Source-linked AI summary
An Empirical Analysis of Anonymity in Zcash
George Kappos, Haaroon Yousaf, Mary Maller, Sarah Meiklejohn
TL;DR
The paper asks whether Zcash’s deployed anonymity matches the strong guarantees associated with its cryptographic design. It empirically analyzes transparent transactions and shielded-pool interactions, finding that simple heuristics based on identifiable usage patterns can considerably shrink the effective anonymity set.
Problem
The paper examines the extent to which anonymity is achieved in deployed Zcash despite its theoretical shielded-pool guarantees and support for transparent transactions.
Method
The authors conduct an in-depth empirical analysis of Zcash transactions, combining transparent-chain analysis with heuristics for attributing and linking shielded-pool interactions.
Results
69.1% of the value withdrawn from the shielded pool is linked by heuristics to deposits, including 65.6% linked to founders or miners and 3.5% captured by a general heuristic.
Takeaways & Limitations
Although Zcash can be used privately, identifiable participation patterns significantly erode the anonymity set of users engaging with the shielded pool.
Takeaways & Limitations
The authors cannot quantify the false-positive risks of some heuristic criteria and therefore do not claim those results are definitive.
Abstract
from arXiv · showhide
Among the now numerous alternative cryptocurrencies derived from Bitcoin, Zcash is often touted as the one with the strongest anonymity guarantees, due to its basis in well-regarded cryptographic research. In this paper, we examine the extent to which anonymity is achieved in the deployed version of Zcash. We investigate all facets of anonymity in Zcash's transactions, ranging from its transparent transactions to the interactions with and within its main privacy feature, a shielded pool that acts as the anonymity set for users wishing to spend coins privately. We conclude that while it is possible to use Zcash in a private way, it is also possible to shrink its anonymity set considerably by developing simple heuristics based on identifiable patterns of usage.
1 Introduction
The paper examines whether Zcash’s deployed anonymity matches its cryptographic guarantees, across transparent transactions and the shielded pool. It finds that usage patterns allow substantial reduction of the effective anonymity set.
- Zcash is backed by cryptographic research that proves security for its shielded pool, where users can spend coins without revealing which coins they spent.
- The deployed system also supports transparent transactions that reveal pseudonymous sender and recipient addresses and the amount transferred.
- The paper provides the first in-depth empirical analysis of Zcash anonymity and studies how the system evolved and who its participants are.
- The vast majority of activity occurs in Zcash’s transparent blockchain rather than engaging with the shielded pool, where exchanges typically dominate.
- 69.1% of the value withdrawn from the shielded pool can be linked to deposits using heuristics, comprising 65.6% attributed to founders or miners and an additional 3.5%.
- Within the shielded pool, relatively little information can be inferred, although certain usage patterns warrant further investigation.
2 Related work
Prior research develops anonymity-enhancing systems and de-anonymization techniques, especially clustering heuristics for Bitcoin and analyses of privacy overlays. This paper extends that tradition to Zcash with a broader ecosystem-level analysis and deeper treatment of its shielded pool.
- Research on cryptocurrency anonymity includes both stronger privacy mechanisms and studies demonstrating the limits of existing anonymity guarantees.
- Bitcoin de-anonymization commonly clusters input addresses under shared ownership and may also link output addresses receiving change.
- Prior work analyzes Bitcoin mixing services and privacy overlays, including their anonymity and participants’ need to trust one another.
- This paper applies the Bitcoin linking heuristic while adding a broader view of the Zcash ecosystem and more detailed analysis of interactions with and within its shielded pool.
3 Background
Zcash is a Bitcoin fork designed to break links between transaction senders and recipients through transparent and shielded addresses. Its ecosystem includes protocol participants such as founders and miners, services, and individual users.
- How Zcash works: Zcash aims to break the link between senders and recipients that otherwise allows funds to be tracked across successive Bitcoin-style address spends.
- How Zcash works: Shielded-pool transactions use vJoinSplits, and users can receive funds at either transparent t-addresses or shielded z-addresses.
