Project Tachyon Explained: How Zcash Plans to Scale Private Payments

Project Tachyon is a proposed new shielded protocol for Zcash, led by Sean Bowe, designed so that private payments can scale. It targets two costs that grow with usage: wallets scanning every encrypted transaction, and validators storing every nullifier forever. As of October 2026 it is a proposal under development, not a feature you can use.

This guide explains what Tachyon changes and why, based on the project's own posts and the research paper behind it, and it marks what is still unknown.

What is Project Tachyon?

Tachyon is the working name of a ground-up redesign of how Zcash's shielded protocol and wallets interact. It is led by Sean Bowe, a key contributor to Halo 2, and developed in the open: the project publishes a blog, documentation and a GitHub organisation with a proof-carrying-data library (Ragu) and a Rust library for the protocol.

Its stated aim is "encrypted money at planetary scale": keep Zcash's privacy, and remove the parts of the design that make usage expensive for everyone running a node or a wallet. It is not the same as Ironwood, the shielded pool of NU6.3 that is live today; our Ironwood status article explains that one.

What problem does Tachyon solve?

Today's shielded pools, Orchard and the newer Ironwood, have two scaling problems that no amount of faster hardware fully removes.

• Wallets must scan everything. A shielded transaction does not say who it is for, so a wallet tries to decrypt every one to find its own. Bowe's April 2025 post says this "simply does not scale".
• Validators must remember every nullifier. A nullifier is the value published when a note is spent, which prevents spending it twice. Every validator has to keep all nullifiers ever published, so the set only grows. The Tachyon overview describes this as "gigabytes per day even at modest TPS".

The usual scaling tricks from transparent chains do not apply cleanly, because Zcash shielded transactions are meant to be indistinguishable from one another on the ledger.

How Tachyon works, in plain terms

The design combines four ideas. The summary below follows the project's overview and Bowe's posts.

Proof-carrying data

Tachyon is built around proof-carrying data (PCD): a way for data to carry a compact proof that it was computed correctly, so a verifier does not have to redo the work. The project's recursive proof toolkit, Ragu, is a Rust library that aims to realise the recursive zk-SNARK approach of the Halo paper without a trusted setup. Its authors say it is still under construction and will go through rounds of optimisation and auditing before deployment.

Evolving nullifiers

In the research paper "A Note on Notes" (Bowe and Miers, Cryptology ePrint 2025/2031, a preprint), a note's nullifier changes with each epoch. Validators only need to track a recent rolling window of nullifiers. To prove a note is unspent, a wallet shows that none of its earlier-epoch nullifiers ever appeared on chain. The authors claim validators can then prune nullifiers permanently without extra cost to users and without loss of privacy; these are the paper's claims, and the page does not say an implementation exists.

Oblivious synchronization

Keeping that proof up to date means following every block, which a phone wallet does not want to do. In oblivious synchronization, the wallet can outsource this to a remote service that builds the proof from public data, even while the wallet is offline. According to Bowe, the service is not trusted with secrets: it sees only historical epoch and nullifier pairs and "never learns anything about the note". A wallet that prefers to can do the work itself. The same post is candid about a limit: if a service can correlate several nullifiers from one wallet, some linkage remains, and network-level measures such as mixnets are part of the answer.

Out-of-band payments

Today, the secrets a recipient needs travel inside the transaction, encrypted on the blockchain, which is why wallets must scan. Tachyon "fully embraces out-of-band payments": the sender gives the recipient what they need through a separate channel, so the chain no longer carries encrypted ciphertexts for wallets to search. The same change lets Tachyon drop payment addresses and diversified keys from the core protocol, leaving that to higher-level wallet protocols.

Bowe lists the costs openly: the blockchain can no longer act as a place to recover a wallet from its seed phrase, or to hold view-key histories, and public donation addresses do not work in the same way. How wallets will cover this is still being designed; the project says one approach under development, with an outside team, uses private information retrieval and post-quantum key exchange.

