ZipcoinZC

Zipcoin reborn · Privacy protocol · Ethereum mainnet

Privacy lives on.

Zipcoin is reborn as a shielded pool for ZC on Ethereum, built by a new team on audited open-source cryptography. Deposit in the open, then pay, speak, gift and swap from inside the pool with zero-knowledge proofs. The chain sees a payment. It cannot see who made it.

Read the roadmap See how it works

Thesis

Privacy is choosing who knows.

Privacy is not secrecy from everyone. It is control over who is party to each payment.

Every Ethereum payment today is a public record. Your salary, your rent, your donations and your mistakes sit in one ledger that anyone can read, forever, and cross-reference with everything else you have ever done. That is not transparency. It is a permanent surveillance record.

Zipcoin takes the other position. A payment should be visible to the people in it, provable to anyone who legitimately needs proof, and invisible to everyone else. The protocol lets you show that your funds came from an approved set of deposits without showing which deposit was yours.

“Only Gladias and the restaurant knew that a 10.5 zipcoin order had been made.”
Snowmoon, chapter 6 · Vitalik Buterin, 2026 · GPL v3
  • Non-custodial

    The pool holds a commitment, not an account. Only a proof built on your device can move what you deposited.

  • Vetted at deposit

    Deposits are screened against a published association policy before they enter the approved set. No monitoring of users is required afterwards.

  • Unconditional exit

    Ragequit returns a deposit to the address that made it, without approval from any operator, including us.

How it works

Deposit. Prove. Spend.

Three steps. Proof generation happens entirely on your device.

  1. 1

    Deposit

    Deposit ZC from any wallet. The pool records a commitment, a hash of your note that reveals nothing about you. The association set provider checks the deposit’s source against its published policy and adds it to the approved set.

  2. 2

    Prove

    In your browser, build a zero-knowledge proof that you own an unspent note inside the approved set. The proof is 256 bytes. It names no deposit, no address and no history.

  3. 3

    Spend

    A relayer submits the proof. The pool pays the Teller, the Book, the Hearth or any address you choose, and records a nullifier so the note cannot be spent twice. Change returns to you as a fresh commitment.

What you seeReceipt
PayeeThe Lantern Café
Base10.5 zc
Tax1.1 zc
Total11.6 zc

Tax follows the receipt in Snowmoon (10.5 base, 1.1 tax). Paying it privately in real time is a Phase VII item.

What the chain sees

Public

withdrawnValue
11.6 ZC
recipient
ZipTeller → café
nullifierHash
…
newCommitment
…
stateRoot
…

Not there

depositor
hidden
source note
one of every approved deposit
remaining balance
hidden inside newCommitment

Hashes above are SHA-256 for illustration. The protocol uses Poseidon over BN254 and the proof is verified on-chain with Groth16.

Architecture

A small pool, stateless spenders, replaceable operators.

The trusted surface is the audited core. Everything else can be swapped out by anyone.

Zipcoin keeps the trusted surface small. The pool, its Merkle tree and its verifiers are the open-source Privacy Pools protocol developed by 0xbow and released under Apache-2.0, deployed without modification. Zipcoin is an independent deployment and is not affiliated with 0xbow. Everything Zipcoin adds on-chain is stateless and ownerless. Off-chain services are designed to be replaceable.

  • EntrypointERC-1967 proxy

    Registers pools, collects the vetting fee, accepts association roots. Owner actions pass through a 48-hour timelock. The owner can close a pool to new deposits but cannot block withdrawals or ragequit, and cannot move pool funds.

  • ZC privacy poolimmutable

    A Lean incremental Merkle tree of commitments, a nullifier set and two Groth16 verifiers from the audited Privacy Pools core. Nobody can upgrade it.

  • Spendersownerless

    The Book, the Doorstep, the Tellers, the Hearth and the Changer. Each decodes a payload bound to your proof and does one thing. None has an owner or a balance that lingers.

  • Association set providerpublished policy

    Decides which deposits join the approved set and publishes the whole set to IPFS so the policy can be audited, not trusted.

  • Relayersopen spec

    Submit proofs so your wallet never signs the withdrawal. Specified so anyone can run one, paid from the withdrawal, never from a token.

  • Prover and indexeryour device

    Notes are derived from a phrase and recovered from public events. No account is required.

The Book

Burn to speak.

A public record where posting has a cost and authorship cannot be proven.

Snowmoon has a wall where speech is paid for in burned zipcoins. Zipcoin’s Book is that wall. To post, you burn ZC from inside the pool. The message is public and permanent. The author is not, because the burn is a withdrawal like any other and the proof says nothing about the note that paid for it.

The Doorstep is the same mechanism aimed at one address. Leave a sealed message for a specific address, with a minimum burn to deter spam. Nothing on the Book or the Doorstep can be edited, deleted or attributed.

The Book · example entriesAuthors unknown by design
  1. 1,000 zcburned

    The lantern is lit on the north bridge until the snow stops.

    Posted from inside the pool · proof verified · no sender

  2. 4,000 zcburned

    Rent for the reading room is paid through spring. Keep the door open.

