Generic custody advice applies to ZEC exactly as it applies to anything else, and it is covered well elsewhere. What is worth writing down is the part that changes because this particular asset has a shielded side, and 3 things do change.
None of them is the risk people expect. The interesting exposures have little to do with the venue failing. They are about what a venue can and cannot do with an asset built to be private, and about what that leaves you holding when you get it back. Each one is checkable before you deposit, which is the useful part.
What an exchange holds, and what it knows
Start with the position rather than the abstraction. When a venue holds ZEC on your behalf. It holds value in a specific place with specific properties, and that place is almost certainly the visible one. Two facts follow from that, and together they describe something quite different from what most depositors picture.
The protocol sorts every unit of value into an accounting bucket, and one of those buckets publishes everything about the value inside it (source: Zcash Protocol Specification). Value held there has a readable history, a readable destination and a readable amount.
An exchange also knows who you are, because it collected that information before it let you deposit. Our explainer on how exchange custody actually works covers the general arrangement.
Put those two facts together and the position is worth stating plainly. A custodied ZEC balance is transparent value attached to a verified identity, which is precisely the configuration the asset exists to make optional. Nothing about it is a failure or a scandal. It is simply not what a lot of people think they are holding.
Whether that matters depends entirely on why you hold the asset. For exposure to a price, it changes nothing. For any privacy-related purpose, it changes everything, and the change happens on deposit rather than at some later moment.
That timing is the part people miss. There is no later event that undoes it. Once a deposit lands. The venue's records and the chain's records both exist, and withdrawing later does not remove either. Our guide to Zcash shielded pool adoption covers how much of the supply sits on each side, which is the population-level version of the same fact.
Why custodians hold transparent ZEC
The obvious question is why a venue does not simply hold shielded ZEC and give its customers the asset's actual properties. The answer turns out to be technical rather than political, and it is a good deal more interesting than the usual assumption that somebody chose surveillance over privacy.
Large custodians do not keep funds behind a single key. They use threshold signature schemes, where several parties jointly authorize a spend and no individual party can move anything alone. Those schemes are mature and widely deployed. They work on transparent addresses without modification.
They do not work on the newest shielded pool. A developer working on the problem explains why: those systems "work cleanly with transparent addresses" but do not support the newest pool's addresses, "because" its spend authorization "uses re-randomized Schnorr signatures", and generic multi-party systems "don't implement the re-randomization" the pool requires for unlinkability (source: Zcash Community Forum).
That is a real engineering gap rather than an excuse. The privacy property that makes the pool valuable is the same property that breaks compatibility with the standard institutional custody stack.
The same post records the practical consequence in one clause: centralized exchanges "have been narrowing support for shielded deposits specifically". Our guide to Zcash shielded pools covers what the pools are and how they differ.
Worth noticing is what this rules out. If the constraint were regulatory, it would vary by venue and by year. Because it is a signature-scheme incompatibility, it applies to every custodian using the standard stack, regardless of appetite. That makes it more predictable and, for now, harder to shop around.
Deposit and withdrawal support, which is the exit risk
Here is the exposure with no equivalent for an ordinary asset. It is also the one worth thinking about before you deposit rather than after, because the decision it constrains is the decision to deposit and every option after that point is narrower.
A venue decides which kinds of address it will send to. If it supports only transparent withdrawals, every exit from that venue lands in the visible pool. Shielding afterwards is a separate transaction you make yourself. If it stops supporting shielded deposits, funds you intended to move in privately have to arrive visibly instead.
Neither decision is announced as a policy change affecting your privacy. Both are usually presented as engineering scope.
What makes this a genuine risk rather than an inconvenience is that support can narrow after you deposit. The asset you withdraw may have fewer options than the asset you deposited, and the difference is not visible in your balance.
It is worth being precise that this is a choice and not a protocol limit. Shielded support is buildable: the protocol's designers documented an arrangement where an exchange "could generate an incoming viewing key" and run it on a detection node "while the spending key remains on the more secure system" (source: Electric Coin Company). A venue that does not support shielded deposits has decided not to build that, which means the decision can also be reversed.
Why venues restrict a privacy asset in the first place, and what happens when a restriction becomes permanent, is the subject of our guide to venues that have restricted ZEC rather than this one.
Proving reserves for a shielded balance
The third specific risk concerns verification, and it runs in the opposite direction from what most people assume about privacy assets. The problem is not that a shielded balance cannot be proved. It is that proving one works differently enough to change what the proof is worth to you.