- How Zcash works: A vJoinSplit specifies outputs through t-addresses, shielded outputs, and an encrypted memo, with an empty zOut distinguishing shielded or private transactions depending on inputs.
- How Zcash works: Inputs to a vJoinSplit include t-addresses, double-spending tokens, and a zero-knowledge proof; an empty zIn indicates either deshielding or a private transaction depending on zOut.
- Participants: Founders receive 20% of newly generated coins, while miners receive newly generated coins and transaction fees through block production.
- Participants: Services accept ZEC for trading or exchanging assets, while users hold and transact in ZEC as individuals, organizations, or groups such as the Shadow Brokers.
4 General Blockchain Statistics
The blockchain was dominated by public activity, while transactions interacting with the shielded pool remained a minority and private transactions were especially rare. The shielded pool held a growing but small share of total ZEC, alongside substantial concentration in transparent addresses.
- Blockchain coverage: 3,106,643 ZEC had been generated by January 21, 2018, including 2,485,461 ZEC for miners and 621,182 ZEC for founders.The analysis covered 258,472 mined blocks using a parsed Zcash blockchain database.
- Transactions: 14.96% of 2,242,847 transactions interacted with the shielded pool, and only a very small percentage of those were private transactions.Most transactions were public, meaning transparent or coin-generation transactions.
- Transactions: The number of coingen, shielded, and deshielded transactions grew approximately linearly, while their value became a very small percentage of block value over time.The paper attributes the transaction-count correlation largely to miner habits and the declining value share to increasing mainstream transparent usage.
- Addresses: 1,740,378 distinct t-addresses were used, including 8,727 that acted as inputs to t-to-z transactions and 330,780 that acted as outputs from z-to-t transactions.The asymmetry is associated with mining pools collecting rewards through few addresses and paying miners through many addresses.
- Addresses: 112,235 ZEC was in the shielded pool, representing 3.6% of the total monetary supply, although its value increased over time with spikes linked largely to miner and founder behavior.The richest transparent address held 118,257.75 ZEC, exceeding the entire shielded pool.
5 T-Address Clustering
The paper clusters transparent Zcash addresses with transaction-based heuristics, then tags clusters through service interactions and public founder or mining-pool addresses. These clusters reveal major exchange activity and other identifiable participants, while some heuristics are excluded because of false-positive risks.
- Clustering addresses: Zcash’s largely transparent activity can be analyzed with Bitcoin-style deanonymization techniques, because it does not use the shielded pool.
- Clustering addresses: Heuristic 1 groups t-addresses used as inputs in the same transaction, assuming they are controlled by one entity.
- Clustering addresses: 560,319 clusters were identified, including 97,539 clusters containing multiple addresses.
- Tagging addresses: The analysis used exchange deposits and withdrawals, plus public founder and mining-pool addresses, to assign names to address clusters.
- Tagging addresses: Four of the five largest clusters belonged to popular exchanges, and the five largest clusters accounted for 11.21% of all transactions.
- Tagging addresses: ShapeShift received over 1.1M ZEC and sent roughly the same amount, while mining pools often reused small sets of addresses rather than forming large clusters.
6 Interactions with the Shielded Pool
The shielded pool’s deposits and withdrawals are dominated by miners and founders, whose identifiable value and timing patterns allow heuristics to link substantial activity. These patterns substantially reduce the effective anonymity set, although some heuristic assignments remain uncertain.
- 3,901,124 ZEC entered the pool and 3,788,889 ZEC left it, with deposits and withdrawals showing near-perfect reflection.Most users withdrew the exact amount they deposited shortly afterward.
- 76.7% of deposits came from miners, while founders deposited larger amounts that produced visible step-like fluctuations.Miners must deposit newly received coins into the pool, whereas founder deposits were less frequent but larger.
- Heuristics linked 120,629 z-to-t transactions to miners and 2,103 to founders, capturing 52.1% and 13.5% of withdrawn value, respectively.
- Founder behavior exposed repeated values and timing: 74.9% of founder deposits were exactly 249.9999 ZEC, while 85% occurred within 6–10 blocks of the prior deposit.Withdrawals of 250.0001 ZEC showed a similarly concentrated 6–10-block interval.
