Equihash algorithm: the Zcash network, ASIC miners and specs

Equihash is a proof of work algorithm built not on grinding through hashes but on the generalised birthday problem. The miner is not looking for a number with a given count of leading zeros; it is looking for a set of values whose XOR sum equals zero. The authors, Alex Biryukov and Dmitry Khovratovich of the University of Luxembourg, presented the paper at the NDSS conference in 2016.

Hence the unfamiliar unit of measurement. Performance of machines on Equihash is measured not in hashes per second but in solutions, Sol/s, and in practice in thousands of solutions, kSol/s. One solution is the result of a full pass of the algorithm rather than a single hash function call, so putting these numbers next to the terahashes of SHA-256 does not work under any conversion.

Equihash was meant to be an algorithm bottlenecked by memory bandwidth, which would deny dedicated chips their advantage. It did not turn out that way. First researchers showed that the algorithm has no proven bound on time memory tradeoff resistance, and then, in 2018, Bitmain simply shipped an ASIC. Today the Zcash network is mined entirely on ASICs, and the asic.es catalog holds 6 Equihash models from two manufacturers.

In Bitcoin the task reads like this: pick a nonce so that the header hash lands below the target. In Equihash the task is a different one: find a set of 2 to the power of k distinct indices whose corresponding hashes XOR to zero. That is what the generalised birthday problem means, and it is solved with Wagner algorithm.

The work runs in two stages. First the miner builds a large list of hashes, for Zcash that is millions of entries, and holds it in memory. Then the list is repeatedly merged with itself: each round keeps only the pairs that match on the next chunk of bits. There are exactly k rounds, and by the last one the sets that sum to zero remain. Each such set is a solution, a Sol.

The parameters n and k set the shape of the task. Raise n and the memory requirement grows. Raise k and memory falls while verification time grows. Zcash has used Equihash(200,9) since launch and has never changed the parameters. Other networks picked sets of their own, and that matters: a machine built for 200 and 9 physically cannot mine a network on 144 and 5.

Verification, meanwhile, is cheap: a node only has to recompute 512 indices and confirm the sum is zero. The asymmetry between expensive search and cheap verification is exactly what the algorithm was created for.

1. Block headerVersion, previous block hash, roots, time, target, nonce
2. List constructionMillions of hashes are generated into memory from the header and a counter
3. k merge roundsEach round keeps the pairs matching on the next chunk of bits
4. SolutionA set of 512 indices with a zero XOR sum, that is one Sol
5. Comparison with the targetSolution hash below the target means a block, otherwise a new nonce

• 2016Alex Biryukov and Dmitry Khovratovich present Equihash at the NDSS conference. The intent: an algorithm where the bottleneck is memory, not arithmetic.
• 2016On 28 October the Zcash network launches on parameters 200 and 9. For the first four years 20 percent of the reward goes to the founders.
• 2018Bitmain ships the Antminer Z9 mini and Z9. The ASIC resistance idea finally stops working and graphics cards leave the algorithm.
• 2019In December the Blossom upgrade halves block time, down to 75 seconds, and halves the reward with it.
• 2020On 18 November comes the Canopy upgrade: the first halving and the end of founder payouts. A development fund takes their place.
• 2022In May the NU5 upgrade starts the shielded Orchard pool on the Halo 2 proof system, which removes the need for a trusted setup ceremony.
• 2024On 23 November the second halving arrives together with the NU6 upgrade. The block reward falls to 1.5625 ZEC and organisation funding is replaced by grants and a reserve.
• 2026In June a bug dating back to 2022 is found in the proof scheme of the Orchard pool. The network closes it with an emergency soft fork and the NU6.2 upgrade within a few days.
• 2026On 28 July comes the Ironwood upgrade: the old shielded pool is closed for good and a new one starts. Withdrawal from the old pool is capped at the provably deposited amount.

All 6 Equihash models in the catalog, sorted by efficiency with the best on top. Performance in kSol/s, efficiency in joules per thousand solutions. Click a name to open the profitability calculator for that model.

There is no custom firmware for Equihash. AsicBoost firmware is built for SHA-256 boards, on Scrypt it covers two models, and the Z series and the A9 line are not on that list. Network installation through HashCore Toolkit belongs to those same supported lines.

The same holds for third party developers. None of the known alternative firmware projects for Antminer claims support for the Z15, the Z15 Pro or Innosilicon machines: their lists carry only SHA-256 and two Scrypt models. The whole custom firmware market is concentrated on Bitcoin hardware, because the installed base there is orders of magnitude larger.

