Every shielded Zcash transaction ever mined carries a public 32-byte field called epk. It is not encrypted. It is not folded into a commitment. It sits in the transaction output, in the clear, and it has been there since the Sprout pool produced its first blocks in October 2016.
Zakura's disclosure this week is, stripped of framing, a statement about that field. Take a single published Zcash address. Collect the epk values that were sent to it. Hand the resulting dataset to an attacker who owns a cryptographically relevant quantum computer, and that attacker walks backwards through every payment the wallet has ever received โ the 2017 grant, the 2019 exchange withdrawal, the 2024 treasury transfer โ and reads them in sequence. Not the payments made after the machine exists. All of them.
The temptation is to file this under "quantum, someday." That filing is the liability.
Zcash ships three address families, and the distinction matters more than the marketing suggests. Transparent addresses (t1/t3) are Bitcoin-shaped: secp256k1 public keys, ECDSA signatures, visible value flows. Shielded addresses hide sender, receiver and amount behind zero-knowledge proofs. Since ZIP 316 landed with NU5 in 2022, wallets present Unified Addresses โ one string that bundles multiple receivers, potentially across pools, and lets the payer choose which one to hit.
The cryptographic core is uniform across the shielded pools. An address is a pair: a diversifier d, and a diversified transmission key pk_d = [ivk] ยท g_d, where g_d is a group generator derived by hashing the diversifier. Both d and pk_d are public โ they are literally the characters you paste into a donation page. When someone pays you, their wallet picks an ephemeral scalar esk, publishes epk = [esk] ยท g_d, and derives the note encryption key from the shared secret [esk] ยท pk_d.
Now read that last expression from the other side. The recipient computes the same secret as [ivk] ยท epk. So the incoming viewing key plus the on-chain epk is sufficient to decrypt the note. And pk_d is public. Which means the entire decryption chain reduces to a single discrete logarithm: recover ivk from pk_d, then apply it to every epk ever addressed to you.
That is the whole claim, and it is worth being precise about why "a single published address" is the correct unit of analysis rather than hyperbole. The address is not the secret. The address is the join key. The chain supplies the ciphertexts; the address supplies the label. A quantum attacker needs both, and both are already public.
Here is where I part company with the more breathless readings of the disclosure. Zakura's claim is about linkage, and linkage is the correct claim to make, because it is the one that follows from public data alone. Full spending-key recovery is a separate and harder proposition: it depends on what additional key material an address has shed over its lifetime, and on the specific pool. An address that has only ever received is fully readable in a quantum future. Whether it is also fully spendable is a question I would not answer without the derivation path in front of me. Conflating the two is how good disclosures get dismissed.
The curve inventory makes the exposure structural rather than incidental. Sapling runs on Jubjub. Orchard runs on Pallas and Vesta. Sprout ran on BN254 with BLS12-381 in the mix. Every one of them is an elliptic curve whose security rests on the hardness of discrete log. Shor's algorithm does not weaken that assumption; it deletes it. Grover's algorithm is the lesser problem โ it halves the effective security of the hash-based commitments, which is a parameter-tuning exercise. Shor is an architectural event.
The harvest-now-decrypt-later model is usually presented as a forward-looking risk. For Zcash it is a backward-looking fact. The epk values have been public since 2016. Archival nodes hold them. Block explorers mirror them. Pruning does not help, because the data has already been copied into a hundred places that will never be pruned. The collection phase of this attack finished years ago. Only the computation phase remains outstanding.
I spent part of last year stress-testing the oracle feed architecture of an autonomous AI agent framework built on zk-SNARKs for private identity. The proofs were sound. The failure I found was elsewhere โ in how the model handled ambiguous state transitions, where a skewed training input could produce an authorization the system had no deterministic rule to refuse. The lesson generalizes cleanly here. A cryptographic guarantee is only as strong as the assumptions it silently imports about time. Zcash's proofs are not broken. Its assumption about the durability of confidentiality is.
The bug is always in the assumption. The assumption here is that privacy is a property of ciphertext, when in fact it is a property of key custody across an unbounded time horizon. Zero knowledge is a liability, not a virtue, when the underlying key material is derived from a public value and the adversary's capability is treated as a constant rather than a variable.
