The Privacy Stack: What Your Privacy Coins Don't Protect

Start with the coins

You chose Zcash or Monero because you care about financial privacy at the blockchain layer. That's the right starting point. Shielded ZEC transactions use zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) to hide sender, receiver, and amount. Monero transactions obscure the same three fields by default using ring signatures, stealth addresses, and RingCT. On-chain, both coins do real work that Bitcoin does not.

That work stops at the chain. Everything before and around a transaction sits outside what coin privacy protects. Your IP address when you visit the exchange. The email address tied to your account. The password you reused on five other services. The phone or laptop holding your wallet. Those are separate layers with separate tools.

There are other angles to privacy beyond finance: messaging, browsing habits, identity fragmentation, operational security against physical threats. This guide stays narrow. It covers the four layers that matter specifically for holding and transacting privacy coins, and it recommends a specific tool for each.

The stack at a glance

Layer	What it covers	What coin privacy doesn't fix	Recommendation
Connection	Your IP address, DNS logs	Your ISP sees every site you visit before you ever open a wallet	Proton VPN >
Identity	The email on your exchange account	KYC ties your real identity to a permanent email address	Proton Mail >
Credentials	Passwords, 2FA codes	One reused password can cascade into a full account takeover	Proton Pass >
Custody	Private keys	A compromised device is a compromised wallet	Trezor >Ledger as alternative

Why Proton for three of the four layers

The internet has hundreds of VPN reviews and password manager comparisons. This site is not one of them. We recommend Proton across the connection, identity, and credentials layers because it is the only integrated privacy suite that meets our bar on all of them, and because the reasons it meets that bar are independently verifiable.

Swiss jurisdiction. Proton is headquartered in Switzerland, outside the Five Eyes and Fourteen Eyes intelligence-sharing agreements. Swiss privacy law is among the strongest in the world and requires a court order before any user data can be disclosed. Even then, the encryption architecture means there is less to disclose than at US or UK-based competitors.

Zero-access encryption by default. Proton Mail, Pass, and Drive use end-to-end encryption where even Proton cannot read the content. VPN traffic is not logged. This is not a trust-us claim; it has been tested in court. Swiss authorities have compelled Proton to disclose user data on rare occasions, and what Proton could disclose was limited to metadata (login timestamps, IPs where logging was legally required), not content.

Open source and audited. All Proton clients are open source. The company publishes independent security audits of its apps and infrastructure. You do not have to trust Proton's claims; you can inspect the code and read the audit reports.

Non-profit ownership. Proton's primary shareholder is the non-profit Proton Foundation. That matters because privacy companies that take venture capital are eventually pressured to monetize user data. Proton's ownership structure removes that pressure at the corporate level.

One account, one bill. Proton Unlimited bundles VPN, Mail, Pass, Drive, and Calendar under a single subscription. For users assembling a privacy stack from scratch, that reduces both friction and cost relative to buying each tool separately from different vendors.

Connection: what your ISP sees

What: Your internet service provider logs every domain you visit. Those logs are retained, subpoenable, and in many jurisdictions sold to data brokers who aggregate them into behavioral profiles.

Why it matters: Every visit to an exchange, a swap service, a wallet download page, or a research site like this one is visible at the network layer. Coin privacy does not touch this. A shielded ZEC transaction on-chain tells nobody anything, but your ISP's log already shows you were browsing privacy-coin content five minutes before.

How: A VPN routes your traffic through encrypted tunnels. Your ISP sees that you are connected to a VPN provider, not what sites you are actually visiting. The VPN provider's logging policy then determines what record remains. Proton VPN's no-logs policy has been independently audited and tested in Swiss courts. Clients are open source across Windows, macOS, Linux, iOS, and Android.

Identity: the email behind every account

What: Every exchange account, wallet backup, and crypto service signup ties a real email address to your activity. That email is the persistent identifier that follows you across data breaches, subpoenas, and aggregation services.

Why it matters: When an exchange is breached (and they are, regularly), the leaked data typically includes email addresses tied to KYC'd identities and transaction histories. If the email on your Coinbase account is the same one you use for LinkedIn, your name, employer, and crypto activity are now correlatable by anyone who buys the breach data. Using your primary email for crypto concentrates risk at the identity layer.