One more warning about a common piece of misinformation. A number of marketplaces publish articles along the lines of "install alternative firmware on a Z15 and get 460 kSol/s instead of 420". That directly contradicts the official supported hardware lists of the firmware developers themselves. Files of unknown origin from marketplaces and auctions do not belong on your machine: the risk of a brick and a voided warranty is real.

The practical conclusion. Efficiency in J/kSol is fixed at the moment of purchase and does not improve afterwards. It has to be calculated before the deal, not after.

Income on Equihash is set by Zcash network difficulty, the ZEC exchange rate and your efficiency in J/kSol. As on Dash, the miner does not get the whole block reward, and that detail is often missed.

Since the NU6 upgrade of November 2024 the reward splits like this: 80 percent to the miner, 8 percent to community grants and 12 percent into a reserve whose spending is decided by coin holder votes. The full block reward is 1.5625 ZEC, so the miner gets 1.25 ZEC. The next halving is expected in November 2028.

Zcash block time is short, 75 seconds, so there are many blocks per day and pool payouts come in evenly. The ZEC rate, on the other hand, has historically moved far harder than most coins: through the autumn of 2025 it rose several times over, and in the summer of 2026 it dropped sharply on news of a technical problem in the network. Calculate payback on current numbers with room to spare, not on the peak of the chart.

Open the profitability calculator →

Efficiency of Equihash machines is measured in joules per thousand solutions, J/kSol. These are not hashes and not terahashes: one solution is the result of a full pass of the algorithm. Comparing J/kSol with the J/TH from the SHA-256 pages or with the J/GH from the X11 page is not valid under any conversion. The comparison only makes sense within Equihash.

Inside the algorithm the spread is moderate by the standards of other pages, but still noticeable. The Antminer Z15 Pro needs 3.15 J/kSol, the Z15 needs 3.6, and the whole Innosilicon lineup together with the Antminer Z11 sits in a band from 10.5 to 12.92. Between the leader and the bottom row the difference is a little over four times.

The arithmetic goes like this: multiply efficiency by performance in kSol/s to get draw in watts, divide by 1000 to get kilowatts, multiply by your tariff and by 720 hours a month. Compare that sum with the mining forecast in the calculator, remembering that the miner gets 80 percent of the block reward, not all of it.

Check the network parameters, not just the algorithm. The word Equihash on a coin page means nothing on its own. A machine built for 200 and 9 mines Zcash but does not mine Bitcoin Gold or Ycash. That is the first thing to establish before buying.

Look at J/kSol, not at kSol/s. Performance tells you about speed, efficiency tells you about the power bill. Between the Z15 Pro and the Antminer Z11 the efficiency difference is more than threefold at comparable draw.

Work out whether you need a full rack. The Z15 Pro takes about 2.6 kilowatts, its own breaker and an exhaust setup. The Innosilicon A9 ZMaster gets by on 620 watts, which is a fundamentally different siting scenario.

Accept that there will be no new models. The last Equihash machine came out in 2023. There is nothing to plan a fleet refresh around two years from now.

Do not count on firmware. On Equihash there is nothing to improve. Factory numbers are your numbers for the whole time you own the machine.

Budget for volatility. The ZEC rate moves harder than the market average. A payback calculation that only works at the peak price does not work at all in practice.

Confusing Sol/s with hashes per second. These are different quantities. One solution is a full pass of the algorithm. Converting kSol/s into megahashes is pointless; you get a number with no physical meaning.

Assuming any Equihash network will do. Networks use different n and k, and a machine for 200 and 9 will not mine 144 and 5. These are different algorithms, not different settings of one.

Counting income on the full block reward. The miner gets 80 percent of 1.5625 ZEC, that is 1.25 ZEC. The rest goes to grants and into the network reserve.

Believing overclocking promises for the Z15. Articles about alternative firmware for the Z15 contradict the official support lists of the firmware developers themselves. That is marketplace marketing, not a working solution.

Buying an A9 because it is cheap. The A9 line spends more than three times the energy of a Z15 Pro on the same work. What you save on the purchase goes into the bills of the first few months.

Ignoring the regulatory backdrop. Zcash is classed among assets with privacy features, and European rules for such assets are tightening. This affects not mining itself but where and how you will be able to sell what you mine.