Tag: Security & Hacks

  • Zcash Plummets, Erasing Billions in Market Cap—Can ZEC Rebound?

    Zcash Plummets, Erasing Billions in Market Cap—Can ZEC Rebound?

    Zcash Plummets After Discovery of Four-Year-Old Vulnerability

    Zcash (ZEC) experienced a dramatic price drop of over 40% in a single day following the revelation of a four-year-old vulnerability within one of its core privacy transaction pools. The flaw, which could have potentially allowed for the unlimited minting of ZEC, sent shockwaves through the investor community.

    The network’s native token has seen a 35% decline in the past 24 hours, recently trading around $339. During the sell-off, ZEC briefly dipped below $300, marking its lowest point since early April and erasing billions from its market capitalization. This sharp downturn follows a significant rally, where the token had climbed from below $200 in March to a high of $675 by the end of May.

    The recent gains have now been wiped out, leaving investors who had bet on the coin’s upward trajectory questioning Zcash’s ability to regain its momentum.

    “The news emerged at a time when the privacy narrative was gaining significant traction, and ZEC had already tripled its value since April, outperforming Bitcoin and other major cryptocurrencies,” Ish Asad, a research analyst at Bitwise Research, told Decrypt. “The timing of this disclosure is precisely why ZEC plummeted 40%.”

    The severity of the price decline is also attributed to the lingering uncertainty surrounding the situation. Although the vulnerability was patched earlier this week, the nature of the Zcash network means it remains unclear whether malicious actors may have exploited the bug to create counterfeit ZEC tokens.

    “The price reaction is more a reflection of that uncertainty than the bug itself,” explained Nicolai Sondergaard, a research analyst at blockchain analytics firm Nansen. “A patched vulnerability in a lesser-known privacy coin would typically be a minor issue. The 30% drop indicates the market is assigning a non-trivial probability to the scenario where some counterfeiting did occur and is permanently undetectable without the proposed upgrade.”

    Zcash, which had neared $700 in November and recently approached that level again, has been a standout performer in the cryptocurrency market over the past year, with gains exceeding 580%, even after accounting for its recent sharp decline.

    However, a swift recovery of its recent gains appears unlikely, according to Jake Kennis, a senior research analyst at Nansen. Kennis pointed to the substantial price drop and the significant increase in trading volume during the sell-off, which exceeded $3 billion in the last 24 hours as of this writing.

    “It would likely require either a broader resurgence of the privacy coin narrative and demand for privacy, a major protocol-level catalyst, or a larger rotation into privacy assets,” he told Decrypt, adding that a token typically needs to “find its footing” after such a sell-off before it can rebound.

    In contrast, Asad believes that traders may be reacting prematurely to the disclosure. “Often, the market gets ahead of itself and reprices assets, sometimes dramatically, in real time,” he stated. “But the fundamental story remains unchanged: Zcash is a clone of Bitcoin with added privacy and encryption features, which will carve out its own market.”

    BitMEX founder Arthur Hayes appears to be among those acting on this real-time assessment. He informed his social media followers that he had sold his entire ZEC holdings, partly because the exploit “violated his narrative mental map.” Despite this, Hayes asserted that “privacy is priceless” and indicated he would have no issue repurchasing ZEC at higher prices should the cryptocurrency recover.

    Meanwhile, the question arises whether other privacy coins could benefit from the fallout surrounding Zcash and attract traders disillusioned by the vulnerability. Nansen’s Kennis, however, does not foresee this happening in the immediate future.

    “I don’t believe a potential vulnerability in a privacy protocol like this would be seen as a positive catalyst for any of its competitors in the near term,” he concluded.

  • Hayes Sells Zcash, Bets Big on Worldcoin

    Hayes Sells Zcash, Bets Big on Worldcoin

    Hayes Ditches Zcash After Vulnerability Disclosures

    Arthur Hayes has announced that his fund, Maelstrom, has liquidated its entire Zcash (ZEC) holdings. The decision follows new disclosures regarding a vulnerability in the Zcash Orchard Pool, which Hayes believes has significantly heightened the perceived risk to ZEC’s monetary integrity. This move effectively marks the end of his recent “Holy Trinity” trade, which encompassed ZEC, NEAR, and HYPE. Worldcoin (WLD) remains the sole AI-linked asset in the fund’s portfolio, according to Hayes.

    “The Holy Trinity is dead,” Hayes declared on the social media platform X. “Sadly, due to the Orchard Pool exploit, I had to dump our entire ZEC bag.”

