The plan concerns public payments, where about seven in 10 ZEC sit. A separate wallet tool would keep balance checks from revealing which addresses belong together.
Developers of privacy-focused Zcash (ZEC) plan to add protections designed to withstand quantum computers within months as warnings about AI-assisted attacks put the broader security of cryptocurrency wallets under scrutiny.
“Our team plans for post-quantum signature opcodes to land in Zcash in January,” Roman Akhtariev wrote in an engineering post for Zakura , one of the programs used to run the Zcash network and validate its transactions.
Those opcodes, or instructions, would give Zcash the ability to check hash-based signatures, a method of approving payments designed to resist quantum attacks. While January is the team’s target, no confirmed network activation date was mentioned.
The aim is to prevent attackers from using today’s public keys to work backward to forge a wallet owner’s approval and spend their coins.
The upgraded software would produce a signature that the network checks using hashes, digital fingerprints made from secret data. Hash-based signatures use a different way to prove permission to spend.
Forging an approval would require defeating those hashes, so a breakthrough against today’s wallet keys would not automatically defeat the replacement.
Using fresh addresses keeps keys hidden before spending, and the proposed signatures are intended to protect the payment when spending makes its approval public.
Zakura’s post comes on the heels of a warning by Ethereum researcher Justin Drake, who on Thursday urged holders to prepare for a so-called “bunker mode,” warning that AI could find a shortcut through the mathematics protecting bitcoin and ether wallets “in months, not years” in the worst case.
Ethereum’s own broader migration to quantum-resistant cryptography has a target date of December 2029 . No practical attack on their wallet keys has been demonstrated so far.
ZEC ended Thursday around $1,185, down about 11% over the preceding week, leading a drop among top cryptocurrencies after Drake’s post went viral on X.
Zcash has two kinds of payments. One is shielded payments, which conceal the sender, recipient and amount. Transparent payments, in contrast, work much like bitcoin , with addresses and amounts visible on the blockchain.
About 11.96 million of the 16.98 million ZEC issued sat in the transparent pool on Thursday, roughly seven in 10 coins, according to CoinDesk’s calculation from ZecStats data. The January plan focuses on that public side of the network.
A wallet uses a secret key to approve spending and a corresponding public key that lets the network check the approval. Working backward from the public key to the secret is supposed to require an impractical amount of computing. Drake’s concern is that a breakthrough could make it affordable, as CoinDesk reported Thursday.
A standard Zcash transparent address initially hides the public key behind a hash, a digital fingerprint designed to be difficult to reverse. Spending reveals that key — and moving leftover funds to a fresh address puts them behind another key that has not been disclosed.
But checking those fresh addresses can give something else away.
Someone who spreads savings across 10 addresses still needs their balances. A typical wallet asks a server for those records, giving it a way to connect addresses that may look unrelated on the blockchain.
Zakura’s lookup tool uses so-called private information retrieval, which lets a database return a record without learning which one was requested. The wallet can check its balances without handing the server a readable list of addresses, while the payments themselves remain public.
An experimental version is already available through the “Private queries” setting in Vizor, a Zcash wallet.
The shielded side needs separate work, however. Zcash’s quantum recovery design warns that an attacker who obtains a recipient’s address could save encrypted payment records today and try to decrypt them after a future mathematical breakthrough.