Pinned Tweet
Introducing Epoch, Shielded Labs’ new research and engineering project focused on hardening Zcash from future threats:
AI-powered hackers
Quantum Computing risk
Adversarial governments
We plan to achieve this through formal verification of critical code and by deploying ography.
Epoch will ensure Zcash remains designed for the threats we face today and for whatever comes next. ⤵️
AI-powered hackers
Quantum Computing risk
Adversarial governments
We plan to achieve this through formal verification of critical code and by deploying ography.
Epoch will ensure Zcash remains designed for the threats we face today and for whatever comes next. ⤵️
6
33
148
8,499
Shielded Labs retweeted
I’m confused by the outrage from certain people around Crosslink. At this point, it’s an R&D effort. There’s no activation proposal or ZIPs, and it isn’t on the mainnet roadmap. It’s a prototype design that we’re testing and iterating on.
Research and experimentation are good for Zcash. Permissionless innovation means people can explore ideas without first securing everyone’s agreement, and the Zcash community should encourage that. Good-faith debate is how Zcash improves, and we welcome scrutiny of Crosslink’s design, assumptions, and tradeoffs.
We’re working on Crosslink because we think stronger protection against reorg and rollback attacks may be a necessary security upgrade for Zcash at some point. AI or other forces could eventually challenge the security assumptions behind PoW, and our thesis is that a hybrid model may offer stronger security than either pure PoW or pure PoS.
Shielded Labs’ mission is to protect the long-term security of Zcash. It’s a common theme across all our projects, including Crosslink, the Network Sustainability Mechanism (NSM), and Epoch. We also demonstrated that commitment by bringing on Taylor Hornby as a security researcher to use AI tools to identify potential vulnerabilities, which uncovered the Orchard counterfeiting bug. We want to address potential risks before they become urgent, and recent events have shown the value of being forward-looking.
The burden of proof is on us. If we want Crosslink included in a future network upgrade, it’s our responsibility to demonstrate consensus. But that’s still a long way off. For now, we’re focused on improving the design, incorporating user feedback, and working toward a production-ready implementation for the community and coinholders to evaluate.
There’s still a lot of work to do before we’d propose Crosslink for mainnet, and we plan to run it on testnet for an extended period of time. If you disagree with Crosslink, challenge the design and help us understand what we’re missing. We all want Zcash to succeed. Let’s focus on strengthening and protecting Zcash as a whole by giving research and experimentation room to happen.
If you're interested in learning more about Crosslink or participating in the incentivized testnet, feel free to DM me.
Research and experimentation are good for Zcash. Permissionless innovation means people can explore ideas without first securing everyone’s agreement, and the Zcash community should encourage that. Good-faith debate is how Zcash improves, and we welcome scrutiny of Crosslink’s design, assumptions, and tradeoffs.
We’re working on Crosslink because we think stronger protection against reorg and rollback attacks may be a necessary security upgrade for Zcash at some point. AI or other forces could eventually challenge the security assumptions behind PoW, and our thesis is that a hybrid model may offer stronger security than either pure PoW or pure PoS.
Shielded Labs’ mission is to protect the long-term security of Zcash. It’s a common theme across all our projects, including Crosslink, the Network Sustainability Mechanism (NSM), and Epoch. We also demonstrated that commitment by bringing on Taylor Hornby as a security researcher to use AI tools to identify potential vulnerabilities, which uncovered the Orchard counterfeiting bug. We want to address potential risks before they become urgent, and recent events have shown the value of being forward-looking.
The burden of proof is on us. If we want Crosslink included in a future network upgrade, it’s our responsibility to demonstrate consensus. But that’s still a long way off. For now, we’re focused on improving the design, incorporating user feedback, and working toward a production-ready implementation for the community and coinholders to evaluate.
There’s still a lot of work to do before we’d propose Crosslink for mainnet, and we plan to run it on testnet for an extended period of time. If you disagree with Crosslink, challenge the design and help us understand what we’re missing. We all want Zcash to succeed. Let’s focus on strengthening and protecting Zcash as a whole by giving research and experimentation room to happen.