    Posted from inside the pool · proof verified · no sender

  3. 12,500 zcburned

    To whoever returned the ledger: it was never about the money.

    Posted from inside the pool · proof verified · no sender

Roadmap

Milestones, not deadlines.

Each phase is released when its completion criteria are met and independently verifiable. No phase carries a target date.

Live Building Next Later Research
  1. Phase ILive

    Genesis

    Token launched, domain secured, and the reference design documented.

    • ZC launched on Ethereum mainnet through a public launchpad
    • Fixed supply, no team allocation, no presale
    • zipcoin.zip registered and this site published
    • Full review of the first attempt’s contracts and failure

    Completion criteriaToken verified on-chain. Site live. Research notes published in the repository.

  2. Phase IIBuilding

    Foundations

    The governance and disclosure groundwork required before any protocol contract is deployed.

    • 48-hour timelock deployed as the Entrypoint owner
    • Public repository under Apache-2.0 with the protocol specification
    • Treasury address and spending policy published
    • Independent legal review of the non-custodial design
    • Incident disclosure policy with a 24-hour clock

    Completion criteriaTimelock deployed and verified as the Entrypoint owner. Repository public. Treasury address published. Legal summary linked from this page.

  3. Phase IIINext

    The Pool

    A ZC shielded pool deployed from the audited Privacy Pools core, with its association policy published before the first deposit.

    • Entrypoint and ZC pool deployed from the audited core
    • Reuse of the core’s audited Groth16 verifiers, no new ceremony
    • Association set policy published, full set mirrored to IPFS
    • Ragequit tested and documented
    • Browser prover and command-line client
    • Public indexer with a rebuild-from-chain script

    Completion criteriaPool verified on-chain and matched to the published source. First association root posted. A deposit, a private withdrawal and a ragequit completed by an independent party.

  4. Phase IVNext

    The Book and the Doorstep

    Unattributable public messaging, paid for by burning ZC.

    • The Book: burn-to-post from inside the pool, fixed minimum burn
    • The Doorstep: a sealed line at one address, with its own minimum
    • Envelopes for longer messages
    • Spender contracts audited and reports linked here
    • Public bug bounty opened

    Completion criteriaAudit reports published with every finding resolved or disclosed. Bounty live. First hundred entries posted by external users.

  5. Phase VLater

    Tellers, the Hearth and the Changer

    Withdrawals settled in other assets, and gifting from inside the pool.

    • Tellers: pay out a withdrawal in ETH or a stablecoin
    • The Hearth: gifts that carry a burn, so generosity has a cost
    • The Changer: swap inside the withdrawal, with a public fee cap
    • Payment links a merchant can issue without knowing the payer

    Completion criteriaEach spender audited. Fee caps enforced on-chain and unchangeable. A merchant integration operated by a third party.

  6. Phase VILater

    Open relaying

    Removing the core team from every operational role that touches user funds.

    • Relayer specification and reference implementation
    • At least three independent relayers live
    • ERC-4337 paymaster path for withdrawals with no relayer at all
    • Association set provider role documented so others can run one
    • Second and third indexers run by other parties

    Completion criteriaA full month in which more than half of withdrawals were relayed by parties other than the team.

  7. Phase VIIResearch

    The Snowmoon layer

    Mechanisms described in Snowmoon that have not yet been implemented on Ethereum. Each requires new circuits and a new trusted setup, so this phase is research until a specification is published.

    • Private sales tax paid in real time inside the same proof
    • Hidden payment amounts, not just hidden payers
    • Reputation-collateralised loans where only the nullifier and the amount are public
    • Nullifier-gated polls: one voice per note, no identities

    Completion criteriaEach mechanism specified, its circuits audited and its trusted setup completed, and a mainnet deployment demonstrated against the chapter that describes it.

  8. Phase VIIILater

    Reach

    Lower cost, additional networks, and integration with existing wallets.

    • Deployment on an Ethereum L2 with the same policy
    • Integration with privacy-first wallets, including Kohaku once it reaches a production release
    • Agent and MCP toolkit so software can pay privately too
    • One-command self-hosting of the entire stack

    Completion criteriaA user completes a private payment from a third-party wallet with no Zipcoin website involved.

Alongside every phase

Always

  • No deposits are invited before the contracts involved are audited.
  • Any incident is disclosed within 24 hours, with transaction hashes.
  • Every contract is verified and matched to a tagged commit before it is announced.
  • This site and the app carry no analytics, trackers or third-party scripts.
  • Progress is reported against this list, in public, and nowhere else first.

Token and treasury

One asset. No insider allocation.

ZC is the asset the pool shields and the Book burns. It confers no governance rights and no claim on fees.

Contract
0xA2f6441c4839A7fD4eF8536b971ceD04c48A1CEAEtherscan
Trade
Buy ZC on etherstreet.funZC / ETH launch pool
Network
Ethereum mainnet
Supply
1,000,000,000 ZC, fixed. No mint function.
Decimals
18
Launch
Public fair launch through etherstreet.fun, paired against ETH on Uniswap
Team allocation
None. No presale, no vesting, no reserved supply.
Rights
None. ZC carries no governance power and no share of fees.

