Mentioned in This Article
1. Zodl wallet switches on IP shielding for everyone
The Zodl wallet for Zcash (ZEC), formerly known as Zashi, began moving its users onto servers it operates itself on November 9, 2026, using a design in which no single party sees both a user's IP address and the requests their wallet makes. The protection ships in Zodl version 3.20.0 and needs no setup from the user.
The change addresses a weakness that sits outside the blockchain. Zcash can shield the sender, recipient and amount of a transaction, yet the act of connecting to the network still produces data about who is asking for what, and when. Zodl's update is aimed at that layer of information rather than at anything recorded on the ledger.
The rollout is gradual. The new infrastructure is being switched on over a period of days on both Android and iOS, so not every user has it yet. The underlying code has been published as open source, which allows outside developers to inspect how the system handles requests.
2. Why does a wallet's server connection matter?
Most mobile wallets are light wallets, which means they do not hold a full copy of the blockchain and instead depend on remote servers to fetch balances and transmit transactions. Those servers are in a position to observe a user's IP address, the content of each request and the timing of every interaction.
On Zcash, the servers in question run software called lightwalletd. A wallet contacts one of them to learn about incoming funds and to broadcast outgoing payments. Even when the ZEC being moved is fully shielded, the pattern of connections can still hint at who a user is or what they are doing, because an IP address can be tied to a location, an internet provider and, with enough additional data, a person.
This kind of information is usually described as metadata. It is not the content of a transaction, but it surrounds the transaction and can be just as revealing. An observer who knows that a particular IP address contacted a wallet server moments before a given transaction appeared on the network has a strong clue about where that transaction came from.
Until this release, a Zodl user who wanted to guard against that exposure had two choices. One was to switch on the wallet's Tor option, which routes traffic through the Tor anonymity network. The other was simply to trust whoever operated the server. Tor was available but had to be enabled deliberately, so users who never opened the setting received no network-level protection.
3. How does Zodl's new server design work?
Zodl relies on Oblivious HTTP, or OHTTP, an Internet Engineering Task Force standard published as RFC 9458 that divides every exchange between two independent parties so that neither holds the full picture. One party learns who is making a request. The other learns what the request contains.
The process has three stages. First, the wallet encrypts each request in such a way that only Zodl's gateway is able to open it. Second, the encrypted request travels to a relay operated by Cloudflare or Fastly, two large internet infrastructure companies. The relay can see the user's IP address, because the connection arrives from the user's device, but it cannot read what is inside the request. It removes identifying details and passes the message along.
Third, Zodl's gateway decrypts the request and forwards it to lightwalletd. At this point Zodl can see what the wallet is asking for, but the only address visible to it is that of the relay. The answer returns along the same path.
The outcome is a split of knowledge. Cloudflare or Fastly knows who is asking, Zodl knows what is being asked, and neither holds both facts at once. A server operator, or anyone who gained access to one operator's records, would therefore be unable to link a specific person to specific wallet activity from that operator's data alone.
The standard was not created for cryptocurrency. Oblivious HTTP is a general-purpose internet protocol, and its use here is an example of a wallet borrowing an existing, publicly specified building block instead of inventing a bespoke scheme. That has a practical benefit: the approach can be examined against a published specification, and the relay role can be filled by companies that already run this kind of infrastructure.
4. What OHTTP does not protect against
Trust is reduced under this model, not eliminated. The arrangement works only as long as the relay and the gateway do not cooperate. If the two operators combined their records, the IP address held by one could be matched to the request held by the other, and the user would be exposed. The project's own documentation acknowledges this and says the relay and gateway should be run by separate operators for that reason.
The relay also continues to see some information. It can observe when a user connects and roughly how much data moves in each direction. Timing and volume are weaker signals than the content of a request, but they are not nothing, and a sufficiently capable observer may be able to draw inferences from them.
For that reason OHTTP is better understood as a stronger starting point than as a complete answer. It is not a replacement for tools such as Tor against an adversary with the resources of a state. Users who are worried about that level of threat can still enable Zodl's Tor option on top of the new servers. In that configuration the relay would see only the address of a Tor exit node rather than the user's own IP address.
5. The surveillance that showed why metadata matters
Concern about network-level tracking is grounded in documented cases. In 2023 a Bitcoin developer known as b10c described an entity he called LinkingLion, which had been opening connections to many Bitcoin (BTC) nodes and recording which of them announced new transactions first.
That position is valuable to anyone who wants to trace payments. The node that first announces a transaction is often the one where it originated, so an observer listening widely enough can connect transactions to the IP addresses that produced them. The activity attributed to LinkingLion stretched back to 2018, meaning it had gone on for years before being publicly described.
Bitcoin was not the only network affected. The same ranges of IP addresses were also found connecting to nodes on Monero (XMR), a cryptocurrency built around privacy. The episode illustrated that strong cryptography on the ledger does not prevent an outside party from collecting information at the moment a transaction enters the network.
6. Bitcoin and other projects are closing the same gap
Zodl is not alone in treating the network layer as unfinished business. Bitcoin Core 31.0, released in April, introduced an opt-in feature called private broadcast. When it is enabled, the software sends a user's own transactions only over Tor or I2P, another anonymity network, and uses a separate connection for each transaction. The aim is to defeat exactly the kind of first-announcement monitoring that LinkingLion relied on.
The feature also showed how difficult this work is to get right. In June, a bug came to light that could reveal a sender's IP address: when a connection handshake failed, the software retried without routing the attempt through Tor. The flaw was corrected in version 31.1.
More demanding approaches exist as well. A mixnet sends traffic through several relays in sequence, pads data packets so they are all the same size, and inserts decoy messages, so that an observer watching the network cannot match what goes in with what comes out. The trade-off is speed. Mixing introduces delay, which makes these systems harder to use for everyday wallet activity where users expect quick responses.
7. Why the default setting is the real change
What sets the Zodl release apart is less the technology than the decision to apply it to every user automatically. Privacy features that must be found and switched on protect only the minority who know they exist. A protection that is active from the first launch covers people who have never thought about what their wallet reveals.
OHTTP suits that role because it is lightweight. It adds a single relay hop between the wallet and the server, far less overhead than a multi-relay system, so there is little performance cost to keeping it on permanently. That makes it practical as a baseline that sits beneath stronger, optional tools.
There is a tension in the approach. The design depends on Cloudflare or Fastly to act as one half of the split, and these are among a small number of companies that carry a large share of internet traffic. A privacy default that leans on the same few infrastructure providers creates a dependency of its own, since those providers are also in a position to refuse service.
8. What happens next?
The immediate next step is the completion of the rollout, with the new servers being enabled for Android and iOS users over the days following November 9. Because the code is new, its behaviour in wide use has yet to be observed over a long period.
Beyond Zodl, the question is whether other wallets adopt the same pattern. The method uses a published internet standard and open-source code, so there is no technical barrier to others following. If they do, shielding a user's IP address from their own wallet provider could become an expected feature rather than an optional extra.
The broader direction is clear. Efforts to protect users of cryptocurrencies have long concentrated on what is written to the blockchain. The work now under way on Zcash, Bitcoin and elsewhere reflects a recognition that the path a transaction takes to reach the network can disclose as much as the transaction itself.