What would change for a Zcash user?

If Tachyon is adopted, the sources suggest these effects, all of them dependent on a design that is not final:

• Faster sync for light wallets, because less scanning is needed. A Shielded Labs event description speaks of "near-instant sync", which is a goal without published benchmarks.
• Lower long-term cost for people who run nodes, because validator state would not grow without limit.
• Different payment flows. Sending and receiving would rely on out-of-band exchange between wallets. The shielded address as we know it would be replaced by higher-level wallet protocols.
• Compatibility intent. The overview says existing cryptography is kept so the current ecosystem, including hardware wallets, can keep working.

Tachyon and quantum computers

The topic comes up often next to our quantum resistance explainer. Two separate claims are in the sources. In October 2025 Bowe wrote that shielded transactions already have post-quantum privacy in many common cases, and that removing in-band secret distribution would let Tachyon fully defend on-chain privacy against quantum attacks, because the chain would no longer carry data to harvest. The Tachyon overview is more cautious: it says the decoupling "opens a path" to post-quantum privacy. That is a design direction, not a delivered property. Protecting funds against forgery by a quantum attacker, the balance question, is a different problem handled by ZIP 2005 and Ironwood's recoverability design.

Is Tachyon live, and when will it launch?

No, and no date is published. What the sources say, with dates:

• April 2, 2025: Bowe's first post introduces Tachyon and oblivious synchronization and says he expects many major scalability improvements "should be able to hit mainnet within a year".
• May 15, 2025: "Tachyaction at a Distance" describes the protocol design. It says Tachyon is a reverse-compatible change to the Orchard protocol and could be deployed as an upgrade or as a standalone pool, without choosing.
• November 2025: the "A Note on Notes" preprint appears.
• May to September 2026: project posts describe Ragu, the proof-tree design, and the start of upstreaming Tachyon's recursive proofs into Zakura Common, a new Zcash cryptography stack built with Valar Group. The September 28 post gives no schedule.
• Now: the project's roadmap page says the shielded protocol is still in design, would be tested on a test network after review, would be a new pool separate from Orchard, and would be activated on mainnet once community consensus is reached and the proposal meets Zcash's ZIP requirements. We found no assigned ZIP number for the protocol.

The one-year hope from April 2025 has therefore not turned into a release, and we do not predict a date. Every Zcash network upgrade needs community approval, and you can follow the process on our Network Upgrade Tracker and in the NU7 explainer for the nearest planned upgrade.

What is still unknown

• The final design: how wallets will replace the blockchain as a recovery and messaging layer.
• Whether Tachyon ships as a new pool or an upgrade; the 2025 design post left it open, while the current roadmap page describes a new pool.
• Performance: no benchmarks, throughput or size figures for Tachyon itself were published in the pages we read. Claims of thousands of transactions per second are goals.
• The trust and privacy details of oblivious syncing services in practice, including how much linkage a service could build from many requests.
• Audit status: Ragu is described as pending optimisation and auditing.
• An activation timeline and the ZIP process.

We will update this guide when any of these change. New articles and data appear first in the ZecZcash Telegram channel.

Sources and methodology

This guide rests on primary material, read on October 12, 2026: Project Tachyon overview and roadmap and its blog; Sean Bowe's posts Tachyon: Scaling Zcash with Oblivious Synchronization (April 2, 2025), Tachyaction at a Distance (May 15, 2025) and Zcash and Quantum Computers (October 16, 2025); the preprint A Note on Notes (Bowe and Miers); and the Tachyon blog posts of May 7, September 28 and September 29, 2026. Several of these pages were only partly readable to us, so statements about parts we could not read are not made. An event page for a Shielded Labs session on Tachyon (March 17, 2026) describes the same goals. Performance figures in marketing coverage were not used. For terms, see our glossary, and for the shielded pools in use today see how Zcash works and our shielded supply data.