Zerocoin

Zerocoin.

Zerocoin is a cryptographic protocol for breaking the public link between a coin's minting and later redemption. Ian Miers, Christina Garman, Matthew Green and Aviel D. Rubin of Johns Hopkins University presented it in 2013 as a proposed extension to Bitcoin. Its central tools are cryptographic commitments, an accumulator and zero-knowledge proofs.

The name refers to a protocol and to the temporary coins created within it. It is distinct from Zcoin, the cryptocurrency later renamed Firo, and from Zerocash, a subsequent research system associated with Zcash. Several independent cryptocurrencies implemented Zerocoin-derived designs; their releases, parameters and security responses differed.

Background and purpose

Bitcoin records transactions in a public ledger. Addresses act as pseudonyms rather than a guarantee of anonymity: transaction relationships and information from outside the blockchain can connect activity to a person. Changing addresses alone does not remove the information contained in the transaction graph.

A custodial mixing service attempts to obscure that graph by accepting and returning funds. Its operator may learn the connections or fail to return deposits. Zerocoin instead proposed that consensus rules and cryptographic proofs control redemption, without appointing a bank or mixing-service operator to issue private coins. This removes one form of custody trust, while leaving cryptographic and setup assumptions.

How minting and spending work

Minting and the coin commitment

To mint, the user generates a secret serial number S and random value r, then creates a commitment C. The paper uses a Pedersen-style commitment, written as C = g^S h^r mod p. The public C conceals S; knowing r allows the owner to relate C to that serial number later. A commitment is not encryption: the spend uses a proof about the committed value rather than decrypting C for everyone.

The mint transaction commits the corresponding base-currency value plus any fees. The original prototype used a fixed coin value. Its proposed Bitcoin integration put the value beyond ordinary spending so that it could be redeemed only through the Zerocoin rules; the user retained the secret coin data in a wallet.

The accumulator and membership witness

Valid public commitments are combined in a cryptographic accumulator, a compact value representing a set. A membership witness provides the information needed to prove that a particular commitment belongs to that set. The spender proves possession of such a witness without revealing the commitment. Keeping the set compact avoids listing every possible mint inside each proof.

Spending and double-spend prevention

A spend publishes S and a zero-knowledge proof linking it to a valid accumulated coin whose opening the spender knows. Nodes verify the proof and check S against previously accepted serial numbers. Reusing a serial number is rejected as a double spend. The destination and redeemed denomination remain visible; what the proof is intended to conceal is which mint supplied that value.

For example, several users may mint coins of the same denomination. A later spend proves eligibility to redeem one coin without naming its original commitment. Publishing a serial number lets the network reject a repeat claim without requiring the spender to disclose the original mint. This is a conceptual description of the protocol, not an instruction to submit Zerocoin transactions to Bitcoin.

The authors built a modified bitcoind prototype. Their full proposal required new transaction-validation behavior, so deploying it on an existing chain was a consensus-change problem as well as a cryptographic implementation problem. The separate libzerocoin library supplied core cryptographic routines; applications still had to implement transaction formats, mint validation, spent-serial tracking and redemption.

Privacy guarantees and limitations

Fixed denominations make the eligible coins comparable, but they constrain payments. The original proposal allowed several denominations through separate protocol instances sharing public parameters. A payment spanning several fixed-denomination coins requires several spends, each with its own proof. A redemption could also create another mint, allowing value to move between denomination instances.

The accumulated mint set is not a permanent guarantee of that many plausible origins. The paper gives an edge case: after all earlier mints have been redeemed, a new mint may be the only possible source of the next spend. Mint and spend counts, denomination choices and timing affect what an observer can infer. Useful anonymity therefore depends on other users' activity as well as proof correctness.

Ledger privacy does not automatically hide a transaction's network origin. The paper treats network anonymity separately, and wallet compromise can expose the secret data linking coins to their mints. Hiding the mint-to-spend link also does not hide all public transaction destinations and amounts. These boundaries distinguish the original construction from a system supporting private transfers entirely within a shielded ledger.

RSA parameters and trusted setup

The accumulator uses an RSA modulus N formed from secret prime factors. Anyone retaining those factors can undermine the accumulator's protection against forged membership, potentially permitting counterfeit coins. Secure parameter generation and disposal of secret factors are therefore separate concerns from avoiding a custodial mixer.

The original paper discusses generating parameters with a trusted setup and destroying the factors, as well as a proposed trapdoor-free alternative called RSA UFOs. Implementations must be assessed against their actual parameter-generation method. The fact that Zerocoin does not require a trusted issuer for every transaction does not establish that every deployment has a trust-free setup.

Performance costs and follow-up research

Zerocoin trades a stronger separation between mints and spends for larger proofs and extra computation. Rational Zero describes the original 80-bit design as producing a spend proof of about 25 KB and taking about 0.5 seconds to verify at those parameters. These are historical research measurements, not specifications or benchmarks for current Bitcoin or every later Zerocoin deployment.

The 2013 authors also tested blocks in a modified Bitcoin client. Their experiment included blocks of 200, 400 and 800 transactions with different proportions of mints and spends; an 800-transaction block composed of Zerocoin transactions verified in under five minutes in their setup. That result depended on the test hardware, parameters and workload. It does not mean that arbitrary present-day blocks have the same cost.