The usual method of demonstrating custodial reserves is to publish addresses and sign a message from each, letting anyone read the balances directly from the chain. Our guide to proof of reserves covers how that works in the general case.
That method transfers to transparent ZEC without modification, which is one more reason custodians hold it there.
For a shielded balance the mechanism has to be different, and the protocol provides one. Keys exist that grant visibility without granting the ability to spend, defined in a public proposal covering unified addresses and unified viewing keys (source: ZIP 316). A custodian holding shielded funds can disclose them to an auditor by sharing the viewing key rather than by signing from an address.
The asymmetry worth carrying away is that disclosure becomes a decision rather than a default. Transparent reserves are readable by anyone at any time. Shielded reserves are readable by whoever the holder chose to tell, which means the assurance depends on a disclosure relationship you are not party to. Our guide to Zcash viewing keys covers what each kind of key actually reveals.
None of this makes shielded reserves unverifiable. It makes them verifiable by arrangement instead of by default, and an arrangement can be narrow or stale without anybody announcing it.
What self-custody fixes, and what still sits with you
Moving funds to your own keys is the standard answer, and it genuinely does resolve all three exposures above. It also introduces a different set of problems. Generic advice tends to underplay it, and some of those are specific to this asset rather than shared with every other one.
What it fixes is direct. You choose which pool your value sits in, nobody can narrow your withdrawal options, and no reserve disclosure is required because you hold the asset rather than a claim on it. Our explainer on what self-custody means covers the general shape of that trade.
What it introduces is more specific to this asset than most guides acknowledge. Shielded funds need software that can find them, and that software is a distinct category: the reference libraries publish dedicated interfaces for building shielded light clients (source: zcash_client_backend). A wallet that handles transparent value competently may handle shielded value badly or not at all.
Restoring a shielded wallet also involves a step transparent chains do not have, and getting it wrong makes a correct backup look like a lost one. Our guide to Store Zcash safely covers that procedure, and it is the single most common way people lose access to shielded funds they still technically control.
Comparing what different arrangements actually protect against is the useful exercise here, and our comparison of wallet security models is a better starting point than a slogan.
The honest summary is that self-custody moves you from one failure mode to another. Both are real. Which one you would rather face is a question about your own habits, not about the asset.
What exchange risk leaves open
Four limits are worth stating plainly here, because an article about custody invites conclusions it cannot actually support. Each of the four gets asserted somewhere on the internet as though this kind of analysis established it, and none of them follows.
It is not the same question as whether a venue will keep supporting the asset at all. That is a separate risk with separate causes and our guide to venue restrictions handles it, including what happens when one becomes permanent.
It says nothing about whether the asset is sound. Counterparty exposure is a fact about the party, not about the protocol. A perfectly engineered chain held at a failing venue produces the same outcome as a broken one.
The custody gap has a proposed answer that is not a standard yet. A proposal exists for threshold spend authorization compatible with the shielded design, and its status in the repository index is Draft (source: zcash/zips). Draft means written down and discussed, not deployed and not available, and anyone citing it as a solved problem is overstating it.
And self-custody is a trade rather than an upgrade. It removes counterparty risk completely and hands you operational risk in exchange, which is why the security checklist exists and why account recovery is a live topic for people who chose the other side of the trade. BloFin lists ZEC on spot as well as perpetuals, so a spot balance held there is exchange custody in the sense this article describes, while a perpetual position is not a coin at all.
What venue custody actually means for a privacy asset
Holding any asset at a venue concentrates risk in one place. Holding this one there does something additional, and it is the part that gets missed.
Your balance is an entry in the venue's ledger rather than a position on the chain. The coins backing it sit in addresses the venue controls, pooled with everyone else's. Nothing about your individual holding exists on the chain at all. That is true of every asset at every venue.
What is specific here is that none of the asset's defining features reach you while it sits there. Shielding is something a holder does with keys they control. A balance held by somebody else cannot be shielded by you, and in practice venue balances sit on the public side because that is what the venue's own accounting requires.
So a holder who bought this asset for its privacy properties and left it on a venue has bought exposure to the price and nothing else. That is a legitimate choice if it is a choice. It is a common outcome when it is not.
The second specific consequence is about exit. Venues decide which assets they support and which withdrawal destinations they will send to, and both can change with little notice. For an asset that some venues have restricted, that decision is more live than it is for a major, which makes knowing your exit route ahead of time worth more here than elsewhere.
