BMIC vs Zcash (ZEC) — Privacy ≠ Quantum Safety

The Biggest Misconception in Crypto Quantum Security

Zcash (ZEC) launched on mainnet in October 2016, offering what was then a breakthrough in blockchain privacy: shielded z-addresses using zk-SNARK zero-knowledge proofs to hide transaction amounts and participants from public view. This genuine cryptographic innovation made Zcash unique — but it has also generated a persistent and dangerous misconception among retail investors: that privacy implies quantum resistance.

It does not. And understanding why requires examining Zcash's actual cryptographic architecture — both for transparent t-addresses and for shielded z-addresses across all three protocol versions: Sprout, Sapling, and Orchard.

Zcash Key Architecture: Every Layer Is Elliptic Curve

Transparent t-Addresses: Identical to Bitcoin

Zcash transparent t-addresses use secp256k1 ECDSA — precisely the same scheme as Bitcoin and legacy Ethereum. When a t-address spends ZEC, the full secp256k1 public key is broadcast to the network and permanently recorded on-chain. A CRQC applies Shor's algorithm to the public key and derives the private spending key.

Mining in Zcash is particularly exposed: all coinbase block rewards must be paid to t-addresses (miners cannot use z-addresses for coinbase outputs). Every miner's reward address is a permanently exposed secp256k1 public key — accumulated over 9+ years since October 2016.

Shielded z-Addresses: Three Generations, All Elliptic Curve

Why z-Address Spending Keys Are ECDLP-Based

The Zcash Sapling shielded protocol derives spending authority through the following key hierarchy (simplified):

• Spending key (sk) → scalar in the Jubjub curve's base field
• Ask (spend authorising key) → derived via PRF from sk; used for spend authority signatures (RedJubjub)
• Ak (spend validating key) → Ask × G_Jubjub — a Jubjub curve point (scalar multiplication = ECDLP)
• Nullifier key (nk) → another Jubjub curve scalar and associated group element
• Outgoing viewing key (ovk) → used for note decryption, derived from sk

The Spend Description in every Sapling transaction includes the Rk value — a re-randomised version of the spend authorising key, published on-chain inside the zk-SNARK proof data. A CRQC can extract the elliptic curve component from this published data and apply Shor's algorithm to derive the underlying spending key.

Why zk-SNARKs Cannot Protect Against a CRQC

Zero-knowledge proofs allow Zcash to prove "I know a valid spending key for this note commitment" without revealing the key to verifiers or blockchain observers. This is a powerful privacy guarantee — but it is a guarantee against passive observation, not against cryptographic key derivation.

A CRQC attack does not attempt to extract a key by watching a proof. It:

1. Reads the elliptic curve public key material published in spend descriptions, viewing key material, or diversified addresses (all on-chain or computable from on-chain data)
2. Applies Shor's algorithm to solve the elliptic curve discrete logarithm — deriving the private scalar underlying the curve point
3. Constructs valid Zcash spend authority independently of the proof system

The zk-SNARK proof system proves correctness of a spend to third-party verifiers. A CRQC does not need to verify a spend — it creates a spend using the derived private key. The proof system is bypassed entirely, not broken.

What the zk-SNARK Circuit Actually Proves

The Sapling/Orchard Spend circuit proves: (1) knowledge of a valid note commitment with correct value, (2) knowledge of the spending key that corresponds to that note's diversified payment address, (3) correct nullifier construction (prevents double-spend), and (4) correct Pedersen commitment re-randomisation. Every one of these checks relies on elliptic curve group operations on Jubjub/Pallas that are ECDLP-based. The circuit's security assumptions are classical — they were not designed for post-quantum adversaries.

CRQC Attack Path: Zcash Wallet and Mining Drain

The following four-step attack path illustrates how a CRQC breaks Zcash security once sufficient quantum hardware is available:

1. Harvest (now, pre-CRQC) Archive all Zcash t-address public keys (revealed at spend time, permanently on-chain), all mining coinbase t-addresses (every block since October 2016), and all Sapling/Orchard spend description Rk values and diversified address material from shielded transaction outputs. 9+ year HNDL corpus fully accessible via Zcash full node RPC.
2. Derive (CRQC, future) Run Shor's algorithm against: (a) t-address secp256k1 public keys → derive private spending keys; (b) Sapling Rk values → solve ECDLP on Jubjub to derive Ask private scalars → reconstruct full spending key hierarchy; (c) Orchard spend authorising key analogues on Pallas curve. All three are standard ECDLP instances — Shor's algorithm applies uniformly.
3. Construct (CRQC, future) With derived private keys, construct valid Zcash transactions spending t-address UTXOs and valid Spend Descriptions (with correctly derived nullifiers and re-randomised keys) for shielded notes. The derived keys enable construction of cryptographically indistinguishable spends — the zk-SNARK proof is generated legitimately using the derived spending key. Full nodes see a valid, properly-formed transaction.
4. Drain (CRQC, future) Broadcast crafted transactions to drain target wallets. For t-addresses, the path is identical to a Bitcoin CRQC attack. For z-addresses, the attacker has fully reconstructed the spending key hierarchy — they can spend any note commitment for which they have harvested the corresponding Rk data, without the original wallet owner's knowledge until the nullifier appears on-chain. Exchange hot wallets (t-addresses) and mining pool reward addresses are highest-value targets.

