Using a Zcash wallet is not only a matter of where the recovery material is stored. Each time the app asks a light-wallet server about the account, that server has been in a position to see both where the request came from and what the wallet asked.
On November 9, 2026, Foresight News reported that the Zcash wallet Zodl had posted about a change to that arrangement. Zodl said it was introducing self-operated wallet infrastructure and working with Cloudflare and Fastly to integrate the OHTTP protocol, so a user’s IP address is separated from the content of the wallet request.
Under the setup Zodl described, the wallet sends requests through independent relays operated by Fastly or Cloudflare. A relay can see the user’s IP but cannot see the encrypted request content. Zodl processes the request but cannot see the user’s original IP. That divides observation between two parties. It is not a statement that the connection carries no identifying information, and the report does not claim the change removes every privacy or custody risk.
Foresight News also noted the earlier boundary: the operator of a light-wallet server that a Zcash wallet connected to could see the user’s IP and the request information together. The new path is meant to stop any single one of these operators from holding both views at once.
Zodl said the infrastructure would be rolled out gradually over the following week. Updating to Zodl version 3.20.0 is what enables a user to use it. The report does not describe confirmed losses, an exploit, or any change to how a seed or other recovery material should be backed up. The only check it supports is installing that version once the rollout reaches the app; accessibility of the wallet service, confidentiality of the request, and redundancy of recovery backups remain separate concerns.
Source: Foresight News, published November 9, 2026, at 22:54 (UTC+8).
