Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Scaling a transparent blockchain is an engineering problem. Scaling an encrypted one is a different kind of problem, and understanding the difference is the key to everything in this report.

On a transparent chain, a wallet can ask any server a simple question: what belongs to this address? Addresses and balances are public, so the entire industry of RPC providers, indexers and block explorers exists to answer that question cheaply, instantly and for anyone. The wallet outsources the work of finding its own money.

A shielded wallet cannot ask that question without destroying the thing it exists to protect. If a server can answer “what belongs to this user,” the server knows what belongs to this user. So Zcash wallets have historically done the work themselves - by downloading the chain's encrypted outputs and trial-decrypting each one to discover which notes are theirs. The cost of that scan grows linearly with network activity and every new user makes sync slower for every existing user.

On transparent chains, adoption makes infrastructure better. On shielded chains, under the legacy model, adoption makes the user experience worse. Privacy that degrades with popularity cannot reach planetary scale, no matter how strong the cryptography is.

Throughput is the visible symptom, and Zcash's roughly 20 transactions per second is the number usually quoted. But raising the block size under the legacy model would simply accelerate the sync problem, handing wallets more encrypted data to scan.

That is the problem Project Tachyon was designed to attack, and it is why we describe Tachyon as a privacy-preserving state architecture rather than a throughput upgrade. The throughput follows from fixing the state model, not the other way around.

Project Tachyon: The technical architecture of private scale

Tachyon's design, led by cryptographer Sean Bowe, is best understood as three linked changes of how shielded Zcash works today.

Change one: the wallet carries its own proof

Today, a wallet tracks its notes locally and constructs a zero-knowledge proof at spend time. Under Tachyon, the wallet's state itself carries proof. Each wallet maintains what cryptographers call proof-carrying data, or PCD, a recursive proof that the wallet's view of its own balance is correct up to a recent point in chain history, updated incrementally as new blocks arrive.

A recursive proof is one that can verify other proofs inside itself, so a single compact object can attest to an arbitrarily long history of correct updates.

The practical consequence is when a Tachyon wallet transacts, it attaches evidence of its own solvency rather than asking the network to re-derive that solvency from chain history. Verification stops depending on the past.

Change two: the network forgets

Because wallets prove their own state, full nodes no longer need to keep the full record. Under Tachyon, nodes retain nullifiers - the cryptographic tags that prevent a shielded note from being spent twice - only for a recent window of blocks, then prune them. Historical blockchain state becomes discardable. Node storage stops growing without bound, and the hardware bar for running Zcash infrastructure falls instead of rising.

Bowe pairs this directly with the scaling payoff - once wallet sync and node state are decoupled from history, block sizes and block frequency can increase without dragging every wallet and node along. The path toward thousands of shielded transactions per second runs through forgetting, not through bigger machines.

Change three: secrets leave the chain

Today, a shielded payment embeds an encrypted package on-chain - the note's value, memo and recipient data, locked to the recipient's key. This is called in-band secret distribution, and it is the reason wallets must trial-decrypt the whole chain to find their money.

Tachyon removes it. Payment secrets move out of band, and wallets discover what belongs to them through a mechanism called Oblivious Synchronization - where the wallet queries untrusted servers for the proofs relevant to its state, in a way that prevents the server from learning what the wallet is looking for. The chain itself keeps only commitments and proofs. Nothing readable, and critically, nothing decryptable later.

We can have the best of both worlds - a private digital payment network that scales to billions of users - by fully leveraging both zero-knowledge and verifiable computation. - Sean Bowe, Project Tachyon lead

Ragu: the proving layer underneath

The recursive proofs that make all of this possible need a software engine. That engine is Ragu, a Rust-language proof-carrying data framework built by the Tachyon team.

Ragu follows the original Halo recursive proof construction, requires no trusted setup, and is designed for the same Pasta curves Zcash already uses, which keeps it compatible with the protocol's existing cryptographic foundations.

Ragu is also, by its developers' own labeling, under heavy development and not yet audited. The team has said it will undergo several rounds of optimization and auditing before it satisfies the performance and safety requirements for deployment. (We flag this plainly because the gap between a working testnet and audited production cryptography is where ambitious protocols historically slip).

