Short answers, with the real numbers — including the ones that do not flatter us.
Because on a shielded chain, every block spends privacy — and ten blocks a second spend it ten times faster without giving users anything they can feel.
Each block mints a coinbase note into the same tree that users hide in. Coinbase notes are public: anyone can recompute their recipient and value. They make the tree bigger without making it more confusing.
What one second actually buys
The histogram is 1,745 at depth 1, 223 at 2, 31 at 3, one at 4. The deepest this node has ever recorded is 5. Waiting ten seconds puts you beyond every reorg in the chain's history — the same safety margin an exchange buys on Monero by waiting twenty minutes.
The estimator quotes feerate 1.0 for the priority, normal and low buckets alike, at a 1-second ETA. Capacity exceeds demand by enough that there is nothing to bid for. Private payments do not get priced out during a rush.
Cost is per note spent, not per block. Ten times the blocks would not change a user's proving bill by one cycle — it would multiply the per-block verification and state-transition overhead carried by every node on the network.
One coinbase mint per block is the floor the emission schedule imposes. Raising the block rate raises that floor. One block per second keeps the publicly readable share of the anonymity set as low as the design allows.
"Isn't the pool small enough to be trackable?"
Partly, yes — and here is the exact shape of it, because a privacy project that rounds this up is not worth trusting.
What this model gives you that a ring cannot
Most published deanonymisation work against ring signatures attacks how decoys are chosen — their age distribution, their reuse, their correlation with real spends. A zero-knowledge membership proof has no decoys, so that entire branch of research has nothing to grip.
It cannot shrink, and it grows every second whether or not a single user transacts, because mining appends to it. There is no parameter to tune, no hard fork needed to raise a ring size, and no version of the chain where yesterday's privacy gets weaker.
Zcash splits its users across transparent, Sprout, Sapling and Orchard, and each migration resets the set. ZKas has one pool, from genesis, with no transparent tier to leak into and no future migration to dilute it.
Extractable value needs a readable mempool: visible amounts, visible recipients, visible ordering intent. Here a pending transaction exposes none of those. Sandwiching and front-running are not mitigated, they are structurally absent.
Every note is structurally uniform. There is no history to trace, so no coin can be blacklisted, frozen or discounted for where it has been — the failure mode that produces tainted-BTC discounts and frozen stablecoin balances.
On an opt-in chain the choice to shield is itself a signal, and it is the signal surveillance firms actually cluster on. Here there is no choice to observe: the coinbase is shielded, so even miners are in the set by default.
"Why a separate network rather than a layer on Kaspa?"
Because privacy only works if it is mandatory, and you cannot make an existing chain mandatory in retrospect.
What the fork actually bought
Because the block reward is itself a shielded note, the set is fed by hashrate, not only by usage. A new privacy chain normally has to win users before it has privacy. This one accrues a set from the day it starts, which is the bootstrap problem solved backwards.
Forking let us diverge where it matters: block bodies are pruned, the note archive and nullifier set never are. A pruned node still serves complete wallet history from its first sync. Nobody had to keep an archival node alive for users to recover money.
Merged mining means we consume none of Kaspa's block space, none of its fee revenue and none of its hashrate — the marginal cost of the second chain is zero. Two chains that would have fought over one consensus instead compound.
Mandatory privacy, a shielded coinbase, a consensus-enforced append order and a supply turnstile are all things a live transparent chain with real holders cannot adopt without breaking everyone already on it.
We kept the engine. We replaced what a block means.
| Kept from Kaspa, unchanged | Rebuilt for privacy |
|---|---|
| kHeavyHash proof of work — byte-identical. The same ASICs, the same stratum, the same difficulty maths, no miner changes at all. | Every output is an Orchard note. There is no transparent output type on mainnet, and the block reward is minted directly into the shielded pool. |
| GHOSTDAG BlockDAG consensus — parallel blocks, one-second cadence, the ordering rule that makes it work. | A second consensus state machine beside the UTXO set: a note-commitment tree, a nullifier accumulator, and a public supply turnstile. |
| Networking, sync and pruning architecture, the transaction mass and fee model, and most of the RPC surface. | Append order became consensus. Coinbase mint first, then accepted actions in applied order. The tree is position-dependent, so on a DAG the order is the data. |
| The mempool and relay policy, inherited and then tightened for shielded standardness. | The shielded state root sits in the coinbase, committing the parent's state. It is proof-of-work anchored, so a divergence surfaces as a rejected block rather than silent drift. |
| — | Pruning had to diverge. Block bodies are pruned; the note archive and nullifier set never are. The reason is user funds. |
| — | Aux-PoW, so a Kaspa block can carry our work. |
What the rebuild bought, in practice
The shielded root lives inside the coinbase, so it carries the block's proof of work. A client can verify the chain's shielded state without trusting the server that served it, and a divergence shows up as a rejected block rather than as quiet drift nobody notices for months.
