On the linkability of Zcash transactions
jeffq.com
jeffq.com
This lines puts the whole thing in perspective.
The other privacy oriented coin - Monero didn't have a web or GUI based wallet for a long time.
This whole privacy aspect provides an interesting problem - most of the exchange volumes are off chain to allow faster movement. So you send coins to the exchange, it gets added to the larger pool ie cold/hot wallet, you trade and if you cash out exchange deducts money and then you see your coins on the wallet.
Now the only way you are sure that exchange has the coins is by looking at the cold/hot wallet address. If not, the coins can simply be "numbers" on an exchange.
Privacy focused coins means there is no provable way to see if the exchanges have the coins.
Sure, exchanges can engage in some form of "auditing" but for that access to the whole system is required.
The weird was-it-or-wasn't-it-surveillance during The Ceremony [1] is terribly odd IMO. But none of it could have ever occurred if ZCash were designed to be trustless.
I seriously wonder whether the algorithms used for ZCash or Monero or your-favorite-altcoin-with-a-new-signing-alg have enough runtime/experience to be trusted with their market cap. I'm optimistic about Monero at least, but TBH I don't have much research or evidence on my side.