هل Zcash مقاوم للكم في عام 2026؟ التحليل النقدي

فهم مكدس التشفير الخاص بـ Zcash

يستخدم Zcash نظام تشفير متطور متعدد الطبقات، وكل طبقة منه ما قبل الكم. العناوين الشفافة تحمل علامة secp256k1 ECDSA، تمامًا مثل Bitcoin، المعرضة للاختراق من قبل أجهزة الكمبيوتر الكمومية. دعونا نفحص نقاط الضعف الكمومية لكل طبقة:

لماذا zk-SNARKs ليست آمنة كميًا

يفترض الكثيرون أنه نظرًا لأن zk-SNARKs عبارة عن "تشفير متقدم"، فيجب أن تكون مقاومة كمومية. هذا غير صحيح.

لا تؤدي ترقية Orchard إلى حل هذه المشكلة

قدمت ترقية Orchard لـ Zcash (تم تفعيلها عام 2022) العديد من التحسينات ولكن لم يضيف مقاومة الكم:

"بينما تزيل Halo 2 مراسم الإعداد الموثوقة (القضاء على ناقل الهجوم الكمي)، فإن نظام الإثبات لا يزال يعتمد على صلابة مشكلة اللوغاريتم المنفصلة على المنحنيات الإهليلجية." - الوثائق الفنية لمؤسسة Zcash

تهديد "الحصاد الآن، وفك التشفير لاحقًا".

هذا هو التهديد الخطير الذي لا يفهمه حاملو Zcash:

يتم تسجيل كل معاملة محمية أجريتها على blockchain. وفي الوقت الحالي، من المرجح أن يقوم الخصوم المتطورون (الدول القومية، والمهاجمون الممولون جيدًا) بجمع هذه البيانات.

عندما تصبح أجهزة الكمبيوتر الكمومية قادرة على:

• يمكن اشتقاق جميع مفاتيح عرض Sapling/Orchard من المفاتيح العامة
• تصبح مبالغ المعاملات المحمية مرئية
• يمكن ربط عناوين المرسل والمستقبل
• سجل المعاملات الكامل قابل لإعادة البناء
• ستصبح معاملاتك "الخاصة" لعام 2023 علنية بحلول عام 2033

Zcash مقابل البديل المقاوم للكم

Zcash Has Already Shipped a Counterfeiting Bug Once

Before discussing what a quantum computer would do to Zcash, it is worth recording what a single misplaced group element already did.

On 1 March 2018, Ariel Gabizon, a cryptographer working on Zcash, found a flaw in the BCTV14 proving system that Zcash's original Sprout protocol used. The construction came from a 2014 academic paper by Ben-Sasson, Chiesa, Tromer and Virza. The proving key contained elements that were not needed to produce a valid proof, and those spare elements could be used to forge one. A forged proof would have allowed an attacker to mint shielded ZEC out of nothing, without limit.

Sit with the second-order consequence, because it is the part that matters. In a shielded pool the supply is hidden by design. Nobody can audit it. The same cryptography that protects a user's privacy would have concealed the counterfeiting completely. There is no balance sheet to check, no address to watch, no anomaly to notice. The flaw and the feature are the same mechanism.

Credit where it is due: fixing quietly and disclosing after deployment was the correct call, and the company did it well. The indictment is not of the people. It is of the assumption underneath the whole field.

That construction sat in published, peer-reviewed academic work for roughly four years. It was read by specialists. It was implemented in production and secured real money. And the hole was still there. Anyone who tells you a zero-knowledge system is safe because the paper was reviewed is describing a process that has already failed once, in exactly this way, on exactly this chain.

This is why the argument for hash-based signatures is not aesthetic. Fewer moving parts, fewer assumptions, fewer places for a spare group element to hide.

What Quantum Actually Breaks in Zcash (Two Different Things)

Most coverage says "quantum breaks Zcash" and stops. The mechanism matters, because there are two of them and they fail in different directions.

One: soundness, which means counterfeiting. Groth16, the proving system Sapling moved to after 2018, has perfect zero-knowledge but only computational soundness. In plain terms: the privacy property holds against an adversary with unlimited computing power, and the integrity property does not. Soundness rests on discrete-logarithm hardness in a pairing group. Break that and you can forge proofs. Forging proofs is counterfeiting. That is the 2018 failure again, except this time there is no patch, because the assumption itself is what failed.

Two: note encryption, which means retroactive privacy loss. Sapling encrypts each note's contents to the recipient using a Diffie-Hellman key agreement on the Jubjub curve. The ciphertexts are on the chain forever. A quantum adversary recovers the shared secret from data already recorded and decrypts the amounts and memos of transactions that happened years earlier. Nothing has to be broken today for this to work. The archive is already being collected.

So the honest summary is not that Zcash is "vulnerable". It is that Zcash is vulnerable twice, on two independent mechanisms, one of which destroys supply integrity and one of which destroys the privacy the chain exists to provide. Orchard's move to Halo 2 removed the trusted setup, which was a genuine improvement, and it did nothing about either of these, because Pallas and Vesta are still elliptic curves.