    The Orchard Pool Vulnerability and Market Reaction

    Hayes’ announcement came shortly after a detailed statement from Zooko Wilcox, Jason McGee, and Taylor Hornby, who characterized the issue as “The Orchard Counterfeiting Vulnerability.” According to their summary, Hornby discovered a critical flaw in Zcash’s Orchard pool on May 29. This vulnerability was disclosed to the Zcash Open Development Lab (ZODL), which then orchestrated an emergency response that concluded on June 2. The core of the problem, as stated, was that the vulnerability “could have been exploited to undetectably create an unlimited amount of counterfeit ZEC within Orchard.”

    This disclosure fundamentally altered the market’s perception. Earlier communications from the Zcash ecosystem had emphasized that the vulnerability had been fixed, with no evidence of exploitation and user funds remaining secure. However, Wilcox, McGee, and Hornby introduced a crucial caveat: due to the privacy features of Orchard, it is impossible to cryptographically prove whether the vulnerability was exploited during its existence.

    This distinction proved pivotal for Hayes’ decision to exit his Zcash position. “While I think it’s extremely unlikely of any minting, it cannot be formally cryptographically proved impossible,” Hayes explained. “The privacy from AI, govt, big tech narrative demands perfection not improbability. I read about the exploit yesterday, and didn’t appreciate how it violated my narrative mental map.”

    ZODL’s Explanation and the Impact of Uncertainty

    Josh Swihart, founder and CEO of ZODL, offered his perspective in a post titled “Never Again.” He described the Orchard bug as a failure in one of the system’s rules, noting that the rule was written with enough leniency to accept false information and still pass. Swihart clarified that the issue was not a privacy leak but a soundness failure within the proof system, a type of problem that can erode confidence in the possibility of invalid value creation within a shielded pool.

    The emergency fix necessitated a coordinated network-wide action, rather than a simple software update for wallets or applications. ZODL and the broader Zcash community temporarily disabled Orchard operations before restoring them with a corrected circuit. While the remediation addressed the vulnerability, the residual uncertainty surrounding the event cast a shadow over the privacy-focused asset. The absence of evidence of counterfeiting is not equivalent to a cryptographic guarantee that counterfeiting never occurred.

    Reassessment and Future Outlook

    Hayes indicated that the approximately 30% sell-off in ZEC prompted a reassessment of his position. “The 30% dump made me rethink, and I had to take profit on the entire position,” he stated. His rationale was not based on confirmed exploitation, but on the principle that the privacy thesis he associated with ZEC demanded a higher standard than probabilistic assurances.

    This sale marks a swift reversal from Hayes’ May 22 “Holy Trinity” call, where he had identified HYPE, ZEC, and NEAR as a promising trio. At the time, he had described HYPE as representing the on-chain derivatives and protocol revenue trade, NEAR as the AI and chain-abstraction play, and ZEC as the privacy component.

    Just a day prior to divesting his Zcash holdings, Hayes had already announced the sale of his HYPE and NEAR positions, citing rising energy prices, anticipated major AI initial public offerings, and political risks surrounding artificial intelligence as reasons for taking profits.

    Despite his exit from Zcash, Hayes has not entirely closed the door on the asset. “We will consistently re-evaluate our thinking and if my assumptions are proven incorrect, will rebuy, hopefully at lower prices,” he wrote. “Privacy is priceless and I have no issue eating humble pie and rebuying much higher.”

    For the time being, Worldcoin remains the sole public manifestation of his AI-linked investment strategy. “We still hold WLD and are excited for Lord Elon to pump our bags,” Hayes added, referencing recent speculation around AI assets and an OpenAI IPO that has fueled renewed interest in Worldcoin.

    At the time of reporting, ZEC had experienced a decline of over 45% in the preceding 24 hours.

  • ZCash Exploit Discovered, Scale Uncertain

    ZCash Exploit Discovered, Scale Uncertain

    Zcash Exploit Discovered by White-Hat Hacker Using Advanced AI

    A critical vulnerability in Zcash’s privacy-focused Orchard pool, which could have allowed for the minting of unlimited counterfeit ZEC, was discovered by security researcher Taylor Hornby. The exploit, which had been present for approximately four years, was identified using Anthropic’s Claude Opus 4.8 AI model. The Zcash ecosystem deployed an emergency fix on June 1, addressing the issue.

    The Nature of the Vulnerability

    The Orchard pool, Zcash’s most advanced shielded transaction layer launched in May 2022, utilizes zero-knowledge proofs to validate transactions without revealing sender, receiver, or transaction amounts. The flaw lay in a specific validation check for transaction inputs, which failed to enforce the intended rules. This allowed an attacker to submit false inputs that would still pass the validation, enabling the creation of ZEC out of thin air, with the zero-knowledge proof system erroneously marking the fraudulent transactions as legitimate.

