private digital gold

Gold earned its role by being scarce, hard to confiscate at scale, hard to track, and durable across regimes. Bitcoin reproduced the scarcity and the durability, then published every holding on a ledger anyone can read, which is how a hedge becomes a target. Zcash keeps Bitcoin's monetary rules and encrypts the ledger. That is why we believe it is the closest thing to private digital gold in existence today.

The shielded pool encrypts the sender, the recipient, and the amount, and the network still verifies every transfer with a zero-knowledge proof. A spend hides among every shielded note ever created rather than among a handful of decoys, so the privacy does not weaken as analysis improves. Since the Orchard upgrade there is no trusted setup behind it. The supply is capped at 21 million on Bitcoin's halving schedule, the network has run since 2016, ZEC trades on regulated exchanges, and an owner can hand an auditor a viewing key without handing over the power to spend.

Zcash's design is public: notes, commitments, nullifiers, and the Orchard proof system are specified in the Zcash protocol specification. The Zcash page walks the mechanism and the argument at full length.

A vault is not an economy

Zcash was built to keep value private at rest. It was not built to let that value act inside other economies. Every route out of the shield today, an exchange, a swap network, a wrapped coin, puts ZEC on a public ledger under a signer set's word, and the crossing is where the privacy ends. Astrea is a different kind of bridge: shielded ZEC enters it by proof, and it stays shielded on the other side.

The mechanism is a proved bridge. A deposit is an ordinary shielded transfer to the bridge's Zcash address, so the Zcash chain shows nothing but a shielded transaction. The bridge keeps what it receives in Zcash's shielded pool; nothing is unshielded on the way in or the way out, and what Astrea adds is the bookkeeping, done in zero knowledge. Astrea then proves the Zcash chain itself: a registered computation checks the block headers and the work behind them, the note-commitment anchor, and the deposit note, and the result enters Astrea's certified state as an imported root. Inside Astrea the ZEC lives in a private ledger where every balance and transfer is a zero-knowledge receipt. Smart contracts can hold it and move it. An action that needs Ethereum reaches it through the bridge's proxy accounts, with Ethereum's state proved back in through the beacon chain's finalized checkpoints. A withdrawal is a shielded transfer back to the owner's Zcash address. The whole path, from the deposit proof inward, runs on Astrea's post-quantum proofs and paired signatures.

How this differs from the routes that move ZEC today

ZEC reaches other chains today through NEAR Intents and through vault-based swap networks such as THORChain and Maya. They work, and they share two properties: you trust a group of signers with your money, and the world sees what you did. The bridge is built so that neither is true. The table puts the two designs side by side.

Put simply: with NEAR Intents you trust a signer network and the world sees your swap. With Astrea you check a proof, the network's own validators hold the key, your ZEC stays ZEC while it works on Ethereum, and nobody sees the trade. The vault networks differ from NEAR only in who runs the signers.

NEAR Intents and chain signatures as described in the NEAR documentation. The Zcash page compares the custody designs in full, including multisig bridges and atomic swaps.

THE BRIDGE, END TO END

proved in · private inside · post-quantum throughout

The ledger is only half the leak

A perfectly shielded transaction still has a shape on the network: when it was sent, how large it was, which machine sent it, and which server it asked for its own history. Zcash leaves that shape to ordinary gossip, the same broadcast Bitcoin uses, and researchers have read it. Astrea carries the bridge's traffic through PRISM, a mix route built into the protocol at the transaction level: every packet and every transaction padded into a standard size class, cover traffic so silence and activity look alike, release scheduled and jittered so a broadcast never lines up with the action behind it, routes that rotate, and Dandelion# for where a public action first appears.