Treasury funding

Every swap on the launch pool pays a 1% fee in ETH. The launchpad splits it.

40% · protocol treasury 60% · launchpad

That share is the only funding source. There is no token sale, no grant and no allocation behind it.

Treasury use

  • Audits of every contract Zipcoin deploys
  • Relayers and indexers while the network bootstraps
  • The public bug bounty
  • No other expenditure without a published roadmap change

The treasury address and every outgoing payment will be published with Phase II.

Commitments

What we will not do.

Each one is a constraint the first attempt operated without.

  • Custody

    We will not hold your funds.

    The pool holds commitments. Only a proof built on your device can spend one. Ragequit works without us.

  • Upgrades

    We will not change the pool.

    Pool contracts are immutable. The Entrypoint owner acts only through a 48-hour timelock, and every proposal is announced when it is queued.

  • Supply

    We will not mint more ZC.

    Supply is fixed at one billion. There is no mint function, no reserved allocation and no mechanism to create more.

  • Source

    We will not build in private.

    Contracts, circuit configuration, relayer and indexer are published under Apache-2.0 before they reach mainnet.

  • Incidents

    We will not stay quiet after a breach.

    Public disclosure within 24 hours, with the transaction hashes and what we are doing about it.

  • Tracking

    We will not watch you.

    No analytics, no trackers, no wallet fingerprinting, on this site or in the app. A privacy protocol should not monitor its own users.

Lineage

Same idea. Better engineering.

The design comes from a novel. The requirements come from studying the first attempt.

Snowmoon

Vitalik Buterin published Snowmoon on 27 September 2026 under GPL v3. Its zipcoin is a tap-to-pay system where the shop and the buyer are the only parties who learn the amount, sales tax is paid privately in real time, speech on the public wall costs a burn, and reputation can stand in for collateral.

Zipcoin treats those scenes as a specification. Where the novel is precise, we build what it describes. Where it is silent, we say so in the roadmap.

The first attempt

A first zipcoin was built by another team hours after the novel was published and shut down 25 days later, after a breach exposed its operational keys. Its failure was operational, not cryptographic: it depended on a single relayer, a single association set provider, a single indexer, and a token that doubled as the treasury.

Zipcoin is a separate project, built by a new team on the same audited open-source core. The idea survives. The engineering around it is different, starting with a clean token that has no insider allocation.

  • ChangedOwner actions pass through a public 48-hour timelock, so nothing changes without notice.
  • ChangedOpen relaying and an auditable association policy are launch requirements, not later promises.
  • ChangedFixed supply, no team allocation, and a treasury funded only by a published launchpad fee share.
  • ChangedContracts and policies are published before they are deployed.
  • KeptThe 0xbow Privacy Pools core, its audited verifiers, and the stateless spender pattern that made the Book possible.

Zipcoin is an independent project run by a new team. It is not affiliated with Vitalik Buterin, the Ethereum Foundation, 0xbow or the earlier zipcoin project. Snowmoon is quoted under its GPL v3 licence.

FAQ

Frequently asked questions.

If a question is missing, it will be added here before it is answered anywhere else.

How does this relate to the ZC token launched in September?

That project was built by a different team and shut down after 25 days following a security breach. Zipcoin is a separate project with its own team, token and contracts. We share the name and the idea from Snowmoon, build on the same audited open-source core, and engineer around the operational weaknesses that ended the first attempt.

There is no connection to the earlier contracts and no migration from them. The only ZC contract associated with this project is the one listed on this page.

Is the shielded pool live?

Not yet. Phase III deploys it. Until this page says otherwise there is nothing to deposit into, and any pool presented as Zipcoin is not affiliated with this project.

Has the code been audited?

The Privacy Pools core by 0xbow that we build on has published audits of its circuits and contracts, and we deploy it without modification. Zipcoin’s own spender contracts will be audited before deposits are invited, and the reports will be linked from the roadmap.

Is Zipcoin part of Privacy Pools or 0xbow?

No. Zipcoin deploys the open-source Privacy Pools contracts under their Apache-2.0 licence as an independent instance, with its own association policy and its own spender contracts. 0xbow does not operate, endorse or have any role in Zipcoin.

Is this legal?

Zipcoin is non-custodial software. The pool cannot be paused or drained by anyone, deposits are vetted against a published association policy, and ragequit lets anyone leave with their own funds. We operate nothing that takes custody.

We are not lawyers. An independent review is part of Phase II and its public summary will be linked here.

Why a token at all?

The pool needs an asset to shield and the Book needs something to burn. ZC is that asset. It is not a governance token, it does not earn fees, and holding it gives you no say over the protocol.

Where does the money come from?

Only from the 40% creator share of the 1% swap fee on the launch pool, paid in ETH. There is no other source. The treasury address and its spending are published with Phase II.

Can I run a relayer or the association set provider?

Yes. That is what Phase VI is for. The specifications and reference implementations will be published, and the phase does not close until most withdrawals are relayed by independent operators.

How do I know an announcement is really from Zipcoin?

Official channels will be listed in the footer of this site and nowhere else. Until they appear there, treat any account, group or token claiming to be Zipcoin as unverified.