Shielded Labs✓

Introducing Epoch, Shielded Labs’ new research and engineering project focused on hardening Zcash from future threats: AI-powered hackers Quantum Computing risk Adversarial governments We plan to achieve this through formal verification of critical code and by deploying “post-everything” cryptography. Epoch will ensure Zcash remains designed for the threats we face today and for whatever comes next. ⤵️

Happy Birthday, Zcash! It’s been 10 years since “the most uneventful launch ever.” Big thanks to the scientists, Satoshi, the Zcash builders, and the holders who’ve made it possible. Watch the original livestream and see how far we’ve come:

Did you know? The destination of newly issued ZEC is a critical aspect of consensus design and remains untouched by the Network Sustainability Mechanism(NSM). What the NSM enables is new sources of issuance support via different mechanisms for burning ZEC.

RT @aquietinvestor: I’m confused by the outrage from certain people around Crosslink. At this point, it’s an R&D effort. There’s no activation proposal or ZIPs, and it isn’t on the mainnet roadmap. It’s a prototype design that we’re testing and iterating on. Research and experimentation are good for Zcash. Permissionless innovation means people can explore ideas without first securing everyone’s agreement, and the Zcash community should encourage that. Good-faith debate is how Zcash improves, and we welcome scrutiny of Crosslink’s design, assumptions, and tradeoffs. We’re working on Crosslink because we think stronger protection against reorg and rollback attacks may be a necessary security upgrade for Zcash at some point. AI or other forces could eventually challenge the security assumptions behind PoW, and our thesis is that a hybrid model may offer stronger security than either pure PoW or pure PoS. Shielded Labs’ mission is to protect the long-term security of Zcash. It’s a common theme across all our projects, including Crosslink, the Network Sustainability Mechanism (NSM), and Epoch. We also demonstrated that commitment by bringing on Taylor Hornby as a security researcher to use AI tools to identify potential vulnerabilities, which uncovered the Orchard counterfeiting bug. We want to address potential risks before they become urgent, and recent events have shown the value of being forward-looking. The burden of proof is on us. If we want Crosslink included in a future network upgrade, it’s our responsibility to demonstrate consensus. But that’s still a long way off. For now, we’re focused on improving the design, incorporating user feedback, and working toward a production-ready implementation for the community and coinholders to evaluate. There’s still a lot of work to do before we’d propose Crosslink for mainnet, and we plan to run it on testnet for an extended period of time. If you disagree with Crosslink, challenge the design and help us understand what we’re missing. We all want Zcash to succeed. Let’s focus on strengthening and protecting Zcash as a whole by giving research and experimentation room to happen. If you're interested in learning more about Crosslink or participating in the incentivized testnet, feel free to DM me.

Crosslink is a proposed hybrid PoW/PoS upgrade for Zcash. By standardizing staking bonds into incremental powers of 10, observers are prevented from easily inferring individual staking patterns, preserving privacy and maintaining accountability among finalizers.

It has been 10 years since the elaborate setup ceremony for Zcash's first shielded pool, Sprout. Since then, Halo 2 rendered the trusted setup obsolete with the launch of the Orchard pool in 2022. Just this year, the Ironwood pool added formal verification to the shielded pool to ensure balance integrity. Soon, the next shielded pool with Tachyon will enable a breakthrough in scaling, ensuring Zcash can be used by whoever needs it.

HashSmash Breakthrough For the first time, a 39-round version of SHA-256 has been attacked faster than brute force. Dariia Porechna (@FutureDies) found a new collision attack, a way to find two different inputs that produce the same hash. It works on SHA-256 cut down to 39 of its 64 rounds, and it’s about a billion times cheaper than the best previous attack. Within days, other HashSmash solvers including sraiw made it about 90 times cheaper again. Full SHA-256, which secures Bitcoin, is still safe. Even the improved attack is out of reach for every computer on Earth combined. Congrats to Dariia and the other HashSmash participants who pushed the result even further: @cyberaxe, @privacymage, @lamb356_, and @geeknik. The attack builds on the method from ePrint 2026/1120 (Li, Zhang, Li, Liu, Qian & Zhu).

