Bitcoin privacy versus privacy coins

Monero's technical specification describes three separate privacy properties, each with its own mechanism. Sender privacy comes from ring signatures, which allow a signer to prove that they control one key in a set without revealing which one; the specification states the ring size and describes the assurance as probabilistic, meaning plausible deniability rather than certainty. Recipient privacy comes from stealth addresses, which require the sender to create a one-time address for every payment so that the recipient's published address never appears on the chain. Amount privacy comes from ring confidential transactions, which hide the values being transferred.

The Monero documentation is careful about what ring signatures do and do not provide. The Moneropedia entry describes a ring as a set of possible signers in which all members are equal and valid, so an outside observer cannot tell which one signed. It also notes that the ring members are drawn from past outputs on the chain, which means the anonymity set is a property of the chain's history rather than a fixed guarantee. The assurance is described as probabilistic, and that word is doing real work.

The practical difference from Bitcoin is that these properties are defaults. A Monero user does not have to practise address hygiene or control coin selection to get the base level of privacy; the protocol applies the mechanisms to every transaction. That is a genuine architectural difference, and it is the strongest argument for the design. It is also a difference in what has to be trusted: the privacy depends on the cryptographic constructions being sound, where Bitcoin's depends on the user's behaviour.

Zcash's protocol specification describes a system that bridges two payment schemes. Transparent transfers work essentially as they do in Bitcoin and, in the specification's own words, have the same privacy properties. Shielded transfers use zero-knowledge succinct non-interactive arguments of knowledge to prove that a spend is valid without revealing which note is being spent or to whom it belongs. Value in a shielded pool is carried by notes, each with a commitment published on the chain and a nullifier revealed when it is spent; the specification states that it is infeasible to correlate a commitment with its nullifier without the relevant key.

The specification is explicit about the boundary between the two schemes. Transfers between pools always reveal the amount transferred, even when one side is shielded. A shielded payment address includes a transmission key for a key-private encryption scheme, so that ciphertexts do not reveal which key they were encrypted to except to the holder of the receiving key. The privacy of a shielded transaction therefore depends on which pool the funds are in and on how they moved between pools, and the specification documents those transitions rather than presenting the system as uniformly private.

The comparison with Bitcoin is instructive precisely because Zcash contains a Bitcoin-like transparent mode. The two systems share the same transparent privacy properties, and Zcash adds an optional shielded mode on top. That makes the trade-off visible: the shielded mode provides stronger privacy for the transactions that use it, and the transparent mode provides none beyond what Bitcoin already has. Which mode a given transaction used is a fact about that transaction.

The architectural difference is real and it is not a matter of degree. Monero and Zcash apply privacy mechanisms to transactions by default or by explicit mode; Bitcoin does not, and its privacy comes from user behaviour. A user who wants privacy without having to practise it will find the privacy coins easier, and that is a legitimate reason to prefer them.

What the comparison does not establish is that one approach is strictly better. Bitcoin's transparency is what makes independent verification cheap and what allows any node to audit the supply without trusting anyone. The privacy coins accept a different set of assumptions in exchange for their privacy properties, and those assumptions — the soundness of the cryptographic constructions, the parameters chosen, the trust placed in the setup of any proving system — are documented in their own specifications rather than hidden. A reader comparing the systems should read those documents rather than the marketing on either side.

There is also a practical point that applies to all three. Privacy is a property of a transaction's whole context, not just its mechanism. A shielded Zcash transaction that is broadcast from an identified IP address, or a Monero payment made to an address published next to a name, has given away information that no protocol can recover. The mechanisms change what the ledger reveals; they do not change what the user reveals elsewhere.