    Hornby, working with Claude Opus 4.8, successfully developed a functional exploit that could generate unlimited, undetectable counterfeit ZEC. He promptly disclosed his findings to ZODL, Zcash’s development coordination body, instead of exploiting the vulnerability on the mainnet.

    Undetermined Impact Due to Privacy Features

    The very privacy features that make the Orchard pool valuable also render it impossible to cryptographically determine if the vulnerability was exploited between May 2022 and June 2026. The Zcash team, which hired Hornby, has stated that exploitation prior to the fix is unlikely. They cited the bug’s evasion of years of scrutiny from expert cryptographers, the necessity of cutting-edge AI tools for its discovery, and a narrow window for remediation. However, they cautioned that users should not solely rely on their assessment.

    Future Network Upgrades and Security Initiatives

    Shielded Labs is proposing a network upgrade that would introduce a new shielded pool and implement “turnstile accounting” for all existing Orchard pool coins. This mechanism would require every Orchard coin to pass through a verifiable checkpoint, thereby exposing any counterfeited supply. This proposal requires broad community governance support and will undergo the standard Zcash network upgrade process. A detailed proposal is anticipated next week.

    Furthermore, Shielded Labs is initiating a project to mathematically verify the entire Orchard circuit from the ground up. The organization is also actively recruiting for a Head of Security and a Cryptographer.

    Broader Implications for the Crypto Space

    This incident serves as a significant real-world demonstration of the capabilities of advanced AI models like Anthropic’s Claude Opus 4.8 when wielded by expert security researchers. Hornby discovered the four-year-old critical bug within 24 hours of Opus 4.8’s public release on May 28, a flaw that had previously withstood multiple rounds of expert human review.

    The discovery highlights the increasing importance of AI in cybersecurity and serves as a stark warning to all cryptocurrency protocols. The industry is urged to proactively engage white-hat hackers to test their own protocols for vulnerabilities, rather than risk exploitation by malicious actors. The evolving landscape suggests that the near-term stability of the broader crypto space may hinge on these proactive security measures.

  • Hayes Dumps Zcash After Four-Year Counterfeit Bug

    Hayes Dumps Zcash After Four-Year Counterfeit Bug

    Hayes Liquidates Zcash Holdings Amidst Protocol Vulnerability

    Arthur Hayes, co-founder of BitMEX, confirmed on Tuesday that he has divested his entire Zcash (ZEC) holdings following the discovery of a critical bug within the protocol’s Orchard Pool. The vulnerability, which affects Zcash’s core shielded transaction layer, compounds a challenging period for the cryptocurrency.

    This liquidation marks the complete unwinding of Hayes’s self-proclaimed “Holy Trinity” portfolio, which previously comprised HYPE and NEAR tokens.

    Hayes announced the move on social media, stating, “The Holy Trinity is dead. Sadly due to the Orchard Pool exploit, I had to dump our entire $ZEC bag. While I think it’s extremely unlikely of any minting, it cannot be formally cryptographically proved impossible – The privacy from AI, govt, big tech narrative demands perfection…”

    The market is now grappling with whether Hayes’s decision was a calculated assessment of protocol risk or a reactive sell-off triggered by a flaw that undermined his confidence in privacy-focused cryptocurrencies as a category. Evidence suggests the former, a distinction that holds significance for those interpreting his exit as a market signal.

    Orchard Pool Vulnerability Detailed

    The Orchard Pool represents Zcash’s latest generation of shielded transaction circuitry, introduced with the NU5 upgrade in May 2022. It superseded the older Sapling pool and incorporated trustless zk-SNARKs through the Halo 2 proving system, eliminating the need for a trusted setup. The pool’s primary function is to facilitate fully private transactions, making its cryptographic integrity the cornerstone of ZEC’s value proposition.

    The bug, identified on May 29, 2026, by Shielded Labs security engineer Taylor Hornby, was attributed to an insufficient constraint in elliptic-curve multiplication within the halo2_gadgets crate. Hornby utilized AI-assisted formal methods, including Anthropic’s Claude Opus 4.8, in his discovery.

    In simpler terms, the flaw meant that specially crafted inputs could theoretically circumvent the circuit’s validation checks, potentially leading to the creation of counterfeit ZEC that would still pass Orchard’s verification processes.

    An emergency hard fork was implemented on June 3, 2026, to address the vulnerability. However, the period between the NU5 activation in 2022 and the June 2026 patch represents nearly four years during which the bug remained undetected, despite undergoing multiple expert audits.

    Implications for Holders and Market Sentiment

    A crucial aspect for ZEC holders is that, due to Orchard’s privacy architecture, it is cryptographically impossible to definitively prove that no counterfeit ZEC was minted during the four-year window. While there is no evidence of exploitation, the inability to guarantee total supply integrity represents a fundamental challenge to the “sound money” narrative that Electric Coin Co. has cultivated around ZEC.