Tor helps, and it is not enough

Zcash can run over Tor. Full nodes can route their connections through it, and Zashi 2.1 now sends block downloads, broadcasts, and server calls through Tor using Arti, the Tor Project's Rust implementation, funded in part by Zcash Community Grants. That hides the wallet's network address from the server and from the relays, and it is worth doing. It leaves three things exposed. Tor is a low-latency network with no cover traffic: its designers state that it does not defend against an observer who can watch both ends of a connection and compare timing, and a burst of traffic when you sync or broadcast is still a burst. Tor is a transport, not a wallet protocol: it does not know what a Zcash transaction is, so it cannot pad one to a standard shape or hold it for a scheduled release, and a shielded transaction with four actions still looks different from one with two. And the light-wallet protocol tells the server which transactions are yours regardless of the route, because a wallet that finds a payment in a compact block fetches that transaction by its identifier to read the memo. Zcash's own wallet threat model documents this, and notes that the server can tell when a user received a shielded payment from bandwidth alone.

PRISM is designed to remove the signal rather than hide who is sending it. Sizes are bucketed, so a two-action transaction and a four-action transaction leave the wallet as the same class. Cover packets fill the gaps, so a wallet that is syncing, broadcasting, or idle produces the same stream. Release is scheduled, so a transaction does not appear on the network at the moment the owner acted. Requests reach a service over the mix, so the service sees a request arriving from the route rather than from you, and the answer comes back as a proof. The same route carries an agent's Zcash traffic and its Ethereum traffic, so Ethereum stays public and your use of it does not have to be. In plain words, a VPN for your money, with one difference. A VPN's exit node sees your traffic in the clear and has to be trusted not to look. Astrea's validators never see anything in the clear: every packet reaches them shaped and encrypted, and every action reaches them as a zero-knowledge proof, so they can verify that the rules were followed without learning who you are, what you hold, or what you did.

ONE TRANSACTION, TWO WAYS TO SEND IT

gossip vs PRISM

Timing has been enough in practice. Tramèr, Boneh, and Paterson showed in "Remote Side-Channel Attacks on Anonymous Transactions" (USENIX Security 2020) that a remote observer could identify the recipient of a shielded Zcash transaction from node response timing alone; the flaw was fixed after disclosure. Biryukov, Khovratovich, and Pustogarov linked Bitcoin transactions to the machines that sent them from broadcast patterns in "Deanonymisation of Clients in Bitcoin P2P Network" (CCS 2014). Tor's scope is stated by its designers in "Tor: The Second-Generation Onion Router" (USENIX Security 2004). Zashi's Tor integration: Electric Coin Company, Zashi 2.1. The light-wallet leak: Zcash's wallet app threat model and Hornby, "Fixing Privacy Problems in the Zcash Light Wallet Protocol". The privacy page states what PRISM reduces and what it does not.

What a proof manifold changes

A proof is a way to check that something is true without redoing the work yourself. A manifold is a space where many things join into one continuous whole. Astrea's proof manifold is both at once: compute, confidentiality, and trust collapse into a single space of verifiable proofs. An operation runs once, carries a zero-knowledge receipt, and every participant can check it — the proof travels, the secrets never do.

Blockchains usually earn confidence the expensive way: every participant repeats every computation, and users still take a server's answer on faith. Astrea keeps the goal and changes the method. Where the standard design asks for repetition or trust, the manifold produces evidence that a validator, a wallet, or an auditor can check directly.

ONE COMPUTATION, TWO WAYS TO TRUST IT

repetition vs evidence

The practical effects follow directly. Agreement never waits on the heaviest work, because consensus checks evidence instead of redoing computation. A wallet can verify a balance from a server it has no reason to trust. Operations that provably cannot interfere may run at the same time. And recorded traffic cannot be unlocked later by breaking classical key agreement alone, because session secrets combine a classical half with a post-quantum half.

The verification operating system, in three parts

Proofs need a system that produces them, orders them, and keeps them checkable. Astrea's operating system separates those powers: consensus decides one shared history, PixelVM runs each registered computation once and proves it, and versioned authenticated state lets any client verify the answer it received.

THE PROOF MANIFOLD, END TO END

runs once · proves itself · anyone verifies

Follow the story from the vault to the applications

Start with the case for Zcash, the bridge, and the agents that will use them. Then follow the machinery in plain language: where the shared history is decided, how execution is proved, how state keeps its versions, how the transport and the privacy route protect the lanes, and what gets built on top.