The 6.36 release is a hardening release. Most of the work came out of a security and correctness review of the whole wallet, so the changes are many and small, and the ones you will notice are on the sync bar, the send page and the network settings.

Released 2 November 2026 as 6.36.0.

Auto and manual sync are told apart

A sync that Zkool starts by itself and one you asked for used to look the same: both retried for ever behind an error dialog, and the only way to stop either was a button in the Settings that also turned auto sync off.

Each sync now knows which kind it is. An automatic sync that fails stops with a short message and the next height check tries again. A manual sync retries up to ten times, shows the attempt and the wait on the account page's sync bar, and only opens a dialog when it gives up.

The sync bar and both sync icons on the app bars offer a cancel while a sync is running, waits included. Cancelling an automatic sync asks whether to turn auto sync off; the cancel button of the Settings page is gone. See Synchronization.

The run itself is stricter about what it calls done. A sync that does not reach the height it asked for, because the stream ended early, the server failed or stalled, fails with both heights in the message instead of reporting Synced. A reorg is absorbed by rewinding and rescanning; the same reorg twice is an error. One transaction whose details cannot be fetched no longer holds up the others.

Every stored transparent address is scanned on every sync. Until now only the newest 100 receive and 100 change addresses were, so a payment to an older address stayed invisible until a rewind. The limit, and the transparentLimit argument of the GraphQL synchronize mutations, are gone.

Every request follows the transport

With Tor or a proxy selected, a handful of requests still went out directly: the server list, the Sapling parameters, plugin downloads, the price and candle lookups, and the voting discovery, which let the vote servers see the wallet's address moments before the vote arrived over Tor. All of them now go through the selected transport, and with Nym they fail closed rather than leak. An https:// proxy is spoken to over TLS, and the user and password in its URL reach the proxy. See Using TOR.

Picking a server from the list in the Settings now lands in the settings draft, like every other setting, and is saved when you leave the page. It also turns the Light Node switch on, since the list only holds lightwalletd servers. Leaving the Settings waits for the save and reports a failure instead of dropping it.

A plugin is only downloaded over HTTPS, or over plain HTTP from localhost.

Multisig sessions survive a crash

A DKG or signing message is now committed to the wallet, with its note locks, before it is broadcast, and resent on every pass until it is mined. A crash between the two no longer makes the next pass spend the same notes again, and a message whose transaction expires is rebuilt instead of waited on for ever.

A DKG and a signing session cannot run at the same time, and starting a session while one exists is an error. If two different key packages claim the same participant's slot, the DKG stops with the round and the participant named rather than keeping whichever came first. A group transaction with Sapling inputs or outputs is refused when the session is created, since a group account is Ironwood-only. Leaving a DKG page while its setup is still running no longer leaves a stray result behind. See MultiSig Accounts.

The PIN lock covers every page

The mempool transaction view, the contacts, the ZSA holdings and issuance pages, the note migration page and the voting pages now lock with the rest of the wallet. The Settings stay usable while locked, but the Pin Lock and Cloud Vault switches, the Database Manager and the proxy credentials refuse input. A PIN-protected wallet no longer paints its account list for one frame before the lock resolves. See Security.

Send page

• The page runs one lookup at a time and is locked while one is pending, so an OpenAlias answer cannot land in a field you have already changed. A spinner shows after a second of waiting; a lookup is bounded at 20 seconds.
• @contact, !account and #alias resolve exactly, and a resolved reference replaces a memo typed for an earlier address instead of carrying it over unseen. See Contacts.
• Sprout addresses and addresses of the wrong network are refused as you type, on the send form and in the contact picker.
• The fiat amount field accepts a comma decimal like the ZEC field, and an exchange rate of zero is flagged instead of breaking the conversion.
• Editing a queued recipient keeps its ZSA asset and amount.
• A transaction the node accepted is reported as sent even when the wallet's own bookkeeping fails afterwards, so it is not sent twice.

Also

• Transparent scan: closing the dialog stops the scan, a cancel ends a scan whose server never answers, a stopped sweep still moves the receiving index past the used addresses, and a failed scan says so instead of "Scan Completed".
• Restoring an account without a birth height now says that the account is born at the chain tip and how to change it in the account editor.
• The address browser lists the addresses of an incoming-only account.
• A WIF key with a marker other than 01 is refused. A stored key that is not a key is an error naming the account, at import and at every load, so the wallet opens and the account can be deleted.
• A wallet with more than 255 accounts lists them again.
• Restoring a database also removes the voting sidecar of the previous contents, and accounts from one seed at different indices keep separate voting records.
• ZSA: an asset first seen in a transfer is reconciled when its issuance is scanned, a payment may name up to 254 assets, and the fee of a ZSA payment is priced for the Orchard change it actually uses.
• A Ledger reply shorter than its status word is an error instead of a crash that disabled the device until a restart.
• The animated QR scanner starts every scan with a fresh decoder, so a second transfer after a completed or abandoned one decodes.
• GraphQL: a negative birth height or account index is refused, FROST and DKG are disabled on a token-authenticated server, the mempool monitor retries at a pace instead of stopping on a connect failure, and broadcastTx locks the spent notes when given the account.