June 2026: It Happened Again, and This Time Nobody Can Check

On 5 June 2026 Zcash disclosed a critical counterfeiting vulnerability in the Orchard circuit, the component that governs its newest shielded pool. ZEC fell somewhere between 31 and 41 percent depending on which outlet you read. Arthur Hayes announced he had liquidated his entire position.

The mechanics matter, because the summary versions lose the important part. Taylor Hornby, hired in April 2026 to hunt for protocol weaknesses, found it on 29 May 2026 using a custom auditing agent framework paired with a large language model. The flaw was an under-constrained element in the Orchard circuit: roughly two lines of code that allowed arbitrary false inputs to an elliptic-curve multiplication to be accepted as valid. Hornby wrote a working exploit and, in a local regtest environment, generated unlimited undetectable counterfeit ZEC. It was patched on 1–2 June and disclosed on the 5th.

It had been live since Orchard activated in May 2022. Four years.

Read that again. Not "we checked and found nothing". Not "we are confident it was not exploited". There is no way to check. The privacy guarantee that is Zcash's entire product is the same mechanism that makes its supply unauditable. You cannot have one without the other. That is not a bug in the implementation, it is the shape of the design.

The proposed remedy tells you how serious it is: a network upgrade is being explored that would deploy an entirely new shielded pool and enforce turnstile accounting on Orchard coins, specifically so supply integrity becomes verifiable. You do not rebuild the pool and add a supply checkpoint if you are confident about what is already in it.

One more detail, and it is not small. Four years of human review, professional audits and academic attention missed two lines. An AI auditing agent found it in weeks. Take from that what you like about the state of manual cryptographic review.

Twice. Eight Years Apart. The Same Blind Spot.

The 2026 bug is not an isolated incident. It is the second instance of one failure mode.

Same class of failure, same invisibility, eight years apart, through two complete rewrites of the proving system. Sprout was replaced by Sapling because of the first one. Sapling was superseded by Orchard with Halo 2 and no trusted setup, which was supposed to be the mature version. It shipped with a constraint bug that did the same thing.

This is an argument against complexity, not against Zcash engineers, who are good at their jobs. A zk-SNARK circuit is thousands of constraints and soundness requires كل واحد to be correct. One under-constrained element and the system mints money. There is no partial failure mode.

SPHINCS+ vs zk-SNARKs: The Attack Surfaces Are Not Comparable

Now the quantum question in context. If a two-line constraint error produces unlimited invisible counterfeiting, ask what a broken mathematical assumption produces. That is what Shor's algorithm does to Zcash soundness, and unlike a constraint bug there is no patch for it. You cannot fix "the discrete logarithm problem is now easy" with a network upgrade.

The honest caveat, because this page is not a pitch: hash-based signatures are large. A SPHINCS+ signature is measured in kilobytes where an elliptic-curve signature is measured in bytes, and that is a real cost in bandwidth and block space. We pay it deliberately. The trade is signature size against an attack surface that does not include "somebody mis-specified a constraint" or "the discrete logarithm problem fell".

A توقيع SPHINCS+ either verifies or it does not. There is no shielded pool it can silently inflate. That is the whole argument, and it is structural rather than clever.

Inspired by Monero, or Inspired by the Cap Table?

Cryptography is not the only place intent shows up. Launch economics is a cleaner signal, because it is a choice made before anyone is watching.

The Zcash Founders’ Reward directed 20 percent of the first four years of block rewards to founders, investors, employees and advisors. That is public record and it was disclosed openly, so this is not an accusation of anything hidden. It is a statement about what the protocol was optimised for on day one.

Monero took the other road: no premine, no founders’ reward, no investor allocation, CPU mining so ordinary hardware could participate. That is the tradition SynX comes out of. We run a peer-to-peer exchange inside the wallet for the same reason: a chain that needs permission from a centralised exchange to be tradeable has handed that exchange a veto over its own existence.

هل يمكن ترقية Zcash؟

تعد ZK-SNARKs بعد الكم منطقة بحث نشطة، ولكنها تواجه تحديات كبيرة:

zk-SNARKs المستندة إلى الشبكة

توجد أبحاث حول الأنظمة المشابهة لـ STARK ذات الأمان ما بعد الكمي، ولكن:

• أحجام الإثبات أكبر بمقدار 10-100 مرة من Groth16
• يزداد وقت التحقق بشكل ملحوظ
• لا يوجد تنفيذ جاهز للإنتاج
• سيتطلب إعادة تصميم البروتوكول بالكامل

تعقيد الهجرة

حتى لو أصبحت zk-SNARKs بعد الكم متاحة:

• ستظل جميع المجمعات المحمية الحالية معرضة للخطر
• سيحتاج المستخدمون إلى ترحيل الأموال إلى عناوين جديدة
• المعاملات التاريخية مكشوفة بشكل دائم
• تنسيق ترقية الشبكة عبر ملايين المستخدمين