What is shielded transaction?

A transaction whose sender, recipient, and amount are encrypted, with a zero-knowledge proof standing in for the public checks a node would otherwise perform.

Zcash implements this alongside transparent addresses, so the same asset can move publicly or privately depending on the address type used (source: the Zcash protocol specification). Moving between the two is itself visible, and a shielded balance that is later moved out in a distinctive amount can be linked by timing. Several exchanges support only transparent addresses for deposits and withdrawals. Generating the proof happens on your own device and takes real time and memory, which is why some wallets still default to transparent addresses for convenience. See zk snark and privacy coin.

For a buyer the practical question is rarely the cryptography. It is whether the exchange you are using will accept a withdrawal to a shielded address at all, and whether it will let you deposit from one.

How it works

A public blockchain validates a payment by checking that the inputs exist, are unspent, and are authorized. Doing that in the open requires publishing who paid whom and how much. A shielded design replaces those checks with a proof that the same conditions hold, without revealing the values they hold over.

In practice the chain stores commitments to notes rather than readable outputs, plus a nullifier that is published when a note is spent so the same note cannot be spent twice. The proof shows that a valid unspent note exists and that the nullifier corresponds to it, and reveals nothing else (source: the Zcash protocol specification).

Two limits are worth understanding. The anonymity set is only as large as the pool of other shielded activity, so a lightly used shielded pool offers less cover than a busy one. And the boundary between the shielded pool and the transparent world is public, so the amount and timing of a shield or unshield is visible even when the movement inside is not.

Example

Illustrative and deliberately simple. Suppose only two shielded transfers happen in an hour, one for 100 units and one for 3.7412 units, and shortly afterwards a transparent address receives exactly 3.7412 units. Nothing inside the pool was revealed, and yet the link is obvious from the amounts and the timing alone. Privacy in a shielded system comes from being one of many similar movements, not from the encryption on its own.

Why it matters when you buy

Support for shielded addresses varies by venue and by jurisdiction, and several exchanges have restricted or removed privacy assets rather than build the compliance tooling. Check which venues list the asset at all on the coin pages and where they operate on the exchange pages, and see Zcash for the venues currently tracked.

Related terms

• zk snark — the proof system that makes this possible
• privacy coin — the asset category this belongs to
• view key — how a holder proves what happened
• stealth address — the alternative approach
• delisting — the common outcome for privacy assets

Questions

Are shielded transactions anonymous?

They hide the sender, recipient, and amount from the chain, but the timing and size of entries into and exits from the shielded pool are public. Anonymity depends on how many other people are using the pool.

Can an auditor see a shielded balance?

Only if you give them a viewing key. That is the point of the design: disclosure is selective and controlled by the holder rather than automatic. See view key.

Why do some exchanges refuse privacy assets?

Compliance teams need to trace flows to meet obligations described under aml and the travel rule, and a shielded transfer does not offer that trace without a viewing key. Several venues chose delisting over building the tooling.