The NU7 testnet activated on May 22, 2026, preparing the ground for Tachyon components alongside Orchard quantum recoverability, with shielded transactions reportedly several times faster and block times reduced. Mainnet activation is expected roughly six weeks from the early-June joint statement on Ironwood, sequenced after the scheduled end-of-support halt of the legacy zcashd node.

Community mandate is not in question. In the February 2026 NU7 sentiment poll, Tachyon drew universal or near-universal support across every constituency - the advisory panel, coinholders voting with shielded ZEC, the engineering caucus and regional groups. The Zcash Foundation called it the most unambiguous signal of the entire poll, with no other proposed feature coming close.

Tachyon is more architecturally ambitious than the Sprout-to-Sapling migration and more fundamental than Halo 2. Recursive proof infrastructure, oblivious query protocols and pruning logic are individually novel; shipping them together in production, on a network securing real value, has no direct precedent. The testnet is evidence of progress, not proof of arrival.

Zcash is not quantum-safe, and its own engineers are the first to say so. What Zcash has built instead is more interesting and more credible - a layered plan that protects what must be protected first, on a timeline that does not depend on predicting when quantum computers arrive.

Zooko Wilcox, Zcash's founder, frames the priority with a distinction worth keeping: integrity versus confidentiality. An integrity break - an attacker forging or counterfeiting coins - only hurts going forward, and the network can respond when it happens.

A confidentiality break reaches backward, which is a future adversary who decrypts historical data and exposes what users did years ago, and no patch can undo it. That asymmetry sets the order of operations: quantum privacy is urgent in a way quantum soundness is not, because the privacy attack is already underway.

Quantum computers do not break everything at once. Zcash's symmetric cryptography - the hash functions behind note commitments, the keyed functions behind nullifiers, the encryption of memos - holds up well, because the relevant quantum algorithm (Grover's) only halves effective security, a margin these primitives can absorb. There is a structural bonus here against Monero, as Zcash nullifiers are derived from keyed functions rather than elliptic-curve operations, so a quantum adversary cannot reconstruct Zcash's transaction graph the way it could unravel ring signatures.

What falls is the public-key layer: the RedDSA and RedPallas signature schemes that authorize spends, and the elliptic-curve assumptions underneath Halo 2's proofs.

These are the mathematical tools that let users prove they own funds and authorize transactions without revealing private keys. They are secure against today's computers, but large fault-tolerant quantum computers running Shor's algorithm are expected to break the elliptic-curve cryptography they rely on.

Stage one, deploying now: recoverability (ZIP 2005)

Orchard quantum recoverability, specified in ZIP 2005, is best understood as an emergency recovery path rather than a claim that Zcash is already post-quantum secure. The proposal changes how recoverable Orchard notes are constructed so that, if a future quantum or discrete-log-breaking adversary forced the network to disable vulnerable shielded protocols, users could later recover funds into a future post-quantum recovery protocol.

Under the new v6 transaction format, the randomness inside each note commitment is no longer drawn independently; it is derived from a BLAKE2b, the hash function used throughout Zcash, of all the note's fields.

(A hash function is a cryptographic fingerprint generator. Users can feed in data of any size and it produces a fixed-length output that uniquely represents that data.)

The effect is to make commitments quantum-binding. Even an adversary who breaks the elliptic curve cannot forge a note without the hash preimage, and hash functions are not what quantum computers break.

The plan is explicit should a credible quantum threat ever materialize. The vulnerable pools are disabled, freezing funds where no adversary can spend them. A recovery protocol built on post-quantum proofs is deployed.

Users prove ownership of their frozen notes and migrate. As such, the ZIP does not make Zcash quantum-secure today and carries a practical implication - if Orchard were ever disabled this way, Sapling would be disabled too, so funds still sitting in the older Sapling pool should migrate to Orchard to gain recoverability at all. Wallet defaults are already nudging in that direction.

In February’s NU7 sentiment process, Orchard Quantum Recoverability drew 90.5% support from ZCAP and 94.6% support from coinholders, with no meaningful opposition reported by the Zcash Foundation. That makes recoverability one of the most-favored roadmap mandates alongside Tachyon.

