The Complete Zcash Roadmap | Sean Bowe and Dev Ojha

Zcash’s central objective is to make shielded activity indistinguishable from random data on the ledger, so an observer cannot reliably connect transactions to a person. Sean Bowe warned that analytics, exchange records, leaks, and increasingly accessible AI tools are making surveillance of public blockchains easier. Small information leaks can compound, so he argued privacy cannot be treated as “99.9%” effective. The team says it understands most, but not all, possible privacy attacks. The speakers ruled out backdoors or regulator viewing access, saying that weakening privacy would compromise Zcash’s values.

The roadmap prioritizes scaling, hardening, and economic sustainability across cryptography, consensus and networking, and wallets. Scaling privacy-preserving wallets may be harder than scaling the chain: wallets must locate payments without downloading and scanning the entire blockchain. Zcash has deployed private information retrieval, or PIR, which lets a wallet query a server without revealing which data it wants; it was also used in a coinholder vote. Users could choose permissionless providers or run their own nodes, but private RPC subscriptions, anonymous payments for those services, and wallet integration still need engineering.

Tachyon is intended to address the cryptographic cost of shielded transactions and the growing nullifier set, not directly increase block size or block speed. Its recursive proofs could let a full node verify one proof for a block containing a million transactions instead of checking a million proofs, while supporting trustless queries of historical state. A speaker described a 5x-plus scaling improvement on day one and said storage could fall from petabyte scale to a few hundred gigabytes; bandwidth and processing would still constrain throughput. The chain handles about 60 KB per second today, with a planned block-time change expected to raise that to 180 KB per second. At 2 KB per transaction, 50,000 transactions per second would require 100 MB per second. The speakers said 1–10 MB per second looks achievable through a relatively straightforward path, while 10–100 MB per second would require novel approaches and trade-offs. They cited current capacity of about 2.9 transactions per second and 6.5 after the next upgrade.

The post-quantum plan has three pillars: quantum recoverability, post-quantum privacy, and post-quantum soundness. Quantum recoverability is live in the new shielded pool, allowing users to retain access to funds if quantum advances threaten existing cryptography. Tachyon’s privacy work is intended to replace scanning based on pre-quantum cryptography with post-quantum key exchange, including ML-KEM; the speakers projected that work would be fully live next January. Post-quantum soundness would prevent quantum computers from counterfeiting Zcash by replacing elliptic-curve proofs with post-quantum recursive STARKs. They projected fully post-quantum transparent transactions early next year, a possible shielded-pool migration demonstration around mid-next year, and an eventual fully post-quantum shielded pool. The speakers described the transition as incremental, and said a credible quantum threat could prompt the community to freeze elliptic-curve use.

Zcash has also invested in formal verification and adversarial testing. Bowe said specialist contractors spent about a year verifying Tachyon’s more esoteric cryptography; after an Orchard counterfeiting bug was found, a roughly month-and-a-half-to-two-month effort verified that the shielded pool had no remaining undetectable counterfeiting bugs before the upgrade shipped. The team injected flaws drawn from roughly 1,000 historical zero-knowledge bugs and said none escaped the verification layer. Bowe cautioned that verification only establishes a specified property: the specification may be wrong or fail to match the shipped system, so auditors still need to assess it. Frontier AI models also found a subtle bug that had eluded auditors and cryptographers for years. Multi-assumption security, which could require an attacker to break two assumptions, remains an unapproved design idea with trade-offs for proof size and scaling.

Bowe argued that Zcash should scale payments before adding features such as private programmability, shielded assets, new custody options, or trustless client bridges, because added functionality expands the attack surface and can complicate upgrades. Proof of work remains the plan, and the 21 million supply cap is a stated principle; changing proof of work would require support from miners and coinholders. Beginning November 5, the merged network sustainability module is to hold 60% of transaction fees at the protocol level rather than pay them to miners, with redistribution to miners intended to begin about four years later on a similar halving schedule. Whether fees, usage, and scaling can support long-term security remains unresolved.

Governance relies mainly on informal consensus among established project participants; ZIPs document proposed changes but do not constitute governance. Coinholder votes, including a roughly $7 million retroactive grants vote and a NU7 vote that drew millions of ZEC, inform decisions but are not binding or on-chain. One speaker said strong coinholder opposition should stop a proposal, while developers would reject changes that violated their core values. The speakers identified stasis from slow-moving committees as a major governance risk. Bowe also linked a higher ZEC price to resources for development and community treasuries, while arguing that the ambition of thousands or tens of thousands of payments per second requires substantial demand and market capitalization.