How Zcash mines a private block

Auto-advance Speed 1× Show full nodes Read how it works

Time is compressed: a 75-second block takes about nine seconds here at 1×. Click a step on the right, or use the arrow keys, to jump to it.

Entering the mempool

transparent: amounts and addresses public shielding or unshielding: crosses the boundary fully shielded: encrypted, with a proof Equihash work, and a block just found proofs and nullifiers check out, on the chain double spend refused a real block, found by that pool inner ring: mining pools, by share of recent blocks

A transparent transaction works like Bitcoin's: everyone sees the addresses and amounts. A shielded one carries encrypted notes and a zero-knowledge proof that the sums add up and the sender may spend them. Both spread to every node's mempool.
Each miner builds a candidate block of up to 2 MB. It sees every fee, which follows a flat rule of 5,000 zatoshi per input or output (10,000 minimum), but not what a shielded transaction moves or to whom. It doesn't need to.
For each 32-byte nonce a miner solves Equihash, a memory-hungry puzzle with about two answers per try, then hashes the header with its answer. The block counts only if that hash is below the target. Nonce 0000000000000000…, 0 solutions tried. Bigger miners win more often, in proportion to their work.
The winner broadcasts the block and every node passes it on. The target is retuned after every block, from the last 17 blocks' timing, so blocks keep arriving about every 75 seconds whatever the hashrate does.
Each node checks the Equihash answer and the work, then every proof. Each shielded spend reveals a nullifier, a tag only that note can produce; one already in the set means a double spend, and the block is rejected. New note commitments join a Merkle tree that future proofs point to.
Each block creates 1.5625 ZEC: 80 % to the miner with the fees, 8 % to Zcash Community Grants and 12 % into a lockbox that coinholders direct. Each block on top is one more confirmation; wallets usually wait for ten, about 12 minutes.

Live mode shows blocks and mempool transactions as zecstats.org's indexer reports them, about a minute behind, with each transaction's type. Proof checks and the tree are drawn, not observed. Pick any step to study it in step-by-step mode.

Where the ZEC is Loading pool balances

How this is counted

Every node keeps a running total of the ZEC in each pool, so these balances are exact even though shielded amounts are hidden. Orchard has been closed to deposits since July 2026 and empties into Ironwood; Sprout only drains. The lockbox is the 12 % of each block reward held back for coinholder-directed grants. The figure in brackets is the change over 30 days.

Transactions per block Waiting for the first block

fully shielded
shielding or unshielding
transparent
not broken down

Block chain 0 tx in the mempool 0 GSol/s 0 % of ZEC shielded 0 ZEC in the lockbox 0 blocks to the halving

The parts that make this work

Proof of work with Equihash

Zcash is a Bitcoin-style chain: miners compete, the heaviest chain wins, and nobody is in charge. The puzzle is different. For each attempt a miner takes the block header and a 32-byte nonce and solves Equihash with parameters 200 and 9, a generalised birthday problem that needs a lot of memory to solve and almost none to check. The 1,344-byte answer goes into the header, and the block is valid only if the double SHA-256 hash of that header falls below the target. Equihash was meant to keep mining on graphics cards, but dedicated machines have done most of it since 2018. In late September 2026 the network found roughly 28 billion solutions a second (28 GSol/s).

A new target every block

Bitcoin retunes every two weeks; Zcash retunes after every block. Each node averages the targets of the last 17 blocks, compares how long they took with the 17 × 75 seconds they should have, damps the correction to a quarter, and caps it at 16 % harder or 32 % easier per block. Timestamps are taken as medians so a miner can't game the clock. The block time itself was 150 seconds until the Blossom upgrade halved it in December 2019. The difficulty at the start of October 2026 was about 236 million.

