THE LEAK IS NOT ON ZCASH
A private transaction does not necessarily leave a private future. Zcash conceals shielded transaction details from public observers. But when a shielded address is recorded on another blockchain, that record can persist long after the swap is complete.
Zakura developer Adam Tucker outlined a proposal, announced October 18, for one-time incoming viewing keys in Zcash swaps through NEAR Intents. The design is intended to limit what a future quantum attacker could learn from an address disclosed during a swap.
When someone swaps ZEC through NEAR Intents, a shielded refund address can be written to NEAR’s transparent chain. The address can remain publicly visible even when no refund occurs. Incoming ZEC swaps may similarly disclose a receiving address. The disclosure happens outside the shielded Zcash ledger.
ONE ADDRESS, A MUCH BIGGER HISTORY
A shielded Zcash account can generate multiple distinct-looking payment addresses that share an incoming viewing key. That key allows a wallet to recognize and decrypt payments it receives.
Current computers cannot feasibly derive that key from a published address. A sufficiently capable future quantum computer running Shor’s algorithm could theoretically undermine the elliptic-curve relationship protecting it. Recovering the shared incoming viewing key could then reveal amounts and memos for other incoming payments associated with the same account.
This would be a confidentiality failure, not automatically a theft of funds. Incoming viewing keys and spending authorization are separate. No quantum computer capable of executing this attack at the required scale has been publicly demonstrated.
ONE SWAP. ONE VIEWING KEY.
Zakura proposes deriving a separate incoming viewing key for each publicly exposed swap address while retaining the account’s existing spending authority. Instead of one exposed address becoming a window into the account’s broader payment history, the damage from a hypothetical recovered key would be limited to payments associated with that swap key.
This is compartmentalization rather than blanket quantum resistance. The design targets a particular cross-chain address-disclosure risk; it does not replace Zcash’s cryptography or make all historical exposures safe. The proposal is under review, not a deployed network upgrade.
THE RECOVERY TRADEOFF
More viewing keys can make wallet restoration harder. A restored wallet normally needs to find outputs intended for it; scanning the chain separately for hundreds of one-time keys could become costly.
Zakura describes an indexed recovery approach using private information retrieval, allowing wallets to request relevant records without telling the indexing service exactly which records interest them. That privacy property matters: otherwise the recovery service could become a new surveillance point.
The actual benefit depends on wallet implementation, key management, and adoption. The design is a proposal; its security and usability should be evaluated in deployed software, not assumed from the architecture alone.
WHAT THIS DOES NOT SOLVE
The proposal does not mean quantum computers are currently breaking Zcash privacy. It does not protect every publicly disclosed address, erase cross-chain metadata, or eliminate all forms of transaction correlation.
Nor is this a substitute for broader post-quantum work across the Zcash ecosystem. It is a narrower, wallet-level mitigation intended to reduce the consequences of a specific future cryptographic failure.
WHY IT MATTERS
Blockchains preserve public records. A refund address disclosed for a routine swap today may still be available to an adversary years later, even if the original transaction was private on Zcash.
That changes the time horizon for privacy engineering. The question is not only what observers can decrypt now, but what they can store now and interpret later. A single disclosed address should not become a master index of someone’s financial history.
The most important boundary in this proposal is not between blockchains. It is between one disclosed address and everything else a wallet has ever received. The less information any one exposure can unlock, the less useful permanent public records become to future surveillance.