Zcash Trusted Setup: How Snowden Held a Piece of the Launch Key

In 2016, a key that could have printed unlimited Zcash was split between six people in six locations. One of them used a fake name, and for more than five years nobody outside the project knew who it was. In April 2022 the answer came out: it was Edward Snowden, the former NSA contractor.

A new Bullrunners video tells the full story, from a problem Satoshi Nakamoto could not solve, to a ceremony involving blowtorches and tin foil, to two counterfeiting flaws found years later. The point is not just Zcash. Every coin rests on some kind of trust, and the video argues that many holders never ask what theirs is.

Why isn’t Bitcoin private?

Bitcoin is not anonymous because every transaction sits on a public ledger that anyone can read. Your name is not on it, but once an address is linked to you, your history can be followed.

The public ledger is a feature. It is how everyone can check that nobody is cheating. The video calls it a glass wall around your money.

Satoshi knew this. In August 2010, someone on the Bitcoin forum raised the idea of hiding transaction details. Satoshi replied that it was a very interesting topic, and that if a solution were found, a better and more convenient version of Bitcoin would be possible. The catch, Satoshi wrote, was that it was hard to see how to apply zero-knowledge proofs, because the network has to prove a coin has not already been spent, and that seems to require seeing everything.

A zero-knowledge proof lets you prove something is true without revealing the thing itself. The video’s example: proving you are over 18 without showing your date of birth.

How did Zcash start?

Zcash grew out of academic research that took up Satoshi’s challenge. According to the video:

1. 2013: Cryptographers at Johns Hopkins, including Professor Matthew Green, designed a privacy add-on for Bitcoin called Zerocoin.
2. 2014: A larger team from Johns Hopkins, MIT, the Technion and Tel Aviv University published Zerocash, a full design for private payments using a type of zero-knowledge proof.
3. 2016: That design became Zcash, built on Bitcoin’s code with the same 21 million coin cap.

The key difference from Bitcoin is the shielded pool: an option to send money where the sender, receiver and amount are all encrypted.

What is the trusted setup problem?

To launch Zcash, someone had to generate a cryptographic structure using a secret key, and anyone who kept that key could counterfeit money. Users would have to trust that whoever created it destroyed every copy.

This became known as the trusted setup problem. It was especially dangerous because shielded coins are encrypted. If someone had printed Zcash inside a shielded pool at launch, it could have gone unnoticed. The Zcash team’s own name for the leftover secret was “toxic waste.”

What happened at the 2016 Zcash ceremony?

The team’s answer was a two-day event in October 2016, just before Zcash went live on October 28, which they called the ceremony. Instead of one person making the key, six participants in separate locations each made one piece. As long as any one of the six destroyed their piece, nobody could rebuild the whole key. This technique is called multi-party computation.

The precautions, as described in the video:

• Each computer was bought new from a random store and kept air-gapped, meaning never connected to any network.
• Participants physically removed the Wi-Fi and Bluetooth radios before powering the machines on.
• Every message between machines was burned onto discs that cannot be rewritten, leaving a permanent evidence trail.
• A fingerprint of the whole process was recorded in the Bitcoin blockchain.

Then came the destruction. A journalist from IEEE Spectrum who witnessed one station reported that memory chips holding key fragments were smashed and burned in a fire pit. Bitcoin developer Peter Todd ran the mobile station on a laptop inside a cardboard box lined with tin foil while driving across British Columbia, then burned the machine with a propane torch.

Within days, five participants were named: Andrew Miller, a University of Illinois professor; Peter Van Valkenburgh of the policy group Coin Center; Peter Todd; the security firm NCC Group, which was hired both to run a station and to try to hack the ceremony; and founder Zooko Wilcox. The sixth went by the pseudonym John Dobbertin.

Who was John Dobbertin?

John Dobbertin was Edward Snowden. In April 2022, Zooko said he had messaged the participant asking to end the secrecy. The reply, as Zooko read it, was that it could be shared “as long as it’s clear that I was never paid and had no stake, it was just a public interest thing.”

