In other words, what does ZKP brings on top of the practice of not reusing addresses?

From my research, ZCash is currently a state of the art example of ZKP application, but what extra benefits does it bring to the scenario where let's say a bitcoin holder created new addresses for each tx it was receiving and not reusing when spending it? Also assuming everyone in the network does the same.

How this situation is different from a network where all users use ZCash's shielded txs?

  • $\begingroup$ This isn't really a cryptography question. Consider the scenario where someone (e.g. an exchange) sends you funds at a fresh (non-reused) address, and you spend those funds at a store. Then, that store is hacked, and all incoming transactions (to the store) are leaked. The exchange can now see which of its customers spent funds at that store. If it's a KYC exchange, that means they also know your personal details. If the exchange is also hacked, now the public knows where you shop too. This is why untraceability is important, so that your privacy does not rely on the opsec of others. $\endgroup$
    – knaccc
    Apr 8, 2023 at 15:08

1 Answer 1


Every Bitcoin transaction has inputs and outputs. In a simple transaction you might take a single transaction input and create two outputs: one to the receiver and one to your new address. Each of the inputs can be traced all the way back to the genesis of the coins (when they were mined). So for each input you can create a graph of addresses that "touched" the coins.

By creating new addresses for every transaction you have a pool of addresses that are associated with you. Importantly if any one of these addresses are associated with your identity all others can be associated with some degree of certainty.

For example, if you send me a transaction I can see the input that was spent (from the sending address), and I can see all the transaction outputs. If there are only 2 outputs (one to me, one to you) I can determine the new address you're using, and see when it sends a transaction, and to where. The new addresses you create don't give you anonymity, they reduce the statistical certainty that you control assets based on how far they are from an address associated with you.

With ZKP it's not possible to construct a graph of addresses that touched inputs using network data. The transaction inputs are not publicly revealed, instead a nullifier is created in ZK for each transaction input and revealed. The transaction is valid if the nullifiers have not been seen before. It's not possible to determine what inputs have or have not been spent.

There are other attacks that apply to both schemes such as looking at wallet specific transaction formatting/metadata or transaction origin ip, but these are not inherent to the protocols.


Not the answer you're looking for? Browse other questions tagged or ask your own question.