Developers of privacy-focused Zcash (ZEC) plan to add protections designed to withstand quantum computers within months, as warnings about AI-assisted attacks put the broader security of cryptocurrency wallets under scrutiny.

The team behind the privacy coin aims to add support for quantum-resistant, hash-based signatures in January, though no network activation date has been confirmed. The upgrade would initially protect transparent transactions, which account for about 70% of issued ZEC, while shielded payments require separate safeguards. The plan concerns public payments, where roughly seven in 10 ZEC sit.

Zakura, one of the programs used to run the Zcash network and validate its transactions, has also developed a private lookup tool that lets wallets check balances without revealing linked addresses to a server. An experimental version of the tool is available in the Vizor wallet.

"Our team plans for post-quantum signature opcodes to land in Zcash in January," Roman Akhtariev wrote in an engineering post for Zakura.

Those opcodes, or instructions, would give Zcash the ability to check hash-based signatures, a method of approving payments designed to resist quantum attacks. While January is the team's target, no confirmed network activation date was mentioned; until one is set, the opcodes amount to a capability in software rather than an active safeguard for coins on the network.

The aim is to prevent attackers from using today's public keys to work backward to forge a wallet owner's approval and spend their coins. The upgraded software would produce a signature that the network checks using hashes — digital fingerprints made from secret data. Hash-based schemes are among the most conservative families of post-quantum cryptography — the same family the U.S. National Institute of Standards and Technology included in its first post-quantum signature standards in 2024 — relying on the well-studied security of hash functions rather than the public-key mathematics that quantum computers are expected to break. Forging an approval would therefore require defeating those hashes, meaning a breakthrough against today's wallet keys would not automatically defeat the replacement.

Using fresh addresses keeps keys hidden before spending, and the proposed signatures are intended to protect the payment when spending makes its approval publicn
Zakura's post comes on the heels of a warning by Ethereum researcher Justin Drake, who on Thursday urged holders to prepare for a so-called "bunker mode," saying AI could find a shortcut through the mathematics protecting bitcoin and ether wallets "in months, not years" in the worst case. Ethereum's own broader migration to quantum-resistant cryptography has a target date of December 2029. No practical attack on their wallet keys has been demonstrated so far. Set against that timeline, Zcash's January target, if the opcodes land as planned, would give the network a working code path for quantum-resistant signatures on its public side years ahead of Ethereum's broader deadline — though with no activation date confirmed and shielded payments outside the plan's scope.

ZEC ended Thursday around $1,185, down about 11% over the preceding week, leading a drop among top cryptocurrencies after Drake's post went viral on X.

Fresh addresses, revealing balance checks

Zcash, launched in 2016, has two kinds of payments. Shielded payments use zero-knowledge proofs to conceal the sender, recipient and amount. Transparent payments, in contrast, work much like bitcoin (BTC $82,985.25), with addresses and amounts visible on the blockchain.

About 11.96 million of the 16.98 million ZEC issued sat in the transparent pool on Thursday — roughly seven in 10 coins — according to CoinDesk's calculation from ZecStats data. The January plan focuses on that public side of the network.

A wallet uses a secret key to approve spending and a corresponding public key that lets the network check the approval. Working backward from the public key to the secret is supposed to require an impractical amount of computing. Drake's concern is that a breakthrough could make it affordable, as CoinDesk reported Thursday.

A standard Zcash transparent address initially hides the public key behind a hash, a digital fingerprint designed to be difficult to reverse. Spending reveals that key — and moving leftover funds to a fresh address puts them behind another key that has not been disclosed.

But checking those fresh addresses can give something else away. Someone who spreads savings across 10 addresses still needs their balances. A typical wallet asks a server for those records, giving the server a way to connect addresses that may look unrelated on the blockchain.

Zakura's lookup tool uses so-called private information retrieval, which lets a database return a record without learning which one was requested. The wallet can check its balances without handing the server a readable list of addresses, while the payments themselves remain public. An experimental version is already available through the "Private queries" setting in Vizor, a Zcash wallet — for now, that privacy benefit reaches only wallets that switch the setting on.

The shielded side needs separate work, however. Zcash's quantum recovery design warns that an attacker who obtains a recipient's address could save encrypted payment records today and try to decrypt them after a future mathematical breakthrough — a risk pattern often described as "harvest now, decrypt later."