Snowden then confirmed it on camera. He said he joined because trusted academic cryptographers were working on it, and because most cryptocurrencies use cryptography to make a fair ledger but not a private one. In his words, “you can’t have truly free trade unless you have private trade.”

According to the video, Snowden had praised the technology publicly before the reveal. In December 2017 he called it a moonshot, risky but transformative if it succeeded, while saying plainly he was not telling anyone to buy it.

What counterfeiting flaws has Zcash fixed?

Zcash has fixed two known counterfeiting flaws, and the way each was handled was very different.

	2018 flaw	2026 flaw
Found by	Ariel Gabizon, cryptographer at the Zcash company	Taylor Hornby, researcher at Shielded Labs
Found on	March 1, 2018	May 29, 2026
Where	Proof system Zcash launched with	Orchard pool circuit, present since 2022
Fix	Upgrade in October 2018	Emergency upgrades within days; new Ironwood pool on July 28, 2026
Disclosure	February 2019, about 11 months after discovery	Patched publicly within days
Evidence of use	Team said none found	Analysis found none, but cannot prove certainty

The 2018 story explains a mystery. In September 2018, Peter Todd publicly criticized the ceremony and complained that files needed to fully check it were unavailable. According to the video, the team had quietly removed those files with a cover story that they were lost, because anyone holding them could have exploited the flaw.

In 2019, Zcash added a rule nicknamed the turnstile, which stops more coins leaving a shielded pool than went in. That protects total supply, but it cannot stop fake coins being created inside a pool.

For the 2026 flaw, the old Orchard pool was closed to new deposits so coins could only leave it, under a stricter check. The video notes that the Orchard balance grew steadily over four years, which suggests nobody was quietly draining it.

How did Zcash remove the trusted setup?

A 2019 breakthrough called Halo made it possible to build these proofs without a trusted setup. The lead researcher, Sean Bowe, described stumbling on the technique and, over about 24 hours, realizing it removed the need for a ceremony. He is a high school dropout, a detail the video highlights.

On September 10, 2019, Zooko announced the team was exploring Halo. On May 31, 2022, the NU5 upgrade went live with the Orchard pool, which needed no trusted setup. A second ceremony had been run in 2018 with far more participants, but as one speaker put it, people may not trust a setup “even if there’s a million people.” Still, as the 2026 flaw showed, setup-free math can have bugs too.

How does Zcash privacy compare with Bitcoin and Monero?

The main difference is whether privacy is off, always on, or optional.

Coin	Privacy model	Video’s analogy
Bitcoin	Public by default	Glass walls
Monero	Always private	Blackout blinds
Zcash	Optional: transparent or shielded addresses	Curtains you can open or close

Supporters say optional privacy gives users a choice. Critics say it means fewer people use the private side.

Privacy coins also make regulators nervous. In 2018, under pressure from Japan’s financial regulator, the exchange Coincheck delisted Zcash and other privacy coins. On the other side, a 2020 RAND study commissioned by the company behind Zcash found only about 1% of dark web listings that took crypto accepted Zcash, far behind Bitcoin and Monero.

Three lessons for any coin you hold

The video closes with a framework that applies well beyond Zcash.

1. Every coin rests on some kind of trust. With Bitcoin, you trust that no single group controls most of the mining. With many newer coins, you trust a company, a foundation or a handful of validators. Ethereum ran its own setup ceremony in 2023 with more than 141,000 contributors, relying on the same one-honest-participant idea.
2. Public by default is a design choice. Know which model your coin uses and what it means for how exchanges and regulators treat it.
3. Watch how a project handles its weak points. Zcash kept one flaw quiet for 11 months and patched another within days. You can read that as a warning sign or as a team that finds and fixes its own bugs.

The exercise: pick one coin and ask what would have to go wrong for it to fail, and who could stop it, change it or print more of it. If you cannot answer, that is your homework.

What to watch next

For Zcash holders, the practical points to follow are how the Ironwood pool performs, whether any further review of the old Orchard pool emerges, and how exchanges and regulators continue to treat privacy coins. For every other holding, the question from this story still applies: know what your coin’s security depends on, and check how its team has handled problems in the past.