Transparent and shielded

Zcash runs two systems side by side. Transparent addresses (starting with t) work like Bitcoin's: inputs, outputs and amounts are public. Shielded pools keep value in encrypted notes. Spending one means publishing a nullifier and a fresh note commitment, plus a zk-SNARK proving the note exists in the tree, the spender holds its key, and inputs equal outputs plus the fee, without saying which note, whose, or how much. A transaction can mix both: moving ZEC from a t-address into a pool is shielding, and back out is unshielding. In the forty blocks before October 1, 2026, a little over half the transactions were transparent, three in ten shielded or unshielded, and one in eight was fully shielded; about 29 % of all ZEC sat in shielded pools.

Nullifiers and the note commitment tree

When a shielded output is created, only a commitment to the note goes on chain, appended to a Merkle tree with room for 2³² notes. To spend it later, the wallet proves its note is somewhere under a recent tree root, the anchor, without saying where. That alone would let a note be spent twice, so each spend also reveals a nullifier, derived from the note and the owner's key. Nobody can link a nullifier to its commitment, but each note has exactly one, so every node keeps the set of nullifiers seen so far and rejects any transaction or block that repeats one. The animation draws the newest sixteen leaves of the tree.

Sapling, Orchard, Ironwood and Halo 2

Sapling (2018) uses Groth16 proofs, which needed a multi-party setup ceremony: the system is sound as long as one participant destroyed their secret. Orchard (May 2022) switched to Halo 2, which needs no trusted setup at all. In May 2026 a soundness flaw was found in Orchard's circuit that could have allowed counterfeit ZEC; an emergency soft fork on June 2 and the NU6.2 upgrade a day later at block 3,364,600 fixed it. Because nobody could prove the flaw had never been used, NU6.3 (block 3,428,143, July 28 2026) opened a new pool, Ironwood, with the corrected Halo 2 circuit and notes designed to be recoverable after quantum computers, and closed Orchard to deposits. Money can only leave Orchard through its turnstile, which publishes the amount and refuses to let out more than ever went in. Almost nine-tenths had moved by the end of September. Sprout, the 2016 pool, has only drained since 2020.

The block reward and the lockbox

The subsidy halved to 1.5625 ZEC at block 3,146,400 in November 2025, the same block that activated NU6.1, and halves again at block 4,406,400, expected in November 2028. Each block's coinbase pays 80 % of it, 1.25 ZEC, to the miner along with the fees, and 8 %, 0.125 ZEC, to Zcash Community Grants. The other 12 %, 0.1875 ZEC, is never paid out: it accrues in a lockbox that coinholders vote to spend. Those shares run until the 2028 halving (ZIP 1016). Supply is capped at 21 million; about 16.96 million existed at the start of October 2026, and fees are a few thousandths of a ZEC per block.

What's next: NU7 and Crosslink

None of this is live yet. NU7 is targeted for November 5, 2026, with testnet on October 6 and a final go or no-go on October 20. It would cut blocks to 25 seconds while keeping the halving dates, stop accepting version 4 transactions (stranding anything left in Sprout), and start burning part of the fees. Crosslink, a hybrid in which miners keep producing blocks and stakers mark them final, is running on test networks; it has no ZIP or activation height. This page will change when they do.

What live mode shows

Live mode polls the free zecstats.org API about once a minute for new blocks, mempool transactions with their type (transparent, mixed or shielded, and which pools), pool balances, hashrate and the halving countdown; ironwood.live stands in for pool balances if it's down. Blockchair, when its free quota allows, adds the per-block split in the chart, judged from each transaction's transparent and shielded parts, and the pool behind each block, read from the tag it writes into its coinbase; many blocks carry no tag, or only "Mined by" and an account name. Blocks show up as the indexers see them, a minute or so late, and the pool sizes on the inner ring are its share of the last 40 blocks. The full-node ring, the proof checks and the commitment tree are drawn, not measured.

What the animation simplifies

Time is compressed about eightfold. Real miners hash continuously and each builds a slightly different template; the step-by-step miners, their shares and the transaction mix are illustrative, and the double spend is staged far more often than anyone tries one. Equihash solving is drawn as sparks, not as the sorting it really is. Read the Zcash protocol specification, ZIP 258 for Ironwood, ZIP 1016 for the reward split and ZIP 317 for fees.