Stage two, arriving with Tachyon and closing the harvest window

The most realistic quantum attack on privacy requires no quantum computer today. An adversary records encrypted blockchain data now, stores it cheaply, and decrypts it whenever the hardware arrives. For a permanent public ledger, every encrypted note ever posted is in scope, which means the attack against today's transactions has, in a meaningful sense, already begun.

Tachyon ends it structurally. By removing in-band secret distribution, Tachyon leaves no ciphertext on-chain to harvest. The ledger holds commitments and proofs; the secrets travel through channels that leave no permanent decryptable record. Bowe has tied this directly to the quantum roadmap, where full defense against quantum attacks on the privacy of on-chain transactions is a stated design goal of the Tachyon transition, not a side effect.

Stage three, the full migration

The Tachyon roadmap also describes work on private information retrieval combined with post-quantum key exchange, a path to scalable post-quantum payment delivery with minimal change to the user experience. We present these as the standards context the teams are working within rather than confirmed implementation choices, because the choices are not final.

The published migration sequence is hybrid signatures combining classical and post-quantum keys for a gradual transition; Unified Addresses extended with post-quantum spend and viewing keys, so users keep one address while wallets negotiate security underneath; proof hardening through hash-based or STARK-style systems, or post-quantum wrappers around Halo 2; and one-way, unlinkable migrations from legacy keys to post-quantum keys.

The deliberateness is the point, and Bowe has defended it on opportunity-cost grounds.

Migrating prematurely means larger transactions, broken hardware-wallet integrations and the risk of locking the protocol into immature standards. Zcash's design philosophy since inception has been to isolate its dependence on pre-quantum cryptography into components that can be swapped.

The sequence - protect funds now, close the privacy window with Tachyon, replace the public-key rails when standards stabilize - spends engineering effort in the order the threats actually bind.

Cryptography decides whether encrypted money is possible, but economics decides whether it persists. This section follows the money: who pays for Zcash's security and development now that the era of guaranteed funding has ended, and how Tachyon redraws the network's cost map.

Zcash development was funded by protocol mandate for most of its life, with a fixed slice of every block reward flowed to the founding organizations and later to a community-directed fund.

That mandate expired in November 2025, and what replaced it, activated in NU6.1, is an experiment with little precedent in crypto: 12% of block rewards accrue to an in-protocol lockbox that only coinholder votes can unlock, alongside 8% that continues to the independent grants program.

Disbursement requires a quorum of 420,000 ZEC and a simple majority, cast as shielded votes.

The mandate behind the model was unambiguous. In the May 2025 poll that chose it, roughly 802,000 ZEC - about 87% of participating coins - backed the coinholder-controlled design over returning the funds to miners. The model is now operational: the first retroactive grants round cleared coinholder votes in late 2025, and more than a million shielded ZEC participated in the February governance round.

The monetary split the community refused to paper over

Deeper monetary redesign is genuinely contested, and the February NU7 poll measured the fault line precisely. The Network Sustainability Mechanism, as proposed, has two halves: burning a portion of transaction fees, and smoothing the issuance curve to spread remaining block rewards over a longer horizon. Coinholders backed the burn with roughly 80% support and rejected the smoothing with roughly 83% opposition, while the advisory panel supported both.

That is because coinholders want monetary tightening and do not want the supply curve redesigned. The position is coherent even if it frustrates the engineers who built the mechanism as one piece.

The Foundation's response was the right one for a protocol whose legitimacy rests on consent: the burn advances with NU7's consensus core, the smoothing returns to deliberation. A narrower upgrade with a real mandate beat a wider one built over an unresolved split.

Zcash's halving cadence runs faster than Bitcoin's narrative suggests: the November 2024 halving cut block rewards to 1.5625 ZEC and annual inflation to roughly 4%, with the next halving due in 2028 and issuance approaching zero by the mid-2030s as supply nears the 21 million cap. Every proof-of-work network faces the same arithmetic: as subsidy fades, fees must fund security, or security declines.

Zcash's specific version of the question is whether shielded usage generates the fee demand.

The trend is the right direction - shielded transactions reached an all-time high of 59.3% of activity in February 2026, and Tachyon raises the ceiling on how much fee-paying activity the network can host.