The 2014 Rational Zero paper explored stronger long-term anonymity, divisibility and smaller proofs. One proposed optimization reduced soundness parameters by assuming an economically rational forger would not spend more attacking a coin than the value recoverable from it. This was a specific threat model, with limits for attackers motivated by goals other than financial profit; it was not a general guarantee of security at reduced parameters.

Historical implementations and proposals

ZeroVert

A developer announcement for ZeroVert in November 2014 described a Zerocoin-based cryptocurrency and linked a wallet release. Later, the researchers who investigated Zerocoin vulnerabilities described ZeroVert as an abandoned predecessor of Zcoin. This earlier experiment makes an unqualified claim that Zcoin was the first implementation misleading. The historical release does not establish a current active network. The project announcement listed Scrypt-N merge mining with Vertcoin and a planned total of 8.4 million ZER. These are the developer's announced specifications, not independently verified present-day network or supply data.

Moneta, Zcoin and Firo

Moneta was an earlier name used by the project that became Zcoin. Its December 2015 release was a testnet stage; the project's retrospective says the name changed before its real-network launch. Firo dates Zcoin's launch to 2016-09-28. Poramin Insom was a founder. Testnet publication and mainnet deployment are different milestones.

The project's 2019 retrospective says it used Zerocoin from September 2016 until April 2019. Sigma, its replacement without trusted setup, became live on 2019-07-30. In October 2020, Zcoin announced the Firo name change on the same blockchain. Further research led to later privacy protocols; Lelantus Spark became live on Firo mainnet on 2024-01-18. These milestones describe that project's evolution, not a universal migration of every Zerocoin implementation.

PIVX and zPIV

PIVX released wallet 3.0.0 with Zerocoin-based zPIV on 2017-10-16, presenting it as the first proof-of-stake deployment of the protocol. Its later FAQ says zPIV minting was disabled on 2019-03-07. Conversion of existing zPIV back to ordinary PIV remained a separate issue; a November 2020 update described public spends for conversion and said zPIV support would end with version 5.0.

PIVX's subsequent SHIELD system used different privacy technology and became active on 2021-01-30, according to its development report. The sequence is therefore a launch, disabled new minting, a conversion period and eventual replacement, rather than a single date on which all zPIV functionality disappeared.

SmartCash, Zoin, Hexxcoin and Veil

The FAU researchers' April 2018 disclosure identified Zcoin, PIVX, SmartCash, Zoin and Hexxcoin as projects using Zerocoin. It reported that SmartCash had disabled its feature. Veil later documented its own libzerocoin-based implementation and its 2019 emergency response. These dated records support historical adoption, but not a claim that every named project offers the same feature today.

Anoncoin and related zero-knowledge systems

Anoncoin's repository contains an overview that explicitly labels itself old and unedited and describes Zerocoin as being in development. It documents a plan, not proof that a functioning Zerocoin deployment was released. The old present-tense claim that Zerocoin was currently being implemented there needs that historical qualification.

CredaCash belongs in the wider history of zero-knowledge privacy systems rather than being assumed to implement Zerocoin's accumulator scheme. Its own repository describes a separate transaction system intended to conceal inputs, outputs and amounts. Sharing zero-knowledge techniques does not by itself make two systems implementations of the same protocol. Old launch forecasts and performance claims require their own dated evidence.

Security findings and incidents

In February 2017, Zcoin suffered an inflation incident arising from an implementation error. An academic disclosure study describes a mistaken C++ operator and the creation of additional coins. This was a software-validation failure, distinct from the later flaws in Zerocoin's cryptographic constructions. Reported historical loss totals vary, so the mechanism is clearer evidence than a single unqualified financial figure.

In April 2018, FAU researchers disclosed a denial-of-spending attack: under the described conditions an attacker could make an honest user's coin unspendable. They separately reported coding issues capable of unauthorized coin creation or theft. Denial of spending, inflation and theft are different outcomes, with different affected implementations and remedies.

Veil's contemporary account separates a March 2019 wrapped-serial implementation exploit from another vulnerability identified after Zcoin detected an attack in April. The April flaw permitted counterfeit spends and inflation. Veil's temporary response sacrificed minting anonymity to close the exploit; its report says that response did not retroactively expose earlier mints. Other projects chose different shutdown, conversion or replacement measures.

The original libzerocoin repository now describes its code as abandoned and unmaintained with known exploits. It is useful as historical implementation evidence, not as a current production reference implementation. A downstream fork's security cannot be inferred from the original paper, its name, or the fact that another project patched a related issue.

Zerocoin, Zerocash and Zcash

The 2014 Zerocash paper built a distinct private-payment system using succinct zero-knowledge proofs. It extended privacy from the payment's origin to its destination and amount, and supported transfers within the private system. Its performance figures belong to that construction, not to original Zerocoin. Zcash emerged from this research line; it is not another name for Zcoin or the original Zerocoin protocol.

Research and software resources

The original Zerocoin and Rational Zero papers explain the construction and its tradeoffs; the Zerocash paper documents the separate successor design. The archived libzerocoin repository and integration notes show what the prototype library supplied and what an application still had to implement. Historical project announcements are useful for dating deployments, while later security disclosures qualify earlier claims about them.