The tree frontier is a pure function of the leaf sequence, so replaying history must reproduce a value the node already holds and never learned from the peer. Fabricate, omit, reorder or truncate and it will not match. Peers do not have to be trusted or reputable.
A wallet birthday is placed anywhere in history in a single call using the node's DAA locator, and a second device holding the same seed adopts a twin checkpoint in about thirty milliseconds. Restoring a private wallet stops being an overnight job.
The turnstile is public integers: issued minus fees minus burns. Anyone can pull it from any node and check that the pool has never been drained. Hidden amounts do not have to mean an unverifiable money supply.
Good — and not for a hand-waving reason. The best Kaspa can ship is opt-in privacy, and opt-in is the failure mode we exist to avoid.
Every branch ends well for us
Their pool starts empty and marks its users. Ours is the whole chain. The comparison gets easier to make, not harder, because there is finally a familiar example of the thing we are not.
Same circuit family, same viewing-key model, same note format. Our wallets, SDK, signer and scanning work would largely apply — and we would have years of operational experience running it in production that a fresh deployment does not.
We are merged-mined either way. Their hashrate growth raises the cost of attacking us whether or not a single privacy feature ever lands.
Privacy on Kaspa would be a feature of a transparent asset. ZKAS is a private asset. Those are different instruments with different holders, and one does not absorb the other.
Because Monero settles in minutes and carries nothing but money. ZKas settles in one second and can carry an authenticated public payload alongside a private payment — which is a different product, not a better slogan.
| Monero | ZKas | |
|---|---|---|
| Privacy | mandatory ✓ | mandatory ✓ |
| Hiding model | ring signatures — one spend among 16 today | zero-knowledge membership in the whole tree |
| Settlement | ~2 minutes | ~1 second |
| Fees | small but real, and they rise with load | near zero |
| Mining | RandomX, its own network to secure | merged-mined with Kaspa at zero marginal cost |
| Message channel | no standard encrypted memo | 512-byte memo, encrypted and signature-committed |
| Selective disclosure | view keys, tx proofs | viewing keys, plus keyless third-party payment proofs |
| Supply audit | hard — amounts are hidden end to end | public turnstile integers, checkable from any node |
| Setup assumption | none | none — Halo 2, no trusted setup |
Six things that are impractical on Monero
One second, no fee market, no congestion premium. A private coin becomes usable at a counter, in a vending machine, inside a checkout flow or behind an API call. Two-minute blocks make private money a transfer rail; one-second blocks make it a payment rail.
The 512-byte memo rides inside the encrypted note and is hashed into the signature, so it is authenticated rather than merely attached. Publish the viewing key of a registry address and that memo becomes world-readable while addresses, amounts and wallet relationships stay private. That is enough for an NFT protocol, a marketplace, a public registry or a notarisation service — with no fork, because the mechanism already ships.
Every Kaspa miner can earn ZKAS from work they are already doing, at zero marginal cost. For a privacy asset this is the decisive property: the exchange listing is exactly the chokepoint regulators press, and mining is the one distribution channel that cannot be delisted, sybil-farmed or gated by an on-ramp.
Sub-second settlement at a flat floor fee makes pay-per-call APIs, metered compute and machine-to-machine billing workable — a class of product where a two-minute wait and a variable fee are both disqualifying, and where the payer usually has excellent reasons not to be profiled.
The turnstile is public: issued, minus fees, minus burns, verifiable from any node. A privacy chain normally asks you to take the money supply on faith. This one does not, which is the single most common institutional objection answered with arithmetic instead of argument.
Keyless third-party payment proofs from a send-time disclosure, and proof of reserves by handing an auditor the viewing key of a dedicated seed. Compliance becomes something you grant to one counterparty, rather than something the whole world gets by default.
Four properties. Any three of them exist somewhere already. All four together do not exist anywhere else.
No transparent tier, no opt-in signal, no pool to migrate between. The coinbase itself is shielded, so the set includes everyone from genesis.
About one second, with no congestion market. Fast enough that privacy stops costing the user a waiting room.
An encrypted, signed, selectively discloseable 512-byte channel per action — programmable privacy without a virtual machine.
Merged-mined with Kaspa at zero marginal cost: 50.9 PH/s today, and an acquisition path that does not route through an exchange.
zkas-rusty source at release zkas-v1.0.9.
Full detail: developer documentation · whitepaper · explorer.