ZIP 316 introduced a specific footgun that deserves more attention than it gets. A Unified Address may include a transparent receiver alongside the shielded ones. That is a convenience feature, and it is a composability decision made without a full audit of its second-order effects. If any payer routes to the transparent receiver, the unified string acquires a permanent, publicly clusterable anchor โ exchange deposit graphs, change-address heuristics, the whole apparatus of chain analysis. Composability without audit is just delayed debt, and this particular debt compounds in a quantum future, when secp256k1 falls alongside everything else.
Diversification does not rescue the design either. Within a single Unified Address, each receiver carries its own diversifier and its own pk_d. That looks like compartmentalization. It is not, because the address string publishes all of them together. One paste into a Twitter bio pins the entire set.
The anonymity-set argument inverts under this threat model, and that inversion is the part I would put in front of any institution. Shielded pools are marketed as anonymity sets: the larger the pool, the harder the inference. That logic holds only while the attacker cannot decrypt. Against an adversary who can, the pool stops being an anonymity set and becomes a labeled dataset. Size stops helping. The binding is per-address, and per-address is exactly what was published.
The memo field is the part almost nobody mentions. Zcash notes carry up to 512 bytes of plaintext memo, and historically those memos carried real text โ exchange deposit identifiers, invoice references, greetings. Recovering them is not a marginal privacy loss. It is the identity layer arriving intact, attached to a transaction graph that also arrived intact.
Migration is the standard reassurance, and it does not survive contact with the mechanics. A turnstile migration moves value forward into a new pool. It cannot retract a single epk already written to a block. The Sapling-to-Orchard transition took years of engineering, wallet coordination and ecosystem nagging, and it was a far smaller change than a post-quantum curve migration will be. A protocol can schedule a deprecation. It cannot schedule a memory wipe.
Trust is a variable, not a constant. Keys rotate. History does not. This is the asymmetry that every privacy protocol prices at zero and every adversary prices at full value.
The selective-disclosure model inverts in the same breath. Viewing keys exist so that a wallet holder can grant an auditor, an exchange or a tax authority read access to a defined slice of history. That is a deliberate, revocable, scoped delegation. In a quantum future the delegation is universal and free, granted to anyone with the hardware, and it cannot be revoked because it was never granted in the first place.
The distribution of harm is the least comfortable part of the analysis. The users who lose the most are the ones who shielded earliest and most carefully โ the ones who treated the pool as a long-term confidentiality commitment rather than a transactional convenience. Their earliest, most sensitive payments are the ones that have been sitting exposed longest. Careful operational security, in this specific case, purchased duration of exposure rather than reduction of it.
Institutional exposure follows directly. A treasury that routed shielded transfers through a published Unified Address, a custody desk that reused a deposit string across counterparties, a foundation that posted a donation address in 2018 โ each of those is a labeled archive waiting on a machine. The counterparty graph is not a future inference. It is a present-day document that only lacks a reader.
The counterargument is predictable and I have heard it in every cycle: quantum computers are decades away, and by the time they arrive the ecosystem will have migrated. That argument mistakes the relevant clock. The clock that matters is not the arrival date of the machine. It is the disclosure date of the data, and that date has already passed. A twenty-year migration window is irrelevant if the ciphertext was harvested nine years ago.
There is a deeper blind spot underneath, and it is not unique to Zcash. Privacy protocols price time as though it were free, publish guarantees as though they were permanent, and market confidentiality as though the adversary were frozen at the moment of the audit. Bitcoin is at least honest about this: its ledger is transparent by construction, and nobody pretends otherwise. Zcash's entire product is a time-unbounded confidentiality claim, and a time-unbounded claim is the one class of claim a discrete-log break destroys retroactively rather than prospectively.
What rigorous remediation would look like is unglamorous. A published cryptographic sunset statement for each pool, with an explicit deprecation horizon rather than an open-ended one. Default address rotation in wallets, so that a single string does not accumulate a decade of history. Removal of transparent receivers from Unified Addresses as a default, not an option. And a post-quantum curve migration scoped with the same seriousness as the original trusted setup, because it is the same order of engineering.
Precision is the only kindness in code. The distinction between "an adversary can read every payment you ever received" and "an adversary can spend every note you ever received" is the difference between a disclosure that gets acted on and one that gets laughed out of the room. Zakura made the first claim. The first claim is the one that holds.
The question worth asking is not whether the quantum computer arrives. It is what your address will mean when one does โ and whether the answer you would give today is the same one the ledger will give on your behalf.