Zcash users bought anonymous-forever and got anonymous-until-someone-builds-a-big-enough-quantum-computer. Halo 2 proofs over Pallas and Vesta are discrete-log, which means every shielded transaction back to 2016 genesis is a retroactive de-anonymization target. The ECC dev team resigning in January 2026 is the second problem.
Summary
Zcash faces the most severe retroactive de-anonymization risk in the evaluated set. Halo 2 shielded proofs are discrete-log-based (Pallas/Vesta) — fully Shor-breakable. A quantum adversary in 2040+ could retroactively de-anonymize every shielded transaction back to 2016 genesis, linking notes and reconstructing transaction graphs. Privacy commitments that users made assuming 'anonymous forever' have a crypto expiration date. Compounding: ECC dev team resigned Jan 2026, eroding the coordination capacity that would execute a PQ shielded-proof migration. A lattice-based or STARK-based shielded proof would need to be designed, audited, deployed, and migrated to — a multi-year project with uncertain leadership.
What the gates say
- Hybrid: FAIL. No hybrid plan on file.
- Evidence: PASS. Sources reconstructable by third party.
- Primitive naming: PASS. Named primitives at every scored sub-level.
Burn-vs-rescue policy on file
none-ratified; shielded de-anon cannot be prevented retroactively — only forward-looking pools can gain PQ privacy
Seven dimensions
Each dimension scores 0-100 internally; the weighted roll-up produces the QRI on the left. Open a row to read the sub-score detail.
1 Cryptographic Exposure 38 / 100
Shielded pools use Pallas/Vesta via Halo 2 (no trusted setup); transparent addresses use ECDSA.
ECDSA secp256k1 (transparent addresses) · JubJub (Sapling shielded addrs) · Pallas/Vesta (Orchard shielded, Halo 2) · Halo 2 (recursion-friendly PLONK) · Pedersen hashing (shielded commitment) · SHA-256 (transparent)Multiple EC families but all classical.
2 HNDL Exposure 18 / 100
Shielded users rely on privacy guarantee; pubkeys not necessarily exposed for shielded-only users.
~9 years mainnet; shielded + transparent pools both long-lived.
Transparent ECDSA sigs historically forgeable post-Shor.
Standard TLS + in-viewing-key encryption; no PQ KEM.
3 Metadata & Privacy Exposure 25 / 100
Shielded pool hides tx graph today BUT only because proofs are unbreakable under classical assumptions.
zcashd + zebrad node operators; Electric Coin Company (ECC) and ZF as primary.
Shielded pool isolates from bridge correlation; shielded-to-transparent hops leak metadata.
CRITICAL: Halo 2 (Pallas/Vesta) is discrete-log-based and Shor-breakable. A capable quantum adversary in the future could RETROACTIVELY DE-ANONYMIZE every shielded Zcash transaction back to genesis by reconstructing proofs and linking notes. This is the strongest retroactive-deanon risk in the evaluated privacy-L2 category because the privacy guarantee itself is crypto-conditional. This is the single most significant structural finding in the LayerQu batch.
4 Migration Architecture 35 / 100
Multi-pool architecture (Sprout-Sapling-Orchard) demonstrates historical cryptosystem migration capacity. New pool addition is the migration primitive.
Viewing keys + spending keys architecture; shielded key rotation possible via new pool.
NU1-NU5 network upgrades executed (Sprout, Sapling, Blossom, Heartwood, Canopy, NU5). ECC-led coordination.
No PQ shielded-proof roadmap ratified. Research (lattice-based SNARKs, STARK-over-Pallas variants) referenced but not shipped. **ECC dev team resigned Jan 2026** — significant coordination disruption.
5 Deployment Execution 5 / 100
Zero PQC on mainnet. Halo 2 is classical zk-SNARK.
No PQ code in zcashd/zebrad mainnet branches; research discussions only.
Zero PQ miners (PoW).
Milestone: forum discussion of post-quantum Zcash (2024-2025); no deliverable.
Low: honest silence, some research talk.
6 Supply Chain Vendor Readiness 10 / 100
7 Governance & Coordination 35 / 100
PoW mining; F2Pool, Binance Pool dominate.
Network upgrade cadence historically smooth; next NU uncertain post-ECC resignation.
Named: Zooko Wilcox (former ECC), ECC (depleted), Zcash Foundation, ZCG. Lead team resigned Jan 2026 = coordination capacity compromised.
Dev fund governance disputes; ECC dev team resignation Jan 2026 = adversarial internal precedent.
The X + Y vs Z inequality
X (data shelf life): FOREVER (retroactive shielded de-anon — privacy commitments must hold indefinitely)
Y (migration time): 5-10 (ECC team disruption adds 2-3y)
Z10 (10% CRQC year): 2036 · Z50 (50%): 2041
Verdict: X+Y > Z (danger).
Four-scenario grid
| Scenario | Value preserved | Privacy preserved |
|---|---|---|
| quantum never | 100% | 100% |
| arrives suddenly pre migration | 15% | 0% |
| arrives slowly post migration | 55% | 10% |
| arrives slowly mid migration | 30% | 5% |
Peers in the privacy-L2 profile
Order-book view of the 5 chains closest to Zcash by QRI.
Public artifacts used for this scorecard
Each entry below is a sub-score citation. Clicking the link takes you to the public source. A third party should be able to reconstruct every number on this page from these URLs in 48 hours.
Shielded pools use Pallas/Vesta via Halo 2 (no trusted setup); transparent addresses use ECDSA.
Supply chain snapshot
A chain's supply chain cannot migrate faster than its slowest dependency. Zero PQC roadmaps in any of the four categories is a structural blocker, not a lagging indicator.
Analyst notes on the scoring
Stage 1. Single most important PQ finding in LayerQu batch: privacy-coin users face FUTURE privacy loss today from quantum adversaries that do not yet exist. X horizon = forever (not merely shelf-life of sigs). Preskill cap applied for leadership disruption. Privacy-L2 scorecard weights elevate metadata/privacy dim (0.25) vs L1 (0.13), appropriately surfacing this risk.
Scorecard metadata
- Profile: privacy-L2
- Scored: 2026-04-17 by
layerqu-v2-scoring-agent-5 - v1 reference:
chainscreen-v1-archive - QRI raw: 18 · after caps: 14
- Confidence interval: ±6
- PQC washing ratio: 0.5x
- Burn-vs-rescue: none-ratified; shielded de-anon cannot be prevented retroactively — only forward-looking pools can gain PQ privacy
Caps triggered
- mosca_cap_60 (5a=0)
- sutor_cap_50
- preskill_cap_40 (ECC dev team resignation disrupts coordination)