Peter Todd

Zcash

Coin

Halo

Sprout

The&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/zcash-privacy-cryptocurrency-zk-snarks" rel="noopener noreferrer nofollow">Zcash</a> “ceremony” was a trusted setup held in October 2016. The original genesis ceremony took place on October 23, 2016, and it generated the public zk-SNARK parameters behind Zcash’s private transactions.&nbsp;
Six people each made one piece of a secret key and destroyed it, so the full key could never exist. Ten years later, the story matters again. ZEC is a top-10 coin, and an upgrade is about to retire the pool that the ceremony created.
<h2 id="span-span-what-was-the-zcash-ceremony-trying-to-solve-span-span">What Was The Zcash Ceremony Trying To Solve?</h2>
The answer starts with how Zcash hides payments.
Zcash uses zk-SNARKs, a type of zero-knowledge proof. This technique proves a statement is true without revealing why it is true. Early SNARK systems needed a one-time setup that creates a “structured reference string,” a set of public parameters. The secret randomness left over is called “toxic waste.” If anyone rebuilt it, they could forge proofs that still pass verification.<a style="text-decoration:none" href="https://www.bit.com/knowledge-hub/zcash" rel="noopener noreferrer nofollow">&nbsp;</a>
For Zcash, that meant fake coins. A leaked master secret would let an attacker create unlimited counterfeit ZEC without being detected.
<h2 id="span-span-how-did-six-people-launch-a-coin-span-span">How Did Six People Launch A Coin?</h2>
The team split the risk across several people using cryptography.
<h3 id="span-span-the-multi-party-computation-design-span-span">The Multi-Party Computation Design</h3>
Multi-party computation (MPC) lets several parties build one result without anyone seeing the whole secret. Six participants each produced one shard of the key set, each in a separate location with separate hardware.&nbsp;
Zooko Wilcox recruited the group, but the others were not told who else was taking part. Rebuilding the toxic waste needs every shard, so the setup fails only if every participant is compromised.
<h4>The Six Participants And The Destroyed Hardware</h4>
<ul>
 <li><a style="text-decoration:none" href="https://bsc.news/post/zooko-wilcox-zcash-founder" rel="noopener noreferrer nofollow">Zooko Wilcox</a>, Zcash’s founder, who organized the ceremony</li>
 <li>Peter Todd,&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/what-is-bitcoin-how-it-works-mining-digital-gold-guide" rel="noopener noreferrer nofollow">Bitcoin</a> Core developer</li>
 <li>Andrew Miller, Zcash advisor</li>
 <li>Peter Van Valkenburgh, researcher at Coin Center</li>
 <li>Derek Hinch</li>
 <li>“John Dobbertin,” revealed in April 2022 to be Edward Snowden. Zooko chose the pseudonym to honor the German cryptographer Hans Dobbertin.</li>
</ul>
After the ceremony, the machines were destroyed so no leftover data could be read from their memory. Za Wilcox, Zooko’s brother, destroyed one computer used to generate random numbers.
<h3 id="span-span-strong-why-did-critics-call-it-security-theater-strong-span-span">Why Did Critics Call It “Security Theater”?</h3>
Not everyone was convinced. Peter Todd later argued that anyone with access to the software used that day could reach everything the ceremony ran on, so it was not truly six independent sources of randomness.
The ceremony’s output powered Sprout, Zcash’s first shielded pool. A shielded pool is the group of private ZEC that follows one set of privacy rules. Sprout used a proof system called BCTV14, built on the 2016 parameters.&nbsp;
In 2018, engineer Ariel Gabizon found a flaw in BCTV14 that could have allowed unlimited fake ZEC. The ceremony itself was carried out correctly, but the error sat in the research behind the parameters. The Sapling upgrade replaced BCTV14 and fixed the flaw on October 28, 2018, and the team disclosed it in February 2019.