SHA-256 is not broken, but its security margin lost 1 more round this year: Last week I found a collision attack on reduced 39-round that improves prior art by over 30 bits and the first differential attack on that round better than generic search on @yukonresearch Hashsmash board. The attack rests on the same method as prior art ePrint 2026/1120 with new insights that first 2 state words could remain free, allowing a critical condition at step 16 rebuilt as a claw-search problem rather than a probabilistic filter. Took days of watching SAT logs, burning cores and arguing with Claude on what's possible to get a result close to generic search. Since my initial submission, other hashsmash participants sraiw, @cyberaxe, @privacymage, @lamb356_ and @geeknik pushed it down by over 6.5 bits, currently estimated at 118.15 bits. The tree of submissions is hard to follow, so I put the construction, insights and numbers into a blog and am working on detailed technical report. It's fascinating to see an initial structural observation develop into an improvement in the reduced-round collision frontier within days. AI is now a real aid in cryptanalysis and open collaboration speeds it up.

With the NSM, you don’t have to make these trade-offs.

Bitcoin, with its 21 million coin cap, is a sustainable store of value. Ethereum, with EIP-1559, is a sustainable medium of exchange. Zcash is about to have both. It already has a 21 million cap, and with ZIP-235’s upcoming transaction fee burn, it becomes a sustainable medium of exchange.

Big milestone for Shielded Labs: the activation height for NU7 is being set today! The upgrade includes our first major mainnet deployment: the Network Sustainability Mechanism (NSM). Like Bitcoin, Zcash faces a long-term challenge: how to sustain network security as block rewards decline. The NSM helps address that while preserving the 21 million coin cap. ZIP-235 removes 60% of transaction fees from circulation, allowing that ZEC to be reissued as future block rewards. ZIP-237 starts that recycling around February 2031. At current fee levels, that’s only about 210 ZEC per year. This is a modest first step, but we’re optimistic about how new use cases for the NSM could evolve over time and contribute to Zcash’s long-term security.

We’ll have a ceremony. The most secure, most sophisticated cryptographic ceremony that’s ever been performed. - Zooko In a few days Zcash celebrates the 10 year anniversary of The Ceremony. Listen to the story as told by @Radiolab

11 days in: HashSmash has 400+ public AI submissions attacking SHA-256, SHA3, BLAKE3 and Poseidon. See for yourself:

The people are vigilant to accept only changes that improve Zcash and meet their values.

In order to protect an essential value, you have to constantly change. You have to adapt to meet your users changing needs, and to meet new threats and challenges.

Meet Suyash Bagad(@BagadSuyash) Suyash recently joined the Epoch Team at Shielded Labs as a Cryptography Engineer. Suyash joins from Aztec, where he worked on the barretenberg cryptography library and the PLONK family of proof systems, including performance improvements for various cryptographic primitives in ZK circuits. He holds both a BTech and MTech from IIT Bombay, where his graduate research focused on privacy-preserving proofs of reserves for Monero and MimbleWimble. He is based in Europe. Join us in welcoming Suyash!

The strength of Zcash comes from its people.

Zcash is insurance against Bitcoin

The Epoch project was created to stay ahead of threats to crypto. Zcash has proven this past year how quickly we address challenges with 3 upgrades happening in 6 months. Zcash defenders don’t rest, so that Zcash users can.

RT @zooko: Fam, check this out: Announcing BLAKE3-Servil! A new implementation of the BLAKE3 secure hash function. I used AI agents to make it *both* more secure *and* a lot faster. It's the opposite of an AI slop cannon. An AI laser beam. :-) ⤵️

RT @zooko: Poseidon is open for business. Get smashing! This is the variant of Poseidon used in Zcash, so we really want to see exactly how much of it can be collided! (Zcash users will be safe, regardless, btw.)

RT @zooko: Worried about quantum computers? Worried about Al breaking cryptography? Join and help strengthen cryptography before Al breaks cryptography!

Bitcoin is insurance against fiat. ZCash is insurance against Bitcoin.