The fee burn, once live, ties usage to scarcity. None of that yet adds up to a demonstrated fee market that can replace subsidy. We flag it as the question that outlasts every upgrade in this report, because it is the one no network upgrade can answer by itself.

Today the costs of private state sit with users and node operators: wallets burn compute scanning the chain, nodes store an ever-growing history. Tachyon redistributes both. Wallets carry proofs instead of scans. Nodes prune instead of accumulate. The hardware bar for running Zcash infrastructure falls, which is the rare scaling change that improves decentralization rather than taxing it.

One genuinely new market appears in the middle, however: oblivious sync services, or the untrusted servers that help wallets find their proofs while learning nothing.

Someone must run them, and the protocol does not pay them. Whether they emerge as a competitive service layer, a public good funded through the lockbox, or a concentrated dependency on a few providers is perhaps the most underexamined economic question in the Tachyon transition.

Cypherpunk Technologies, the Nasdaq-listed vehicle backed by Winklevoss Capital, has acquired more than $90 million in ZEC and helped lead the seed round for ZODL, the for-profit lab formed by the former Electric Coin Company team. Grayscale has filed to convert its Zcash trust into a spot ETF. Both Zooko Wilcox and ZODL chief executive Josh Swihart advise Cypherpunk.

The bridge is real and it is also a dependency. A development ecosystem partly funded by a listed treasury vehicle and a pending ETF inherits some exposure to equity markets and regulatory timelines. We note it without alarm: the same was said of every Bitcoin treasury company, and the diversification across six organizations and a coinholder lockbox is precisely the hedge.

Meanwhile, the institutional base is also widening beyond holders. Digital Currency Group's mining subsidiary, Fortitude Mining, announced a business combination on June 24 with HeartSciences (Nasdaq: HSCS) that is expected to take it public under the ticker TUDE.

Fortitude, a Zcash mining platform, is the first publicly traded venture mining vehicle built around early-stage proof-of-work bets.

Security, decentralization and execution: the real test

Every prior section describes machinery being built. This one asks what could break it, and it opens with the part of the story nobody planned - the machinery was tested live, weeks before the publication of this report.

The Bug, the Model and the Pool that Audits itself

In early June 2026, ZODL disclosed that it had remediated a soundness flaw in the zk-SNARK circuit validating Orchard shielded transactions, discovered days earlier by researcher Taylor Hornby during persistent security analysis funded by Shielded Labs. A soundness bug is the worst category of flaw a shielded protocol can have. It leaks nobody's data, but instead allows an attacker to construct a transaction the network accepts as valid even though it creates money that should not exist: counterfeit notes, minted invisibly inside the encrypted pool.

The flaw had survived years of professional audits and was exploitable that entire time. Hornby noticed it one day after a frontier AI model was made available to him for permitted security research, applied on top of years of targeted scrutiny of Zcash's protocol.

The lesson is that AI is now in the toolkit of attackers and defenders alike, and the defenders got there first because a funded human expert was already looking. To be clear - the tooling found nothing on its own, but expertise knew where to point it.

Why exploitation appears unlikely, but cannot be ruled out

A rational counterfeiter, never knowing when the bug might be found or how many other counterfeiters existed, has one sensible strategy: drain and sell continuously. The Orchard pool did the opposite, growing throughout the exploitable period and declining only modestly after disclosure.

Zcash has run this experiment before. When a counterfeiting flaw was found in the original Sprout pool, the pool was patched and deprecated, and roughly 25,000 ZEC still sit inside it nearly eight years later, value any counterfeiter would have had to inexplicably abandon. The turnstile was never violated. The same accounting now constrains Orchard.

NU7 will introduce a new shielded pool named Ironwood. It runs the identical, patched Orchard protocol but starts empty. From activation, wallets route all Orchard payments to Ironwood automatically, the user never needing to know the difference, while the old pool is barred from receiving funds. Migrating is one tap, the same gesture wallets already use for shielding.

The auditing is done by the turnstile, Zcash's accounting rule that no pool may ever pay out more than publicly entered it. Any hypothetical counterfeit coins remaining in old Orchard must cross the turnstile to be spent, and the turnstile will refuse anything beyond recorded inflows.

