Just under three percent of the circulating supply of Zcash is still at risk.
The Zcash network was upgraded to its latest version Sapling, in October 2018, providing enhanced privacy transactions using the ZEC coin. However, not everyone has migrated onto the latest version. According to the Zchain block explorer, 184,000 Zcash ($15 million) is still sitting in legacy addresses on the previous version, Sprout.
The Electric Coin Company—which created privacy-focused cryptocurrency Zcash—revealed in February that these addresses have been vulnerable to a potential counterfeiting bug for years. While it made moves to minimize the possibility that they would be exploited, the Zcash Foundation believes there is a non-zero chance that this has already happened. In fact—it wrote that there is no way of knowing if the addresses are safe, until all coins are migrated across to the new protocol.
To provide additional security, while the Electric Coin Company said it will support Spout address “for the foreseeable future,” it recommended that users update regularly to keep up with the ecosystem. It is also possible there will be a point when they get left behind.
And community group mineZcash has joined the chorus, reminding its Twitter followers on Monday that “All Zcash users should migrate to Sapling!”
To make migrating easier, the Electric Coin Company released a tool on May 21 to help Zcash users. The Sprout-to-Sapling migration tool automates the process, without requiring users to manually transfer their funds across.
This doesn’t affect Zcash held in transparent addresses—wallets that aren’t making use of Zcash’s privacy features. Currently 95 percent of Zcash is held in such address, where transactions are as publicly available as Bitcoin transactions.
But, to date, just 1.9 percent of Zcash is making use of the Sapling privacy features. Perhaps Zcash owners don’t want privacy after all.