If you're interested in learning more about Crosslink or participating in the incentivized testnet, feel free to DM me.
Crosslink is a proposed hybrid PoW/PoS upgrade for Zcash.
By standardizing staking bonds into incremental powers of 10, observers are prevented from easily inferring individual staking patterns, preserving privacy and maintaining accountability among finalizers.
19
31
136
12,846
It has been 10 years since the elaborate setup ceremony for Zcash's first shielded pool, Sprout.
Since then, Halo 2 rendered the trusted setup obsolete with the launch of the Orchard pool in 2022.
Just this year, the Ironwood pool added formal verification to the shielded pool to ensure balance integrity.
Soon, the next shielded pool with Tachyon will enable a breakthrough in scaling, ensuring Zcash can be used by whoever needs it.
Since then, Halo 2 rendered the trusted setup obsolete with the launch of the Orchard pool in 2022.
Just this year, the Ironwood pool added formal verification to the shielded pool to ensure balance integrity.
Soon, the next shielded pool with Tachyon will enable a breakthrough in scaling, ensuring Zcash can be used by whoever needs it.
8
22
109
4,294
HashSmash Breakthrough
For the first time, a 39-round version of SHA-256 has been attacked faster than brute force.
Dariia Porechna (@FutureDies) found a new collision attack, a way to find two different inputs that produce the same hash. It works on SHA-256 cut down to 39 of its 64 rounds, and it’s about a billion times cheaper than the best previous attack. Within days, other HashSmash solvers including sraiw made it about 90 times cheaper again.
Full SHA-256, which secures Bitcoin, is still safe. Even the improved attack is out of reach for every computer on Earth combined.
Congrats to Dariia and the other HashSmash participants who pushed the result even further: @cyberaxe, @privacymage, @lamb356_, and @geeknik. The attack builds on the method from ePrint 2026/1120 (Li, Zhang, Li, Liu, Qian & Zhu).
For the first time, a 39-round version of SHA-256 has been attacked faster than brute force.
Dariia Porechna (@FutureDies) found a new collision attack, a way to find two different inputs that produce the same hash. It works on SHA-256 cut down to 39 of its 64 rounds, and it’s about a billion times cheaper than the best previous attack. Within days, other HashSmash solvers including sraiw made it about 90 times cheaper again.
Full SHA-256, which secures Bitcoin, is still safe. Even the improved attack is out of reach for every computer on Earth combined.
Congrats to Dariia and the other HashSmash participants who pushed the result even further: @cyberaxe, @privacymage, @lamb356_, and @geeknik. The attack builds on the method from ePrint 2026/1120 (Li, Zhang, Li, Liu, Qian & Zhu).
SHA-256 is not broken, but its security margin lost 1 more round this year:
Last week I found a collision attack on reduced 39-round that improves prior art by over 30 bits and the first differential attack on that round better than generic search on @yukonresearch Hashsmash s on the same method as prior art ePrint 2026/1120 with new insights that first 2 state words could remain free, allowing a critical condition at step 16 rebuilt as a claw-search problem rather than a probabilistic filter. Took days of watching SAT logs, burning cores and arguing with Claude on what's possible to get a result close to generic search.
Since my initial submission, other hashsmash participants sraiw, @cyberaxe, @privacymage, @lamb356_ and @geeknik pushed it down by over 6.5 bits, currently estimated at 118.15 bits. The tree of submissions is hard to follow, so I put the construction, insights and numbers into a blog and am working on detailed technical report.
It's fascinating to see an initial structural observation develop into an improvement in the reduced-round collision frontier within days. AI is now a real aid in cryptanalysis and open collaboration speeds it up.
1
21
78
6,565
Bitcoin, with its 21 million coin cap, is a sustainable store of value.
Ethereum, with EIP-1559, is a sustainable medium of exchange.