Counterfeits, if they exist, are quarantined into worthlessness, and every coin that does cross is, by construction, “clean.”

The turnstile - earlier considered a wall that compartmentalizes damage to a single pool - may be used as an active indicator of circulating supply, converting a hypothetical-counterfeit problem into a measurable one. However, a smaller exploiter could have exited below gross inflows, and a patient exploiter could wait for a migration period when outflows are expected.

Two properties set Ironwood apart from a simple redeployment: its circuit is being hardened with formal verification to prove the absence of soundness bugs, and the pool is quantum recoverable by design under ZIP 2005.

The Orchard incident is the argument for taking the rest of this section seriously. The bug that mattered was not on anyone's risk register.

Tachyon stacks novel components: recursive proofs via Ragu, proof-carrying wallet state, oblivious query protocols, pruning logic. Ragu is explicitly pre-audit. The Orchard bug demonstrated that even mature, heavily audited circuits hide soundness flaws for years. The mitigations are the right ones - Tachyon and Valar Group are extending formal verification across both the patched Orchard circuit and the new stack - but formal methods budgets and audit timelines are now on the critical path to mainnet, and we will treat any compression of them as a red flag, not a sign of confidence.

Oblivious Synchronization is designed so servers learn nothing, and that guarantee covers privacy only. Availability and censorship sit outside it. If two or three providers end up serving most wallets, shielded Zcash acquires an operational chokepoint it has never had: entities that cannot read anyone's transactions but could degrade everyone's access. The open economic design question from Section 4 is also the open decentralization question; how these services are funded will determine how many of them exist.

NU7's activation is sequenced after the scheduled end-of-support halt of zcashd, the original node software, finalizing a migration to the Foundation's Zebra implementation that has been underway since 2023. Retiring legacy software is healthy. It also concentrates consensus in a single client for a period, making Zebra's quality and the breadth of its operator adoption central to network resilience precisely when the protocol is absorbing its largest-ever upgrade.

NU7 began as a broad wishlist and narrowed to its consensus core: Tachyon, quantum recoverability, explicit fees, the fee burn, and now Ironwood. Shielded Assets and issuance smoothing went back to deliberation after coinholders rejected them. We read the narrowing as strength, with one caveat worth stating: Ironwood entered NU7's scope by necessity on a six-week timeline, with community approval still required. Emergency scope additions are sometimes unavoidable. They should not become a habit, and the distinction between this one and habit is the vote.

Against those risks, two structural improvements. Pruning lowers the hardware bar for running a node, widening rather than narrowing the operator base over time. And development is now spread across five independently funded organizations - ZODL, Project Tachyon, Valar Group, the Zcash Foundation and Shielded Labs - a fragmentation that looked like chaos when the Electric Coin Company team resigned in January following a difference in future strategy (this team then formed ZODL) and looked like resilience in June, when no single point of failure existed for a security incident to find.

Zcash's first decade proved encrypted money can exist. The thesis of this series is that the second must prove it can scale, survive quantum uncertainty and stay decentralized under real-world pressure. When we scoped this report, there were three forward-looking tests. By publication, each had produced evidence.

On scale, Tachyon is on a public testnet, with a community mandate no other feature in Zcash's history has matched and a mainnet date weeks away. On quantum, the recoverability layer is built and the harvest window closes with the same upgrade, a sequencing that protects the irreversible risk first. On decentralization, a worst-category security bug met a six-organization response that found it, patched it, planned around it and submitted the plan to a vote inside a week.

What remains genuinely unresolved is economics. A coinholder lockbox younger than this report series, a fee market that does not yet replace subsidy, a new class of sync infrastructure nobody has priced, and an institutional bridge that helps and obligates in equal measure. The cryptography in this report is further along than the political economy underneath it.

We said in Report #1 that Zcash is one of the most consequential experiments in crypto. We hold that view with more evidence and fewer caveats than when we started. The machine is not finished. It is, for the first time, visibly being assembled in public, on a schedule, under audit, with its failure conditions stated in advance. That is what credible engineering looks like, and it is rarer in this industry than cryptography is.

A research series should say in advance what would prove it right or wrong. These are the markers we will be tracking, all from public data, with the readings we would draw.