<h2 id="span-span-how-did-zcash-move-beyond-the-trusted-setup-span-span">How Did Zcash Move Beyond The Trusted Setup?</h2>
Each new shielded pool reduced reliance on the 2016 event.
<h3 id="span-span-sapling-and-powers-of-tau-span-span">Sapling And Powers Of Tau</h3>
For Sapling, Zcash ran an open ceremony. Phase 1, called Powers of Tau, drew 87 contributors, and about 90 people took part in total.<a style="text-decoration:none" href="https://www.spark.money/glossary/trusted-setup" rel="noopener noreferrer nofollow">&nbsp;</a>
<h3 id="span-span-orchard-halo-2-and-ironwood-span-span">Orchard, Halo 2 And Ironwood</h3>
Orchard was designed to remove the trusted setup, so no hidden secret is created and no ceremony is needed. Bugs in the circuit itself remain possible, though. In May 2026, researcher Taylor Hornby found that one elliptic-curve multiplication step in Orchard’s zero-knowledge circuit was under-constrained. In plain terms, the circuit did not check that step fully.<a style="text-decoration:none" href="https://blofin.com/academy/education/zcash/zcash-trusted-setup-explained" rel="noopener noreferrer nofollow">&nbsp;</a>
Zcash responded with Ironwood. Ironwood is a separate shielded pool that keeps key parts of Orchard’s design, including the Halo 2 proving system. The old Orchard pool now allows withdrawals only.<a style="text-decoration:none" href="https://www.kucoin.com/blog/ua-zcash-ironwood-nu6-3-shielded-pool-migration" rel="noopener noreferrer nofollow">&nbsp;</a>
<h2 id="span-span-what-is-happening-with-zcash-now-span-span">What Is Happening With Zcash Now?</h2>
The ceremony’s legacy is closing out this month.
<ul>
 <li>NU7 upgrade: NU7 went live on testnet at block 4,465,026 on October 4. It cuts block time from 75 to 25 seconds and disables version 4 transactions. That makes ZEC left in the old Sprout pool unspendable if it is not moved before activation. A mainnet decision is due October 20, with a November 5 target.<a style="text-decoration:none" href="https://www.chaincatcher.com/en/article/2294145" rel="noopener noreferrer nofollow">&nbsp;</a></li>
 <li>ETFs: The Winklevoss filing proposes a fund that holds ZEC directly, uses Gemini as custodian, charges 0.25% a year and would trade on Nasdaq as WINK. Valour also launched a Zcash exchange-traded product in Sweden.<a style="text-decoration:none" href="https://www.theblock.co/news/markets/2026-10-06-winklevoss-files-spot-zcash-etf-wink-417826" rel="noopener noreferrer nofollow">&nbsp;</a></li>
 <li>Shielded use: The share of ZEC held in shielded pools rose from about 9% in September 2023 to roughly 28%.<a style="text-decoration:none" href="https://hackernoon.com/soda-labs-raises-$3m-from-nextblock-to-let-regulated-money-move-privately-on-public-chains" rel="noopener noreferrer nofollow">&nbsp;</a></li>
 <li>Rankings: ZEC entered the top 10, pushing out Cardano and Chainlink.&nbsp;</li>
</ul>
ZEC traded near $1,332 on October 12, roughly 8% above the previous day. It has rebounded even as investors keep withdrawing money from Grayscale’s Zcash ETF, with weekly ZCSH outflows of $30.72 million.&nbsp;
<h2 id="span-span-conclusion-span-span">Conclusion</h2>
The 2016 ceremony let Zcash launch private payments with zk-SNARKs, using six shards so that one honest participant kept the system safe. Sapling widened that trust to about 90 people. Orchard and now Ironwood use Halo 2, which needs no trusted setup. With NU7, Zcash is retiring the Sprout pool the ceremony created.
<h2 id="span-span-resources-span-span">Resources</h2>
<ol>
 <li><a style="text-decoration:none" href="https://coinbureau.com/education/zcash-ceremony" rel="noopener noreferrer nofollow">Coin Bureau</a>: What is the ZCash Ceremony?</li>
