Zcash Developers Target January for Quantum-Resistant Payments After Security Scare

Zcash (ZEC) developers are planning to introduce quantum-resistant security features within the coming months, as concerns about AI-assisted attacks put the long-term safety of cryptocurrency wallets under renewed scrutiny. The proposed upgrade focuses on public payments, which account for roughly 70% of ZEC in circulation. A separate wallet tool is also being developed to prevent balance inquiries from exposing links between addresses.

“ Our team plans for post-quantum signature opcodes to land in Zcash in January,” Roman Akhtariev wrote in an engineering update for Zakura, a software implementation used to operate the Zcash network and validate transactions.

The proposed opcodes would enable the network to verify hash-based signatures, a payment authorization method designed to resist attacks from quantum computers. January is the development team’s target, although no definitive date for activating the upgrade across the network has been announced.

The objective is to prevent attackers from exploiting publicly visible keys to derive private keys, forge transaction approvals and steal funds.

The upgraded software would verify signatures using cryptographic hashes, which act as digital fingerprints generated from secret information. Unlike conventional wallet signatures, hash-based signatures rely on a different mechanism for proving authorization.

An attacker attempting to forge a transaction would need to overcome the underlying hash security. As a result, a breakthrough that compromises existing wallet keys would not necessarily defeat the proposed replacement.

Using new addresses helps keep public keys concealed before funds are spent. The planned signature system is intended to provide additional protection when spending a transaction reveals the authorization key.

The development announcement follows a warning from Ethereum researcher Justin Drake, who urged cryptocurrency holders on Thursday to prepare for a potential “bunker mode.” He cautioned that, under a worst-case scenario, AI could help uncover a way around the mathematical protections securing Bitcoin and Ethereum wallets “in months, not years.”

Ethereum’s broader transition to quantum-resistant cryptography currently targets December 2029. However, no practical attack capable of breaking the cryptographic keys used by these wallets has been demonstrated.

ZEC closed Thursday near $1,185, falling approximately 11% over the previous seven days. The token led losses among major cryptocurrencies after Drake’s warning gained widespread attention on X.

Read more: Bitcoin and ether holders urged to prepare ‘bunker mode’ against possible AI attacks.

Fresh addresses and the privacy risks of balance checks

Zcash supports two types of transactions. Shielded payments conceal the sender, recipient and transaction amount, while transparent payments function more like Bitcoin (BTC), leaving addresses and transaction values visible on the blockchain.

According to CoinDesk’s calculations based on ZecStats data, approximately 11.96 million of the 16.98 million ZEC issued were held in the transparent pool on Thursday. That represents roughly 70% of the total supply, making the public portion of the network the primary focus of the January proposal.

Cryptocurrency wallets use private keys to authorize transactions and corresponding public keys to verify those approvals. Deriving a private key from its public counterpart is designed to require an impractical amount of computing power. Drake’s concern is that a technological breakthrough could eventually make such attacks economically feasible.

A standard transparent Zcash address initially conceals its public key behind a cryptographic hash that is difficult to reverse. When funds are spent, the public key becomes visible. Transferring the remaining funds to a newly generated address places them behind a different key that has not yet been exposed.

However, checking the balances associated with multiple fresh addresses can introduce another privacy problem.

For example, someone distributing their holdings across 10 addresses still needs to retrieve the balance of each one. A conventional wallet may send these requests to a server, potentially allowing the service to associate addresses that otherwise appear unrelated on the blockchain.

Zakura’s lookup tool uses a technique called private information retrieval. This approach allows a database to return requested information without revealing which specific record the user is accessing.

With this method, a wallet can retrieve its balances without giving the server a readable list of its addresses. The underlying transactions remain publicly visible, but the balance-checking process reveals less information about which addresses belong to the same user.

An experimental implementation is already available through the “Private queries” setting in the Vizor Zcash wallet.

The shielded portion of Zcash requires additional safeguards, however. The project’s quantum-recovery design warns that an attacker who obtains a recipient’s address could store encrypted payment records now and attempt to decrypt them later if a future mathematical breakthrough makes that possible.

About The Author

ctleditor

See author's posts