Zcash infrastructure developer Zakura has proposed a new wallet security feature designed to protect users’ transaction histories against potential future quantum computing attacks. The proposal would give every ZEC swap made through NEAR Intents its own incoming viewing key, limiting how much transaction information could be exposed if one key were compromised.
The feature, called a one-time incoming viewing key, would leave a wallet’s existing spending key unchanged. Zakura says software wallets built with its open-source libraries could begin integrating the feature in the coming weeks, with hardware wallet support expected later.
In an engineering post, Zakura developer Adam Tucker explained that the design aims to prevent attackers from using one publicly exposed Zcash address to uncover payments received across a user’s shielded account.
The concern centers on NEAR Intents, a cross-chain swapping service that can permanently record certain Zcash addresses on NEAR’s public blockchain. Even when a swap succeeds and no refund is needed, the address may remain publicly available.
Although current computers cannot use this information to recover the underlying viewing keys, Zakura warned that sufficiently powerful quantum computers could potentially do so in the future.
How NEAR Intents swaps could expose Zcash transaction history
NEAR Intents allows users to exchange assets across different blockchains without manually handling every stage of a transaction.
For example, someone swapping shielded ZEC for USDC on Ethereum sends ZEC to a deposit address associated with the service. The swap request also includes a refund address where unused ZEC can be returned.
According to Zakura, the refund address is recorded on NEAR’s public blockchain when the deposit is registered. That record can remain available even if the swap succeeds and the refund address is never used.
Zcash normally allows wallets to generate multiple shielded addresses that appear unrelated to outside observers. However, addresses associated with the same account can share an incoming viewing key, which allows the wallet to identify and decrypt incoming payments.
Zcash relies on elliptic-curve cryptography, which conventional computers cannot practically reverse. Zakura warned that a sufficiently powerful quantum computer running Shor’s algorithm could theoretically recover an incoming viewing key using public information from an exposed shielded address.
If that happened, an attacker could potentially identify payments received by the account, including transaction amounts and private memos attached to them.
The risk concerns transaction privacy rather than direct access to funds. An incoming viewing key does not authorize spending, so recovering one would not, by itself, allow an attacker to transfer the user’s ZEC.
The concern applies to swaps in both directions. When users exchange ZEC for assets on other networks, refund addresses may become public. When they swap other assets into ZEC, the receiving shielded address may be exposed through the process.
Zakura’s proposal separates viewing keys without creating new accounts
Zakura’s proposed fix would generate a unique incoming viewing key for each swap address while allowing users to keep all their funds under their existing Zcash account.
The wallet would derive a new key using its existing account credentials, the address’s intended purpose and an index identifying the individual swap.
Each address would therefore have its own viewing key, while the original spending key would continue to authorize transactions involving funds held across the account.
The engineering post says the design changes the randomized component used to derive an incoming viewing key. The account’s authorization and nullifier keys would remain unchanged.
Zakura uses a keyed-hash construction associated with Zcash’s ZIP 32 key-derivation system, along with a separate domain identifier to distinguish swap keys from the wallet’s existing internal keys.
Under this approach, recovering one viewing key would expose payments associated with that particular address rather than automatically revealing the account’s entire incoming transaction history. Linking it to other swap addresses would require reversing the hash-based derivation.
Creating a separate Zcash account for every transaction could provide similar separation, but Zakura says that approach would create practical problems for hardware wallet users.
According to the post, Keystone’s Zcash implementation supports signing transactions only from account index 0. Ledger supports multiple accounts but can require separate transactions and approvals when spending funds from different accounts.
Users who accumulated funds across many separate accounts could therefore face additional restrictions or repeated approval requests.
Zakura’s proposed design would keep the funds spendable through the original account and its existing authorization process.
The wallet would also leave an encrypted note in the change output of an outgoing ZEC swap. This note would record the index used to derive the refund address, allowing the wallet to reconstruct the appropriate key when recovering its transaction history.
If NEAR returns unused ZEC to that address, the funds could still be spent using the wallet’s normal spending key.
Private database searches could make wallet recovery easier
Giving every swap its own viewing key introduces another challenge: wallets must be able to recover transactions associated with potentially hundreds of different keys.
Zcash wallets generally identify incoming payments by checking encrypted transaction outputs against their viewing keys. Under Zakura’s proposal, the number of keys a wallet must check would grow with the number of swaps.
Repeatedly scanning the entire blockchain for every key could make wallet restoration increasingly slow.
To address this, Zakura proposes using private information retrieval, or PIR. This technique would allow a wallet to locate relevant transactions in a database without revealing its addresses to the database operator.
The design relies on a feature of NEAR’s Zcash bridge, whose outgoing transactions use an all-zero outgoing viewing key. This allows transactions to be indexed by their destination addresses.
During recovery, a wallet would first download filters identifying addresses that may have received payments through the bridge. Because the filters are downloaded in full, the server would not learn which addresses belong to the user.
If a filter identifies a possible payment, the wallet would send an encrypted database request using PIR. The server could return the matching transaction’s location without learning which address the wallet searched for.
Zakura says the system uses the same lattice-based private retrieval technique it developed for transparent wallet lookups and Zcash coinholder voting.
Swaps into ZEC require a slightly different recovery process because the receiving wallet does not create an outgoing Zcash transaction containing the address index.
In those cases, the wallet would generate addresses in sequence and compare them with published filters until it found 30 consecutive addresses that had neither received payments nor been supplied to NEAR.
The team says abandoned swap quotes would not lead to address reuse because each new transaction would receive an address that NEAR had not previously encountered.
Zcash developers are working on broader quantum protection
Zakura’s proposal addresses transaction privacy, while other Zcash development work focuses on protecting spending authorization against future quantum attacks.
Developers have targeted January 2027 for proposed post-quantum signature instructions that would allow transparent Zcash transactions to use hash-based signatures. Those protections would address a different problem from one-time viewing keys, which are intended to limit the exposure of historical shielded payments.
Earlier reporting put the amount of ZEC held in transparent addresses at approximately 11.96 million tokens, or around 70% of the issued supply as of October 8.
Zcash’s July Ironwood network upgrade also introduced quantum-recoverable notes through ZIP 2005. The feature provides a foundation for developing a future recovery mechanism if advances in quantum computing threaten existing cryptographic protections. It does not, by itself, make the network fully quantum-secure.
Quantum computing research has added to the wider discussion. On October 15, Google reported a 40-fold reduction in quantum computing errors using a technique known as magic state cultivation. The experiment achieved 99.99% logical fidelity under the researchers’ testing method, but it did not demonstrate an attack against Bitcoin, Zcash or another cryptocurrency network.
No publicly demonstrated quantum computer has been shown to recover the elliptic-curve keys used by Zcash.
Zakura has not announced a confirmed release date for the one-time viewing key feature. The team expects software wallets using its cryptographic libraries, including Vizor, to begin integrating the design in the coming weeks. Hardware wallet support is expected later, once the required firmware changes are available.
For now, the proposal remains under development. Its goal is to limit the amount of transaction history exposed by any single compromised viewing key while preserving the wallet’s existing spending arrangements.