 <li><a style="text-decoration:none" href="https://en.coinotag.com/glossary/zcash-ceremony" rel="noopener noreferrer nofollow">CoinOtag</a>: What Is the Zcash Ceremony?</li>
 <li><a style="text-decoration:none" href="https://www.spark.money/glossary/trusted-setup" rel="noopener noreferrer nofollow">Spark Glossary</a>: Trusted Setup</li>
 <li><a style="text-decoration:none" href="https://www.bit.com/knowledge-hub/zcash" rel="noopener noreferrer nofollow">BIT Knowledge Hub</a>: Zcash</li>
 <li><a style="text-decoration:none" href="https://blofin.com/academy/education/zcash/zcash-trusted-setup-explained" rel="noopener noreferrer nofollow">BloFin Academy</a>: The Zcash Trusted Setup Explained</li>
 <li><a style="text-decoration:none" href="https://www.coindesk.com/defending-zcash-blockchain-art-security-theater" rel="noopener noreferrer nofollow">CoinDesk</a>: Zcash and the Art of Security Theater</li>
 <li><a style="text-decoration:none" href="https://diyhpl.us/wiki/transcripts/magicalcryptoconference/2019/cryptographic-hocus-pocus" rel="noopener noreferrer nofollow">Peter Todd talk transcript</a>: Cryptographic hocus-pocus meaning nothing</li>
 <li><a style="text-decoration:none" href="https://a16zcrypto.com/on-chain-trusted-setup-ceremony/" rel="noopener noreferrer nofollow">a16z crypto</a>: On-Chain Trusted Setup Ceremony</li>
 <li><a style="text-decoration:none" href="https://pool.kryptex.com/articles/zcash-en" rel="noopener noreferrer nofollow">Kryptex</a>: Zcash (ZEC) overview</li>
 <li><a style="text-decoration:none" href="https://theblock.co/post/409934/zcash-ironwood-upgrade-launching-new-shielded-pool-after-orchard-vulnerability" rel="noopener noreferrer nofollow">The Block</a>: Zcash activates Ironwood upgrade</li>
 <li><a style="text-decoration:none" href="https://www.kucoin.com/blog/zcash-ironwood-nu6-3-shielded-pool-migration" rel="noopener noreferrer nofollow">KuCoin</a>: Zcash Ironwood NU6.3 Goes Live</li>
 <li><a style="text-decoration:none" href="https://www.chaincatcher.com/en/article/2294145" rel="noopener noreferrer nofollow">ChainCatcher</a>: Zcash activated NU7 on testnet</li>
 <li><a style="text-decoration:none" href="https://www.theblock.co/news/markets/2026-10-06-winklevoss-files-spot-zcash-etf-wink-417826" rel="noopener noreferrer nofollow">The Block</a>: Winklevoss group seeks to launch Zcash ETF</li>
 <li><a style="text-decoration:none" href="https://hipther.com/news/2026/09/29/160776/blocks-headlines-today-in-blockchain-september-29-2026-chainlink-swift-bitcoin-quantum-risk-valour-z" rel="noopener noreferrer nofollow">Hipther</a>: Blocks &amp; Headlines, September 29</li>
 <li><a style="text-decoration:none" href="https://hackernoon.com/soda-labs-raises-$3m-from-nextblock-to-let-regulated-money-move-privately-on-public-chains" rel="noopener noreferrer nofollow">HackerNoon</a>: Soda Labs report citing 21Shares data</li>
 <li><a style="text-decoration:none" href="https://en.coin-turk.com/zcash-monero-and-hyperliquid-join-top-10-crypto-list-as-cardano-and-chainlink-drop-out/" rel="noopener noreferrer nofollow">CoinTurk News</a>: Zcash, Monero and Hyperliquid join top 10</li>
 <li><a style="text-decoration:none" href="https://cryptoticker.io/en/zcash-weekly-gain-top-ten/" rel="noopener noreferrer nofollow">CryptoTicker</a>: Zcash $1,332, the only weekly gain in the top ten</li>
 <li><a style="text-decoration:none" href="https://invezz.com/news/2026/10/12/zcash-price-tops-1300-despite-124m-etf-outflows-why-is-zec-still-rallying/" rel="noopener noreferrer nofollow">Invezz</a>: Zcash price tops $1,300 despite $124M ETF outflows</li>
</ol>

The Zcash “Ceremony”: The Strange Story of How the Coin Was Born

Table of Contents

BSCN

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!