Zcash
on KeepKey.
Orchard shielded transactions on hardware. Send, receive, shield, and unshield ZEC — spending keys never leave the device. Built for auditors and early testers.
What's included
Full Orchard privacy.
Hardware-grade keys.
The Zcash module ships as a standalone Rust sidecar bundled inside Vault Desktop. Vault owns USB; the sidecar handles proofs, sighashes, and chain scanning.
Orchard shielded pool
Shield transparent ZEC into the Orchard pool, send shielded-to-shielded, or unshield back. Halo2 proofs constructed by the sidecar; device signs the sighash.
Spending keys never leave hardware
Only the full viewing key is stored locally. The spending key is derived and used exclusively inside the KeepKey — no software path to extract it.
Transparent + shielded addresses
Receive on a standard t1 transparent address or a unified Orchard address (u1…). Both are verified on the device OLED.
Light-client scanning
Connects to lightwalletd over gRPC+TLS. Scans compact blocks to find and decrypt notes belonging to your FVK. Balance and history surfaced in Vault.
Shield / Unshield
One-click flows to move funds between the transparent and Orchard pools. ZIP-317 fee math applied automatically.
Open source audit surface
59 tests covering ZIP-244 sighash, ZIP-317 fees, Orchard tree building, and full v5 transaction round-trips. Standalone repo for auditors.
Last step
Enable the
feature flag.
After flashing the firmware and loading a seed, open Vault Desktop and go to Settings → Feature Flags. Toggle on Zcash Shielded Privacy.
A Zcash asset tile will appear in your asset list and the full Zcash tab — Receive, Send, and Privacy — becomes available.