The Trusted Setup Ceremonies: What They Do and Don't Protect

Zcash has conducted two major multi-party computation (MPC) ceremonies to generate public parameters for its proof systems:

• Sprout ceremony (2016): Six-party MPC generating toxic waste parameters for the Sprout Groth16 circuit on BN128. Required all participants to destroy their secrets for security.
• Sapling ceremony / Powers of Tau (2017–2018): Much larger MPC (over 90 participants) for the Sapling Groth16 circuit on BLS12-381. Included prominent cryptographers and security researchers.

These ceremonies serve a specific purpose: preventing counterfeit ZEC creation. If any single participant retains their "toxic waste" (trapdoor parameter), they could generate fraudulent proofs that claim false ZEC balances. The multi-party setup distributes this risk across many participants — as long as one participant honestly destroys their secret, the trapdoor is computationally unrecoverable.

Orchard's Halo2 system eliminates the trusted setup requirement entirely through recursive proof composition. This is a genuine advance for ZEC supply integrity. But as noted above, it is orthogonal to quantum resistance of spending keys, which remain ECDLP-based on the Pallas curve.

9-Year Harvest-Now-Decrypt-Later Corpus

Zcash mainnet launched in October 2016 — making it one of the longest-established chains after Bitcoin and Litecoin. Every t-address spending transaction and every Sapling/Orchard spend description published since then is part of a permanently accessible HNDL corpus.

Technical Comparison: BMIC vs Zcash (ZEC)

How BMIC Approaches Quantum Security

BMIC is a presale crypto project built with three NIST FIPS post-quantum standards — finalised August 2024 — as core cryptographic infrastructure from day one:

• NIST FIPS 203 (ML-KEM / CRYSTALS-Kyber) — lattice-based key encapsulation. Replaces all ECDH variants including those used in Zcash note encryption. No known quantum polynomial speedup from Shor's or Grover's algorithms.
• NIST FIPS 204 (ML-DSA / CRYSTALS-Dilithium) — lattice-based digital signatures. Replaces secp256k1 ECDSA (t-addresses) and the RedJubjub/RedPallas signing schemes (z-addresses). Security based on Module Learning With Errors — no elliptic curve arithmetic.
• NIST FIPS 205 (SLH-DSA / SPHINCS+) — stateless hash-based signatures. Provides a mathematically independent backup layer; relies only on hash function collision resistance, not algebraic structure. Unlike Zcash's three address types (all sharing the ECDLP assumption), BMIC's three standards rest on genuinely independent hardness assumptions.

BMIC implements ERC-4337 account abstraction, which separates wallet signing logic from classical EOA private-key construction. This architectural choice reduces the on-chain key material surface available to a future CRQC — a structural advantage that neither t-address UTXO spending nor shielded note spending (with their on-chain Rk / RedPallas values) provides.

The key distinction from Zcash's multi-version shielded privacy system: BMIC's quantum protection is cryptographic (PQC key hardness), not observational (hiding amounts). Privacy and quantum resistance are independent properties — BMIC addresses the latter from genesis.

NSM-10 and Institutional Zcash Holders

US National Security Memorandum 10 (NSM-10) requires federal agencies and critical infrastructure operators to inventory quantum-vulnerable cryptography and complete migration to NIST-approved post-quantum algorithms by 2030. Institutional investors operating under NSM-10 — or equivalent frameworks in the EU, UK, and APAC — face increasing pressure to evaluate the quantum posture of digital asset holdings.

ZEC's quantum posture is particularly complex institutionally. The three-layer key architecture (t-addresses / Sapling / Orchard) means institutional custodians holding ZEC must navigate three separate quantum migration gaps, none of which have a published roadmap from the Electric Coin Company or Zcash Foundation as of August 2026.

Exchange custodians — Coinbase Custody, Kraken, Bitfinex — holding ZEC in operational wallets use t-addresses (secp256k1) for liquidity management. These are the highest-value, most directly exposed targets for CRQC-era attacks, and they accumulate a longer HNDL corpus with every passing year.

BMIC implements NIST FIPS 203/204/205 from genesis — not as a future migration target — positioning it as the only presale-stage crypto project with demonstrable NSM-10 alignment at the cryptographic architecture layer.

Related Quantum Comparisons & Research