How: A dedicated encrypted email account for crypto use isolates your financial activity from the rest of your digital identity. Proton Mail uses end-to-end encryption with zero-access architecture, meaning Proton itself cannot read your messages. Recovery addresses and phone numbers are optional, so the account can be as isolated as you want it. Custom domains are supported on paid tiers for readers who want to own the email address itself.

Credentials: the cascade problem

What: Most people reuse passwords across services. When one service is breached, the credentials get tried against every other known service in what is called credential stuffing. For crypto users, this turns a single breach at an unrelated site into a full exchange takeover.

Why it matters: The 2024 Ledger phishing wave, the repeated Coinbase support impersonation attempts, and the long tail of SIM-swap attacks all rely on the same assumption: that an attacker who obtains your email plus a password from a previous breach can reach your crypto. A password manager removes that assumption by generating a unique high-entropy password for every service. If one site is breached, nothing else is exposed.

How: Proton Pass generates and stores unique passwords locally encrypted on your device. The master password is the only one you need to remember, and Proton does not have access to it. The service also includes an integrated 2FA authenticator and hide-my-email aliases, which let you sign up for services with generated email addresses that forward to your real inbox. For crypto account signups, aliases add another layer of identity isolation on top of the Proton Mail recommendation above.

Custody: where your keys actually live

What: Your private keys control your coins. If an attacker gets your keys, they get your coins, regardless of how much privacy you have at the blockchain, connection, or identity layers. A software wallet on a computer or phone puts the keys on a device that also runs email, browsers, and installed applications, any of which can be compromised.

Why it matters: Malware that reads wallet files, clipboard-swap attacks that replace destination addresses, and phishing apps on mobile stores all target software wallets. Hardware wallets isolate the keys on a dedicated device that never exposes them to the host computer. Transactions are signed on the hardware device, and only the signed transaction leaves it.

How: Trezor and Ledger are the two mainstream hardware wallets that support Zcash. Both support ZEC at transparent addresses, and Ledger has publicly committed to restoring shielded ZEC support by Q2 2026. For Monero, both devices work through third-party wallet software rather than natively. We recommend Trezor as the primary choice because its firmware is fully open source, which fits the same verifiability standard we apply elsewhere in the stack. Ledger remains a strong alternative for readers who prefer its ecosystem or have an existing device.

What this stack does not fix

The four layers above close specific gaps around privacy-coin activity. They do not make you anonymous, and honest editorial means naming what remains exposed.

KYC'd exchange data. If you buy ZEC on Coinbase using your real identity, Coinbase has a permanent record linking your name, government ID, and purchase history. No amount of downstream privacy tooling removes that record. Shielding the coins after withdrawal prevents further on-chain tracking, but the original purchase event is fixed.

Transparent transactions. ZEC supports both shielded and transparent addresses. Transparent ZEC transactions are visible on the blockchain like Bitcoin. If your wallet lands ZEC at a transparent address and you never shield it, coin privacy is not engaged. See our shielded vs transparent guide for when each applies.

Legal compulsion. Encrypted content remains encrypted even if Proton receives a Swiss court order. But metadata (account creation timestamps, login IPs where logging is legally mandated, payment records if you paid by credit card) can be compelled. The protection is against mass collection, not against a specific legal process targeting you.

Physical threats. Technical privacy does not protect against coercion, seed phrase theft, or someone with physical access to your unlocked devices. Those are different threat models that require different defenses.

Starting points by situation

You do not need to deploy all four layers at once. Pick the most exposed layer for your situation:

New to privacy coins. Start with jurisdiction-specific buying guides to understand what is available where you live, then add a VPN and a hardware wallet. Email and password manager can wait until you have an active crypto presence.

Active user on a regulated exchange. The identity layer is your highest exposure. Migrate your exchange email to a dedicated Proton Mail account, then deploy Proton Pass to fix credential reuse. VPN and hardware wallet next.

EU user facing MiCA delistings. Read the MiCA delisting survival guide first for the immediate action steps, then layer the privacy stack around the self-custody and swap workflows that guide recommends.

Common questions