- The authors could not directly measure false-positive risk for the founder heuristic, despite strong value and timing correlations supporting its reliability.
- A unique-value heuristic linked 12,841 transactions representing 1,094,513.23684 ZEC, or 28.5% of all coins deposited.Most linked coins had already been attributed to founders or miners by earlier heuristics.
7 Interactions within the Shielded Pool
Private z-to-z activity is a small but central part of Zcash’s anonymity core. Its transaction structure and timing suggest that a small number of users or a shared service generated many transactions, while some mining-pool activity may account for additional cases.
- Z-to-z transactions form a small percentage of overall activity but make round-trip transactions difficult to identify.
- The analysis identified 6,934 z-to-z transactions containing 8,444 vJoinSplits, using transaction timing and vJoinSplit counts to study their use.
- 93% of z-to-z transactions used one vJoinSplit, so most involved no more than two shielded inputs.This structure makes it difficult to distinguish a few prolific users from many one-time users.
- 17% of all vJoinSplits occurred in January 2017, and other concentrated periods suggest repeated activity by the same group or service.
- BitClub Pool may account for up to 1,300 z-to-z transactions through extra private transactions or change returned to the shielded pool.
8 Case Study: The Shadow Brokers
The case study used payment amounts, transaction history, funding sources, and clustering to identify possible Shadow Brokers customers. The resulting matches included likely false positives and one cluster whose deposits matched announced prices across multiple months.
- 8.1 Techniques: The researchers combined blog-announced prices with transaction timing to evaluate whether matching deposits coincided with TSB’s Zcash payment period.TSB announced Zcash acceptance in May 2017, accepted Zcash and Monero during June–August, and accepted only Zcash from September.
- 8.1 Techniques: The study flagged non-founder, non-miner t-to-z transactions depositing 100, 200, 400, or 500 ZEC ± 5 ZEC as potential TSB payments.Candidates also had to avoid pool withdrawals, remain infrequent users, and belong to clusters whose monthly deposits matched requested amounts within 1 ZEC.
- 8.2 Results: The authors could not quantify false-positive risks, so they did not treat the matching transactions as definitive identifications.They characterized the criteria as realistic for narrowing potential suspects in a law-enforcement investigation.
- 8.2 Results: Four of the 24 matching transactions were highly likely false positives because they occurred before the corresponding TSB prices were announced.These included one 100-ZEC deposit before the first blog post and three 200- or 400-ZEC deposits before the relevant July prices were announced.
- 8.2 Results: One remaining cluster deposited 100 ZEC in June, 200 ZEC in July, and 500 ZEC in August, exactly matching TSB prices.The cluster belonged to a new user, and most of its funds came directly from Bitfinex.
9 Conclusions
The paper presents an empirical exploration of Zcash anonymity using existing Bitcoin clustering methods and new heuristics tailored to the shielded pool. It concludes that identifiable usage patterns and limited shielded-pool participation can substantially shrink the effective anonymity set.
- 9 Conclusions: The study provides an in-depth empirical exploration of Zcash focused on its anonymity guarantees.It applies both established Bitcoin clustering heuristics and new attribution heuristics designed for Zcash’s shielded pool.
- 9 Conclusions: Most users do not take advantage of Zcash’s main privacy feature, while shielded-pool participants use it in identifiable ways.These findings concern both participation in the shielded pool and the patterns of users who do engage with it.
- 9 Conclusions: The initial exploration leaves further work, including classifying more z-to-z transactions through timing, miner fees, transaction size, and mining-pool interaction.These are presented as avenues for extending the study’s analysis.
- 9 Conclusions: Regular founder behavior, including repeated withdrawal amounts at repeated intervals, made founder withdrawals distinguishable from other users.The authors state that less regular founder behavior would have made their heuristics significantly less effective.
- 9 Conclusions: The authors identify requiring all transactions to use the shielded pool, or substantially expanding its use, as the way to ensure a larger anonymity set.They note that emerging cryptographic advances or broader wallet support might make this more feasible.