Zcash is about to have both. It already has a 21 million cap, and with ZIP-235’s upcoming transaction fee burn, it becomes a sustainable medium of exchange.
Ethereum, with EIP-1559, is a sustainable medium of exchange.
Zcash is about to have both. It already has a 21 million cap, and with ZIP-235’s upcoming transaction fee burn, it becomes a sustainable medium of exchange.
4
25
137
4,660
Big milestone for Shielded Labs: the activation height for NU7 is being set today! The upgrade includes our first major mainnet deployment: the Network Sustainability Mechanism (NSM).
Like Bitcoin, Zcash faces a long-term challenge: how to sustain network security as block rewards decline. The NSM helps address that while preserving the 21 million coin cap.
ZIP-235 removes 60% of transaction fees from circulation, allowing that ZEC to be reissued as future block rewards. ZIP-237 starts that recycling around February 2031.
At current fee levels, that’s only about 210 ZEC per year. This is a modest first step, but we’re optimistic about how new use cases for the NSM could evolve over time and contribute to Zcash’s long-term security.
Like Bitcoin, Zcash faces a long-term challenge: how to sustain network security as block rewards decline. The NSM helps address that while preserving the 21 million coin cap.
ZIP-235 removes 60% of transaction fees from circulation, allowing that ZEC to be reissued as future block rewards. ZIP-237 starts that recycling around February 2031.
At current fee levels, that’s only about 210 ZEC per year. This is a modest first step, but we’re optimistic about how new use cases for the NSM could evolve over time and contribute to Zcash’s long-term security.
5
25
89
6,035
We’ll have a ceremony.
The most secure, most sophisticated cryptographic ceremony that’s ever been performed.
- Zooko
In a few days Zcash celebrates the 10 year anniversary of The Ceremony. Listen to the story as told by @Radiolab radiolab.org/podcast/ceremo…
The most secure, most sophisticated cryptographic ceremony that’s ever been performed.
- Zooko
In a few days Zcash celebrates the 10 year anniversary of The Ceremony. Listen to the story as told by @Radiolab radiolab.org/podcast/ceremo…
4
26
127
3,241
11 days in: HashSmash has 400+ public AI submissions attacking SHA-256, SHA3, BLAKE3 and Poseidon.
See for yourself: HashSma.sh
See for yourself: HashSma.sh
5
7
43
2,455
The people are vigilant to accept only changes that improve Zcash and meet their values.
4
16
82
3,493
RT @zooko: Poseidon is open for business. Get smashing!
HashSma.sh
This is the variant of Poseidon used in Zcash, so we real…
HashSma.sh
This is the variant of Poseidon used in Zcash, so we real…
0
14
0
68
In order to protect an essential value, you have to constantly change.
You have to adapt to meet your users changing needs, and to meet new threats and challenges.
You have to adapt to meet your users changing needs, and to meet new threats and challenges.
4
21
100
2,439
Meet Suyash Bagad(@BagadSuyash)
Suyash recently joined the Epoch Team at Shielded Labs as a Cryptography Engineer.
Suyash joins from Aztec, where he worked on the barretenberg cryptography library and the PLONK family of proof systems, including performance improvements for various cryptographic primitives in ZK circuits.
He holds both a BTech and MTech from IIT Bombay, where his graduate research focused on privacy-preserving proofs of reserves for Monero and MimbleWimble. He is based in Europe.
Join us in welcoming Suyash!
Suyash recently joined the Epoch Team at Shielded Labs as a Cryptography Engineer.
Suyash joins from Aztec, where he worked on the barretenberg cryptography library and the PLONK family of proof systems, including performance improvements for various cryptographic primitives in ZK circuits.
He holds both a BTech and MTech from IIT Bombay, where his graduate research focused on privacy-preserving proofs of reserves for Monero and MimbleWimble. He is based in Europe.
Join us in welcoming Suyash!
