During a Zcash community challenge, one user, Brian Deep, was able to trace a ZEC transaction from another user, MoneyKnowledge0, back to its source in less than three days. The event revealed critical misunderstandings among users and the privacy of the network.

Challenge someone who talks down on Shielded Zcash. If people know so much about privacy with #Zcash it’s time to put money where their mouth is.

— ⚡️ᙇ (@MoneyKnowledge0) July 11, 2020

How the Transaction Was Traced

Zcash relies on two types of addresses: shielded addresses (z-addresses) and transparent addresses (t-addresses).

In this case, MoneyKnowledge0 made a donation from his shielded address to a recipient’s shielded address. From there, Brian Deep was able to determine which transparent address MoneyKnowledge0 used to fund his original shielded address.

The transaction was easy to trace because MoneyKnowledge0 made each transaction over a very short period. Deep reportedly told MoneyKnowledge0 to “divide funds and make longer breaks between transactions” for better privacy.

As such, the traceability of MoneyKnowledge0’s transaction is arguably user fault, not a problem of Zcash itself.

Though MoneyKnowledge0 called Deep’s success a “lucky guess,” he awarded $100 worth of ZEC to the friendly attacker for his work.

Zcash CEO Weighs In

Zooko Wilcox, CEO of Zcash, commented on the matter by noting that “pass through” privacy methods do not work, and that shielded fund storage is what provides privacy.

Until users make that mental leap that privacy doesn't come from something you move your money through, it comes from *where you store your money at rest*, they'll keep making this mistake.

— zooko (@zooko) July 19, 2020

According to Wilcox, longer gaps between transactions provide little benefit. Instead, users who want privacy should store their funds in Zcash’s shielded pool.

If MoneyKnowledge0 had used the shielded pool for storage, the transaction “[wouldn’t] be linkable going solely from information in the blockchain,” Wilcox says.

ZEC’s Privacy Issues

This is not the first time that Zcash’s privacy has been questioned.

In May, Carnegie Mellon University suggested that more than 99% of users fail to use ZEC’s privacy and shielding features. Chainalysis, a data analytics firm, also suggested that it was able to trace most Zcash and Dash transactions in June.

As of July 2020, just over 11% of ZEC transactions are shielded, according to Zchain’s Zcash block explorer.

Zcash could encourage users to use shielded addresses through “on-by-default” or mandatory privacy, as seen in other privacy coins like Monero. Although Zcash developers have considered on-by-default privacy since 2018, the feature has not yet been put in place.