Swap ZEC for another asset through NEAR Intents and the service publishes your shielded refund address on-chain. It stays there. Whether the swap settles or fails, whether you get paid back or not, the address becomes a public artifact, sitting in a block explorer for anyone — or anything — to pick up later.
The address looks like noise. It isn't. Behind every address a Zcash shielded account generates sits a single incoming viewing key. Crack that key and you don't crack one payment. You crack all of them: values, memos, the account's entire received history.
Classical computers can't do it. A machine running Shor's algorithm could. None exists yet. That gap is the entire window Zakura is working in, and this week the team published a design for it.
Zakura builds Zcash node and wallet software. The design, written up by Adam Tucker, gives every shielded address posted during a NEAR Intents swap its own viewing key. It is listed as in review. It has not shipped.
The problem it targets is structural, not speculative. Zcash shielded accounts are built so that every address belonging to one account shares a single incoming viewing key. The addresses are diversified — they look unrelated on-chain — but the derivation path converges. One key, many doors.
That single-key model is not an oversight. It exists because one key per account makes scanning and recovery tractable: a wallet syncs against one viewing key and knows everything the account received. Privacy and usability have been trading against each other inside this design since Sapling, and usability has mostly won.
Tucker's framing is blunt. Until Zcash's planned Tachyon upgrade arrives, he writes, "a single published shielded address lets a quantum attacker link every payment that address's key has ever received."
Tachyon is the protocol-level answer. It is not here yet. Zakura's proposal is the wallet-level answer in the meantime, and it exists because NEAR Intents turned the exposure from rare into routine.
Here is the mechanism that converts a privacy tool into a publication service. In ordinary Zcash use, you hand an address to whoever is paying you, privately, once. NEAR Intents works differently. When a user swaps ZEC out, the wallet supplies a shielded refund address; once the deposit is logged, NEAR publishes that address on-chain. When a user swaps into ZEC, the receiving address gets published too. The addresses look unrelated. One key sits behind all of them.
The service has already had one incident this year — a theft that was traced and recovered — which is why its on-chain address trail is now a subject of interest rather than an academic footnote.
Note what the design does not require. It does not require the user to lose funds. It does not require a bug. It requires only that someone use the product as intended, and that a future adversary keep a copy of the chain — the one thing every chain guarantees.
Zakura's fix is surgical. It changes only the randomness that feeds the viewing key, deriving a fresh key per swap from a hashed index. The spending key stays put. Funds stay in one account. Nothing about the user's balance moves.
The obvious alternative — open a new account per swap — was ruled out on hardware grounds. Tucker notes that Keystone devices sign only from the first account, and Ledger devices spend from one account per transaction. "Which wasn't an acceptable UX to us," he wrote.
That sentence is crypto privacy in miniature. The cryptography was never the bottleneck. The signing flow was. Every privacy feature that survives contact with users gets shaped by firmware constraints, not by the proof system. Narratives decay. Structures don't.
Per-swap keys create a second problem: restore cost. More keys normally means one full chain scan per key, and a wallet with hundreds of swaps becomes a wallet that takes hours to recover from seed. Zakura's design works around it in layers. The wallet leaves itself an encrypted memo recording each swap's index. It checks published filters first. Then it uses private information retrieval to look up matching NEAR bridge payouts without the server learning which addresses it asked about. For swaps into ZEC, where there is no index to consult, the wallet walks addresses in order and stops after 30 unused ones in a row.
That last number deserves attention. Thirty is a heuristic, not a proof. It assumes the address stream is dense enough that a run of 30 unused addresses means the scan is finished. That holds in normal use and fails at the edges — a long dormancy, a restored backup, a user who swaps once a year.
The index is the fragile part. It lives in wallet state, encrypted in a memo the wallet writes to itself. Lose that memo and you do not lose funds — the spending key is untouched — but you lose the map between swaps and keys. Recovery becomes a brute-force walk. That is a survivable failure, not a safe one.
PIR is the more interesting piece and the more under-examined one. Private information retrieval lets a client query a server without revealing the query. In practice it relocates trust rather than eliminating it. The server no longer learns which address you asked about, but you now depend on the PIR implementation being correct and the server set being honest about what it holds. When I reviewed viewing-key implementations for a client last quarter, the PIR layer was consistently the part with the thinnest public scrutiny. That is a genuine improvement over broadcasting your refund address to the world. It is not trustlessness, and the design post does not claim it is.
Zakura says software wallets using its libraries — Vizor among them — should be able to add support "in the coming weeks." Hardware wallets follow once their firmware supports it.
Read that twice. The patch ships on someone else's schedule. A privacy fix that depends on firmware vendors is a privacy fix with a queue in front of it, and the queue is controlled by companies whose incentive is compatibility, not confidentiality.
State it plainly: this design protects the future. It does nothing for addresses already on-chain. Every refund address NEAR Intents has published to date still shares a key with its siblings, still waiting for a machine that does not exist yet. A fresh key per swap going forward does not retroactively split the old ones.
The contrarian read is that the quantum frame is doing more marketing work than engineering work.
Not because the threat is fake. Because the threat is distant and the harm is here now. A chain analyst does not need Shor's algorithm to cluster a published refund address with the deposit that funded it. He needs a block explorer. The quantum story is the version of this problem that earns a headline. The surveillance story is the version that earns a spreadsheet, and the spreadsheet is being filled in today.
I have watched this pattern before. In 2017 I worked through more than 500 Ethereum ICO whitepapers and found that 85% had no viable roadmap, yet the marketing was uniformly excellent. Narrative is cheap. Structure is expensive. Every cycle produces a word that does the work of an argument, and this cycle's word is "quantum." Structure beats speculation every time — and a per-swap viewing key is structure. A press cycle about post-quantum Zcash is speculation.
There is a second blind spot. The design solves for the wallet. It does not solve for the bridge. NEAR Intents publishes refund addresses by design, and no amount of client-side key hygiene changes that policy. Zakura is patching the downstream consequence of an upstream choice. That is worth doing. It is also an admission that the party creating the exposure is not the party fixing it.
2017 called. It wants its lessons back. The lesson then was that privacy claims shipped as features while data leaked through interfaces nobody audited. The lesson now is identical, one layer up. The cryptography is fine. The plumbing is where the water gets out.
Zakura's proposal has the right shape: narrow, testable, honest about its constraints. In review, not shipped, no date promised beyond "coming weeks" for software wallets.
The question worth carrying forward is not whether per-swap keys work. It is whether the services that publish addresses will ever stop publishing them — and who audits the index that replaces them. A hashed index is new state: held by a wallet, restored from a memo, queried through a server. Each of those links is a place where the privacy claim can quietly fail.
The quantum clock is slow. The chain is patient. The only question is which one reaches the address first.