Four questions worth answering before you leave funds anywhere
Each takes a minute and each removes a way this goes wrong.
Can you withdraw to the address type you actually want? Many venues send only to transparent addresses, which means shielding is something you do afterwards rather than something the withdrawal gives you.
Have you tested a withdrawal at a size you can afford to lose? The first withdrawal to any new destination is the one that finds the mistake, and finding it cheaply is the whole point.
Do you know what happens to the balance if the venue restricts the asset? Restrictions have historically arrived with short notice, and the window to act has sometimes been days.
And is the amount you are leaving there an amount you have decided to leave, or just the amount that happened to accumulate? Most venue balances are the second, which is the version that turns into a loss when something goes wrong.
Why this risk gets underweighted
Three reasons, and they compound rather than sitting side by side.
The first is that venue custody feels like the default rather than like a decision. Funds arrive there when you buy and stay there unless you act, so the risk is taken passively and never gets examined the way an active choice would.
The second is that the failure mode is rare and total. Most of the time nothing happens, which trains people to treat the arrangement as safe, and when something does happen the outcome is not partial. A risk with that shape is systematically underestimated by everyone, not just by people new to this.
The third is that the alternative carries visible costs and the status quo does not. Self-custody means backups, testing, plus a real chance of losing access through your own mistake. Those costs are immediate and concrete, while the venue risk is deferred and abstract, and people trade the second for the first without noticing they are trading at all.
None of that argues for one choice over the other. What it argues for is making the choice deliberately, in an amount you have decided, rather than arriving at it by default.
The exit question, and why it is worth answering early
Every arrangement here eventually ends in one of three ways, and knowing which one you intend removes most of the pressure from the moment it arrives.
You withdraw to a wallet you control. That converts venue risk into custody risk, which is a real trade rather than a removal, and it is the only route that makes the asset's privacy features available to you at all.
You sell. That converts the position into whatever you sold it for and ends the question entirely, which is a legitimate answer that gets treated as a failure state more often than it deserves.
Or the decision gets made for you. A venue restricts the asset, changes its withdrawal destinations, or stops serving your jurisdiction, and the options narrow to whatever remains inside whatever window is given. This is the outcome the other two exist to avoid.
The reason to decide in advance is that the third case has historically arrived with days of notice rather than months, and the people worst affected are consistently the ones who had not thought about it. Writing down which of the first two you intend, and confirming that the route works while nothing is wrong, is a short exercise that removes the whole category.
Frequently asked questions
Is it safe to hold Zcash on an exchange?
It carries the same counterparty risk as holding anything else on an exchange, plus three specific to this asset. Your balance is almost certainly transparent value attached to a verified identity. Your withdrawal options can narrow after you deposit. And the reserve assurance for any shielded holdings depends on a disclosure relationship rather than on public readability. Whether those matter depends on why you hold it.
Does an exchange hold shielded or transparent ZEC?
Transparent, in nearly all cases, and for a technical reason. The threshold signature schemes large custodians use work on transparent addresses and do not support the newest shielded pool's spend authorization, which uses a re-randomized signature scheme that generic multi-party systems do not implement. A proposal addressing this exists and is currently a Draft rather than a deployed standard, so the constraint applies to essentially every custodian using the standard stack today.
Can an exchange prove reserves for shielded Zcash?
Not by the usual method, which relies on publishing addresses and signing from them. For shielded holdings, disclosure runs through viewing keys, which grant visibility without granting the ability to spend. That works, and it changes the nature of the assurance rather than removing it. Transparent reserves are readable by anyone at any time. Shielded reserves are readable by whoever was given the key, which makes the assurance depend on an arrangement you are not part of.
Should I move my ZEC off an exchange?
That depends on why you hold it, and this guide does not answer it for you. Holding for price exposure and holding for the asset's privacy properties are different purposes with different answers. Self-custody removes counterparty risk and adds operational risk, including a restore step specific to shielded funds that people get wrong regularly. Our guide to Store Zcash safely covers what that involves.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources are the Zcash protocol specification, a Zcash community forum post by a developer working on shielded custody, an Electric Coin Company explainer on viewing keys, ZIP 316, the zcash_client_backend crate documentation, and the ZIP repository index. All facts independently verified against cited documentation current as of August 2026. what follows covers custody and counterparty exposure; venue restriction policy, reporting obligations and self-custody procedure belong to the articles that own them, and no venue other than BloFin is named.