6
11
70
2,977
RT @zooko: Worried about quantum computers? Worried about Al breaking cryptography? Join hashsma.sh and help strengthen crypto…
0
50
0
71
The Epoch project was created to stay ahead of threats to crypto.
Zcash has proven this past year how quickly we address challenges with 3 upgrades happening in 6 months. Zcash defenders don’t rest, so that Zcash users can.
x.com/ShieldedLabs/s…
Zcash has proven this past year how quickly we address challenges with 3 upgrades happening in 6 months. Zcash defenders don’t rest, so that Zcash users can.
x.com/ShieldedLabs/s…
Introducing Epoch, Shielded Labs’ new research and engineering project focused on hardening Zcash from future threats:
AI-powered hackers
Quantum Computing risk
Adversarial governments
We plan to achieve this through formal verification of critical code and by deploying ography.
Epoch will ensure Zcash remains designed for the threats we face today and for whatever comes next. ⤵️
7
22
63
2,272
A new Zcash ETF is on the horizon
The Winklevoss twins have filed for a spot zcash:native ETF, seeking a Nasdaq listing under the ticker $WINK
1
3
35
842
Meet Luke Edwards
Luke recently joined the Epoch Team at Shielded Labs as a Cryptography Engineer.
He joins from Aztec, where he worked on the cryptography engineering team from 2022 and most recently served as its technical lead, working on the protocol's cryptographic systems and bringing advanced zero-knowledge techniques into production.
Earlier in his career, he was as a systems engineer at Raytheon and a graduate researcher at Los Alamos National Laboratory. He holds a PhD in Applied Mathematics from the University of Arizona and a BS in Mathematics from Penn State. He is based in the United States.
Join us in welcoming Luke!
Luke recently joined the Epoch Team at Shielded Labs as a Cryptography Engineer.
He joins from Aztec, where he worked on the cryptography engineering team from 2022 and most recently served as its technical lead, working on the protocol's cryptographic systems and bringing advanced zero-knowledge techniques into production.
Earlier in his career, he was as a systems engineer at Raytheon and a graduate researcher at Los Alamos National Laboratory. He holds a PhD in Applied Mathematics from the University of Arizona and a BS in Mathematics from Penn State. He is based in the United States.
Join us in welcoming Luke!
5
6
60
1,515
Introducing HashSmash
HashSmash is a project to accelerate cryptographic research with AI, and to figure out how to keep the internet secure as attackers get stronger.
It focuses on cryptographic hash functions, because devices, networks, software, and blockchains all depend on them. Even with how critical they are, we still don't know which of today’s hash functions will hold up against future attackers, or how to make them stronger.
HashSmash is a contest where humans and AI agents work on that problem together. Four hash functions are in play, and the goal is to show which are weak and which still hold:
SHA-256
SHA3-256
Poseidon
BLAKE3
It's a co-op, PvE effort. Participants are pooling work toward a shared result for the betterment of all. If you want to learn more, visit hashsma.sh.
HashSmash is a project to accelerate cryptographic research with AI, and to figure out how to keep the internet secure as attackers get stronger.
It focuses on cryptographic hash functions, because devices, networks, software, and blockchains all depend on them. Even with how critical they are, we still don't know which of today’s hash functions will hold up against future attackers, or how to make them stronger.
HashSmash is a contest where humans and AI agents work on that problem together. Four hash functions are in play, and the goal is to show which are weak and which still hold:
SHA-256
SHA3-256
Poseidon
BLAKE3
It's a co-op, PvE effort. Participants are pooling work toward a shared result for the betterment of all. If you want to learn more, visit hashsma.sh.
Announcing hashsma.sh! 𝟘 𝟙 ❒ 🔨
Strengthen cryptography with AI.
Cryptography—both current and post-quantum cryptography—depends on hashes. SHA-256? SHA-3? BLAKE3? Nobody knows if they are secure. We're going to find out!
Come help accelerate scientific an open science-acceleration project in collaboration with @yukonresearch, @eigenlabs, @projecteleven, and @ShieldedLabs.
3
6
66
4,208