Think about the last thing you bought with a card.
The receipt is gone, probably. The record is not. There is a row in a database with a timestamp, a merchant, an amount, a card number, and — through the card network, the acquirer, the issuer and the merchant's processor — a chain of custody that runs from your account to a till in a shop. Add the loyalty program, the delivery address, the phone that was in your pocket, and the record stops being a payment and becomes a profile.
None of that is a scandal. It is how the system pays for itself. But it is worth being precise about what has happened: the money moved, and a permanent, searchable, saleable description of the movement was created at the same time. You did not agree to that in any meaningful sense. You agreed to the terms of a service, which is a different thing.
This chapter is about why that matters, and about the two ways the crypto industry has tried to fix it — and what is wrong with both.
Three different privacies The word "privacy" collapses several distinct things, and most arguments about it go wrong because the participants are talking about different ones.
Privacy of identity. Does anyone know that a given transaction belongs to you?
Privacy of transaction. Does anyone know the amount, the counterparty, or the timing?
Privacy of association. Can anyone link two of your transactions together and infer that they belong to the same person, even without knowing who that person is?
Bitcoin gives you a version of the first and almost none of the second or third. Your name is not on the ledger, but the ledger is a graph, and a graph with enough edges identifies its nodes. That is the entire business model of the chain-analysis industry: not breaking cryptography, but counting.
The two leading privacy coins take different approaches to this problem, and both are serious. It is worth describing each on its own terms before saying anything critical, because both have earned that.
Monero: privacy as the default Monero made privacy mandatory and built it into every transaction from the start.
Ring signatures hide which of several possible inputs is the real one, so a spender cannot be identified from the inputs alone. Stealth addresses generate a one-time address for each payment, so a recipient's address never appears on the chain. RingCT hides the amounts, using commitments and range proofs so that the network can verify a transaction balances without learning the values. Dandelion++ obscures where a transaction originated on the network.
The design is coherent, it has been running since 2014, and its defaults are the strongest in the industry: there is no transparent mode to fall back into, so there is no way for a user to accidentally leak. Monero's supply is also uncapped — 0.6 XMR per block, forever — which is a deliberate choice rather than an oversight, and a reader who values scarcity should know that this is one of the places where the two designs genuinely differ rather than merely rank.
What Monero costs is size and time. Every ring signature needs decoys, every output is retained, and the chain is roughly two hundred gigabytes for a full node, seventy for a pruned one. It is not a chain you run on a laptop you also use for work.
Zcash: privacy as an option Zcash made a different bet, and a technically remarkable one.
Its shielded transactions use zero-knowledge proofs — the sender proves that the transaction is valid without revealing the sender, the recipient or the amount. The cryptography is among the most sophisticated ever deployed in a monetary system, and the team behind it has repeatedly advanced the state of the art, including moving the protocol away from the trusted setup that early versions required.
But Zcash is a dual system. There is a transparent chain, which behaves like Bitcoin's, and a shielded pool beside it. Privacy is something a user chooses, per transaction, and the choice is visible: the network can see whether a transaction is shielded or transparent even when it cannot see what is inside.
This is a defensible design, and it has one large structural consequence: optional privacy leaks. A privacy feature that most people do not use does not protect the people who do, because the flows around them are visible, and the boundary between the two systems is where the analysis happens. The proportion of value inside the shielded pool has historically been a small fraction of the whole.
There is a second consequence, and it is the one this chapter is really about.
The problem with adding a second system When you add privacy to a transparent chain, you are not changing the chain. You are building a second machine beside it — new cryptography, new assumptions, new code — and connecting the two.
That second machine has to be correct in a way that ordinary software does not, because its failures are silent. A bug in a payment app shows up as an error message. A soundness bug in a proof system shows up as nothing at all: valid-looking proofs for invalid statements, accepted by every node, potentially for years.
This is not a hypothetical objection. In 2026 the privacy-coin category had a bad year, and the failures were concentrated exactly where the added machinery lives — proof systems and shielded pools. Zcash disclosed a soundness vulnerability in its Orchard pool rated 9.3 on the CVSS scale, present since 2022 and patched within days of disclosure. Other privacy projects had comparable failures in the same period. The pattern is not that these teams were careless. The pattern is structural: every system that adds a privacy layer adds a surface where the layer itself can be wrong.
A privacy design that does not add a layer has a different risk profile. It is not that it is free of bugs — no software is — but the class of bug is different, because there is no separate proof system whose soundness is the only thing standing between a valid chain and an invalid one.
What fungibility actually requires Step back from the cryptography and ask what the property is for.
Fungibility means that any unit is interchangeable with any other, so a holder never has to care where their money has been. That is not an abstract virtue. It is what makes money usable by ordinary people: you do not run a background check on a twenty- dollar bill, and if you had to, cash would stop working.
For a digital currency, fungibility requires that there be nothing to check. Not that checking is difficult — that there is no data to check with. If a coin has a history, that history can be graded. If it can be graded, it can be priced. If it can be priced, there is a market in clean coins and a discount on the rest, and the discount falls on people who did nothing wrong except receive money that had been somewhere.
So the requirement is stronger than "private if you choose." It is: private in a way that leaves no optionality to get wrong, and no separate pool to be traced across.
The honest position on both Neither Monero nor Zcash is a failure. Monero has held the strongest privacy defaults in the industry for over a decade and has been tested by real adversaries. Zcash pushed zero- knowledge proofs into production and funded research that the whole field uses. A book that dismissed either would be signalling its own unseriousness.
What can be said, accurately, is this: Monero's privacy is real but expensive to run and uncapped in supply; Zcash's privacy is optional and therefore partial, and its architecture carries the risk of the second system. Both are answers to the question of how to add privacy to a chain that was not designed for it.
There is a third answer, and it is the one this book spends its second half on: design the chain so that there is nothing to hide in the first place. No addresses, no amounts, no transparent mode, no shielded pool, no second machine.
That is not a small claim, and it is not enough to assert it. It has to be tested against everything else money has to do — supply, settlement, mining, governance, custody — and that is what the next part of the book does.
Before it can, though, the reader needs the test itself.
Where this leaves the three questions Store of value. Bitcoin answered it. Supply is fixed, and the question is now about who else can match that and what else they can offer alongside it.
Medium of exchange. Bitcoin partly answered it and pushed the rest upstairs. Monero answers it better at the base layer, at the cost of scale. Zcash answers it at roughly Bitcoin's level, with an optional privacy layer on top.
Sovereignty. Here the category splits. All three let you hold keys. Only one of them — Monero — makes every transaction private by default, and none of them removes spent data, which is why their chains grow forever and why a full node is a commitment rather than an afternoon.
Three questions, three partial answers, and no design that answers all of them at once. That is not a rhetorical setup. It is a description of the state of the art as of this writing, and it is the reason the next chapter does something unusual: instead of comparing coins, it defines what superior money would have to be, and only then looks at who meets the definition.