Chain profile
Privacy is not quantum safety: Zcash spends are authorised by elliptic-curve signatures, though ZIP 2005 adds a quantum recovery path for shielded notes ahead of a full transition.
No, and the distinction matters more here than almost anywhere else in this index. Zcash is a privacy chain, and privacy is routinely confused with quantum safety. They are different properties. Zcash spends are authorised by RedDSA and RedPallas signatures, which are elliptic-curve schemes, and the Halo 2 proof system they underpin rests on the same mathematics. A large fault-tolerant quantum computer running Shor's algorithm is expected to break them. What Zcash does have is an unusually thoughtful sequencing of the problem. ZIP 2005 introduces Orchard quantum recoverability, an emergency path that changes how recoverable Orchard notes are constructed so that if a quantum adversary forced the network to disable the vulnerable shielded protocols, holders could still recover funds into a future post-quantum protocol. Full post-quantum migration is targeted on a twelve to eighteen month horizon from mid-2026.
Where we are making a judgement call Zcash is the clearest case in the index of two different security properties being conflated. Zero-knowledge privacy hides who paid whom. Quantum safety concerns whether the signature authorising a payment can be forged. Zcash currently has the first and not the second, and a reader who takes shielded transactions as evidence of quantum resistance has drawn the wrong conclusion.
RedDSA and RedPallas elliptic-curve signatures, with Halo 2 proofs
Not yet selected. ZIP 2005 adds Orchard quantum recoverability ahead of a full transition.
None confirmed for the full migration at the time of writing
Tier 3: Committed. A funded roadmap with public dates and active research exists, but no post-quantum signature is live on mainnet.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 5 | 25% | 12.5 |
| 3 | NIST alignment | 5 | 15% | 7.5 |
| 4 | Migration path | 8 | 15% | 12.0 |
| 5 | Exposure | 5 | 10% | 5.0 |
| 6 | Verification | 8 | 5% | 4.0 |
| Hardy Score | 41.0 | |||
Zcash spend authorisation uses RedDSA and RedPallas, both elliptic-curve signature schemes, and the Halo 2 proving system rests on the same curve mathematics. Nothing post-quantum authorises spends on mainnet today. source
Tier 3: Committed. A named ZIP is deploying a quantum recovery path and a full post-quantum transition is on a published horizon, but no post-quantum signature authorises spends on mainnet. source
Zcash has committed to a direction and to a recovery mechanism, but we could not confirm a specific NIST-standardised signature scheme selected for the full transition. The recoverability work in ZIP 2005 is a bespoke construction rather than an adoption of FIPS 204 or FIPS 205. source
The strongest sequencing logic in the committed group. Rather than waiting for a full migration, Zcash is shipping a recovery path first, so that funds remain recoverable into a future post-quantum protocol even if the shielded protocols had to be disabled in an emergency. Solving the rescue case before the upgrade case is the right order. source
Shielded Zcash is a genuine exception in this index. Funds held in shielded pools do not publish a spending public key on-chain in the way a transparent account does, which materially limits what an attacker can harvest today. Transparent addresses behave like Bitcoin's and are exposed on spend. source
Zcash's protocol is specified in a public document, changes go through numbered public ZIPs, the cryptography is peer-reviewed and the implementation is open source. The quantum recoverability work is identified by a specific ZIP number rather than described in a blog post. source
The deployment dimension is not a separate judgement. It is Tier 3 expressed as a number. See the tier mapping.
Zcash sets out a plan for quantum-recoverable wallets within a month and full post-quantum protection on a twelve to eighteen month horizon. source
ZIP 2005 deploys Orchard quantum recoverability, changing how recoverable notes are constructed so funds can later be moved into a post-quantum recovery protocol. source
Full post-quantum protocol migration. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Zcash is the one chain in this index where the privacy design genuinely reduces quantum exposure, though not for the reason people usually assume. Funds held in shielded pools do not publish a spending public key on-chain the way a transparent account does, so there is materially less for an attacker to harvest today. That is a real advantage and it is why Zcash scores at the midpoint rather than near the bottom. It is not the same as quantum safety: the signatures authorising shielded spends are still elliptic-curve, so a quantum adversary that could break them could still forge spends. Transparent Zcash addresses behave like Bitcoin's and reveal their key on spend.
What this rating means for you
Zcash has a funded roadmap but no post-quantum signature protecting funds on mainnet yet. Until it ships, your exposure is the ordinary one, and the steps that reduce it cost nothing.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No. Zcash spends are authorised by RedDSA and RedPallas, elliptic-curve signature schemes that a sufficiently large quantum computer would break, and the Halo 2 proof system rests on the same mathematics. Zcash is shipping a quantum recovery path and targeting a full post-quantum migration, but neither is complete.
No, and this is the most common misunderstanding about Zcash. Privacy hides the parties and amounts in a transaction. Quantum safety is about whether the signature authorising that transaction can be forged by an attacker with a quantum computer. Zcash's shielded pools deliver the first property. They do not deliver the second.
ZIP 2005 introduces Orchard quantum recoverability. It changes how recoverable Orchard notes are constructed so that if a future quantum adversary forced the network to disable the vulnerable shielded protocols, holders could still recover their funds into a future post-quantum recovery protocol. It is an escape hatch, not a post-quantum signature scheme.
Because shielded funds do not publish a spending public key on-chain in the way a transparent account does, so there is less material for an attacker to collect today against a future quantum computer. That is a genuine structural advantage of the shielded design, and it is separate from whether the underlying signatures are quantum-safe, which they are not.
This is a security-readiness assessment, not investment advice.