The Zcash “ceremony” was a trusted setup held in October 2016. The original genesis ceremony took place on October 23, 2016, and it generated the public zk-SNARK parameters behind Zcash’s pri
The Zcash “ceremony” was a trusted setup held in October 2016. The original genesis ceremony took place on October 23, 2016, and it generated the public zk-SNARK parameters behind Zcash’s private transactions.
Six people each made one piece of a secret key and destroyed it, so the full key could never exist. Ten years later, the story matters again. ZEC is a top-10 coin, and an upgrade is about to retire the pool that the ceremony created.
The answer starts with how Zcash hides payments.
Zcash uses zk-SNARKs, a type of zero-knowledge proof. This technique proves a statement is true without revealing why it is true. Early SNARK systems needed a one-time setup that creates a “structured reference string,” a set of public parameters. The secret randomness left over is called “toxic waste.” If anyone rebuilt it, they could forge proofs that still pass verification.
For Zcash, that meant fake coins. A leaked master secret would let an attacker create unlimited counterfeit ZEC without being detected.
The team split the risk across several people using cryptography.
Multi-party computation (MPC) lets several parties build one result without anyone seeing the whole secret. Six participants each produced one shard of the key set, each in a separate location with separate hardware.
Zooko Wilcox recruited the group, but the others were not told who else was taking part. Rebuilding the toxic waste needs every shard, so the setup fails only if every participant is compromised.
The Six Participants And The Destroyed HardwareAfter the ceremony, the machines were destroyed so no leftover data could be read from their memory. Za Wilcox, Zooko’s brother, destroyed one computer used to generate random numbers.
Not everyone was convinced. Peter Todd later argued that anyone with access to the software used that day could reach everything the ceremony ran on, so it was not truly six independent sources of randomness.
The ceremony’s output powered Sprout, Zcash’s first shielded pool. A shielded pool is the group of private ZEC that follows one set of privacy rules. Sprout used a proof system called BCTV14, built on the 2016 parameters.
In 2018, engineer Ariel Gabizon found a flaw in BCTV14 that could have allowed unlimited fake ZEC. The ceremony itself was carried out correctly, but the error sat in the research behind the parameters. The Sapling upgrade replaced BCTV14 and fixed the flaw on October 28, 2018, and the team disclosed it in February 2019.
Each new shielded pool reduced reliance on the 2016 event.
For Sapling, Zcash ran an open ceremony. Phase 1, called Powers of Tau, drew 87 contributors, and about 90 people took part in total.
Orchard was designed to remove the trusted setup, so no hidden secret is created and no ceremony is needed. Bugs in the circuit itself remain possible, though. In May 2026, researcher Taylor Hornby found that one elliptic-curve multiplication step in Orchard’s zero-knowledge circuit was under-constrained. In plain terms, the circuit did not check that step fully.
Zcash responded with Ironwood. Ironwood is a separate shielded pool that keeps key parts of Orchard’s design, including the Halo 2 proving system. The old Orchard pool now allows withdrawals only.
The ceremony’s legacy is closing out this month.
ZEC traded near $1,332 on October 12, roughly 8% above the previous day. It has rebounded even as investors keep withdrawing money from Grayscale’s Zcash ETF, with weekly ZCSH outflows of $30.72 million.
The 2016 ceremony let Zcash launch private payments with zk-SNARKs, using six shards so that one honest participant kept the system safe. Sapling widened that trust to about 90 people. Orchard and now Ironwood use Halo 2, which needs no trusted setup. With NU7, Zcash is retiring the Sprout pool the ceremony created.
