Can Privacy Coins Be Trusted?

The objection sounds plausible: with privacy coins, the actual circulating supply cannot be verified. What cannot be controlled cannot be trusted. Therefore: structurally unusable.

The problem with this argument is not that it is entirely wrong. It fails to distinguish what needs to be distinguished.

Privacy coins are not a homogeneous class. The three dominant cryptographic approaches — zkSNARKs, ring-signature-based systems, and Mimblewimble — differ fundamentally in where and how the integrity of the money supply is secured.

In Zcash, zkSNARKs prove that all protocol rules have been followed without revealing amounts, inputs, or outputs. An observer sees only cryptographic proofs, not the underlying transaction structure. Money supply integrity therefore depends not on transparency but on the correctness of the proof system itself.

The consequences became visible in May 2026, when an independent researcher discovered a soundness vulnerability in the Orchard proof logic. The flaw could have allowed invalid transactions to pass verification and required an emergency shutdown of the Orchard pool followed by a protocol upgrade. Although no unauthorized value creation was detected, founder Zooko Wilcox acknowledged that, because of Orchard’s privacy properties, there is no cryptographic way to determine whether the vulnerability had been exploited before it was fixed.

The incident illustrates a fundamental characteristic of zkSNARK-based systems: if the proof system itself fails, money supply integrity may become impossible to verify. Even proponents often describe the underlying cryptography as “moon math” because of its extreme complexity. In response, Shielded Labs has proposed a network upgrade that would for the first time allow public verification of whether the ZEC supply has been silently inflated.

This dependence on the proof system is not unique to Zcash. Fully shielded systems such as Piratechain lack even the limited accounting anchor provided by Zcash’s transparent pool and turnstile mechanism. Yet that same feature exposes a trade-off: optional privacy provides an external accounting reference, but also creates metadata that privacy-by-default systems such as Monero and native Mimblewimble avoid.

Monero and other ring-signature-based privacy systems rely on the interplay of several cryptographic mechanisms: ring signatures, stealth addresses, Pedersen commitments, and range proofs. In Monero, the adoption of Bulletproofs strengthened this model by efficiently proving that hidden amounts are non-negative, eliminating an important class of potential inflation vulnerabilities.

Coinbase transactions are public, so the emission curve remains traceable and verifiable against protocol rules. The amounts of regular transactions are concealed through Pedersen commitments, while ring signatures prevent unambiguous attribution of expenditures. Money supply integrity therefore rests on the assumption that every individual cryptographic component functions correctly. A node can verify that each transaction supplies the required proofs — but a transparent global ledger in which inputs, outputs, and balances are directly traceable cannot be constructed from this.

Should a previously unknown flaw cause invalid commitments or faulty proofs to be accepted, reconstructing the precise inflation path after the fact would be substantially harder. Global balance consistency is not directly observed but inferred from the correctness of numerous individual cryptographic proofs.

Mimblewimble takes a different approach. Cut-through removes already spent inputs and outputs, while transaction kernels are retained permanently. Together with the remaining commitments and range proofs, they provide the information required to verify that every transaction satisfied Mimblewimble’s balance equation.

A node can verify all emissions, kernel signatures, range proofs, and commitment relationships from genesis and directly confirm global balance consistency. In contrast, Monero derives supply integrity from the validity of a large collection of individual cryptographic proofs.

Notably, this property survives pruning. Although large portions of historical transaction data can be discarded, the commitments, kernels, and proofs required for balance verification remain available. A pruned Mimblewimble blockchain can therefore still be fully verified without relying on prior checks — a property neither zkSNARK-based nor ring-signature-based systems offer in equivalent form.

The underlying cryptographic assumptions are comparatively elementary: the security of secp256k1 and the discrete logarithm assumption are shared with Bitcoin; Pedersen commitments and Bulletproof range proofs—cryptographic components also used by Monero—add privacy without turning the monetary system into a cryptographic black box. Their design remains sufficiently narrow and well understood to allow independent review and verification.

In March 2026, a validation flaw in the interface between the Litecoin base chain and its Mimblewimble-based extension system allowed an attacker to construct a withdrawal from the MWEB extension far exceeding the actual input value — because MWEB input metadata was not fully checked against the referenced UTXO at block connection. Developers coordinated an emergency update and froze the affected outputs. In April 2026, a second exploitation attempt triggered a 13-block reorganization before upgraded miners overtook the invalid chain.

The flaw did not lie in the cryptographic core of Mimblewimble — neither in Pedersen commitments, kernel signatures, nor the underlying balance logic — but in the integration layer of the MWEB extension.

It is precisely here that hybrid architectures introduce failure classes that do not exist in native Mimblewimble systems. The security-relevant risks of such systems frequently lie not in the cryptographic design but in the transition logic between otherwise correctly functioning protocol layers — a surface that grows with every extension beyond the Mimblewimble core: confidential assets, smart contract layers, scriptability.

The decisive question is not: is the money supply visible? But rather: what must I trust to be confident that no silent inflation has occurred — and is it even possible to determine this after the fact?

The answer differs by architecture. In Zcash, trust rests primarily in the zkSNARK system itself. If its correctness is called into question, there is no way to independently verify the integrity of the Orchard pool after the fact. In Monero, money supply integrity derives from the correctness of all individual cryptographic components and their complete history — a global balance cannot be directly constructed from this. Of the three approaches, only Mimblewimble allows direct and independent verification of global balance consistency — and retains that property even after the blockchain has been pruned.

The objection that privacy coins are fundamentally unusable because their money supply cannot be verified misses the point. Not all privacy systems relocate trust to the same place. The question is not whether trust is required, but whether the integrity of the money supply — when that trust is shaken — can still be verified independently.