    Hayes had previously identified Zcash as a high-conviction holding, classifying it as part of his “Holy Trinity” alongside HYPE and NEAR, which he described as his asymmetric altcoin investments. He had already liquidated his positions in HYPE and NEAR before turning his attention to ZEC, a sequence that some interpret as a methodical risk reduction rather than a panicked reaction.

    Hayes’s ZEC exit followed the public disclosure of the Orchard bug and the June 3 hard fork, indicating that his decision was made after the vulnerability became known. His stated reason was direct: “The probability of unauthorized minting is extremely low, but it cannot be proven cryptographically impossible,” he explained. He further elaborated that “The narrative of protecting privacy from AI, governments, and Big Tech demands perfection, a standard the bug undermined.”

    This rationale is framed not as a trader’s justification but as a thesis-driven decision. Hayes’s investment in ZEC was predicated on privacy coins occupying a unique ideological and technical niche, one that demands absolute cryptographic certainty, a standard that the Orchard bug has now compromised.

    This pattern of investment and exit is familiar to followers of Hayes’s public portfolio movements. He typically demonstrates strong conviction, offers public endorsement, and then executes a clean exit when the underlying thesis falters. Whether this constitutes disciplined risk management or a “shill, pump, dump, repeat” cycle, as previously documented, is a matter of interpretation. However, the Orchard bug provides a more substantial fundamental rationale for this exit than many previous instances. Hayes continues to hold Worldcoin (WLD), which was not part of the Trinity framework.

    Market Reaction and Technical Outlook

    Following the public disclosure of the bug, ZEC experienced a significant price drop, falling between 30% and 36% from its recent highs. The cryptocurrency declined from over $600 to approximately $390, resulting in a market cap reduction exceeding $3 billion.

    The price action saw ZEC break below its 20-day, 50-day, and 100-day exponential moving averages (EMAs) in succession. Traders are now closely monitoring the 200-day EMA support level, situated near $367, as the next critical price point.

    Hayes’s own exit occurred on average trading volumes, suggesting that his position did not mechanically influence the price; the market had already begun pricing in the protocol risk prior to his announcement.

    The current technical outlook for ZEC remains bearish until the $430–$450 zone is reclaimed on a closing basis. A break below $367 would usher ZEC into uncharted technical territory with limited historical support to draw upon.

  • Zcash Plummets 38% on Critical Counterfeiting Vulnerability Disclosure

    Zcash Plummets 38% on Critical Counterfeiting Vulnerability Disclosure

    Zcash Suffers Double-Digit Plunge After Critical Vulnerability Disclosure

    Zcash experienced a significant overnight drop of more than 10% after developers revealed a critical vulnerability in the protocol’s Orchard shielded pool. The flaw, which had the potential to allow undetectable counterfeiting for over four years, sent the privacy coin’s value plummeting.

    According to CoinGecko data, Zcash fell from a local high of $635 on Wednesday to an intraday low of $309 on Thursday. The cryptocurrency has since seen a slight recovery, trading around $330, marking a 37.8% decrease for the day.

    Vulnerability Details

    The security flaw was identified on May 29 by researcher Taylor Hornby, who utilized AI-assisted auditing tools. The vulnerability was located within two lines of code in the Orchard circuit, the cryptographic component responsible for Zcash’s shielded transactions. It would have enabled a malicious actor to create counterfeit ZEC within the shielded pool without leaving any on-chain trace. If exploited before its discovery, there would have been no cryptographic means to prove that counterfeiting had occurred.

    Shielded Labs, the organization spearheading Zcash development, stated in a disclosure post that the vulnerability was present from Orchard’s activation in May 2022 until an emergency fix was implemented on June 1, 2026. “Due to the privacy properties of Orchard and the nature of the bug, there is no definitive way to determine, using only cryptography, whether such exploitation occurred,” the post read.

    Reignited Debate on Privacy Coin Risks

    The incident has intensified discussions surrounding a perceived structural issue within privacy coins. Critics argue that, unlike Bitcoin or Ethereum where on-chain exploits are readily apparent, privacy-focused cryptocurrencies like Zcash can conceal successful attacks, making detection impossible.

    “Zcash enables a unique class of bugs where if they’re exploited, no one would know,” commented crypto analyst Udi Wertheimer on social media. “This unique class still exists. The fact that they fixed this specific bug is immaterial.”

    Joe Andrews, CEO of Aztec Labs, a privacy-focused product studio, noted that under-constrained elliptic curve checks, the category of flaw at the core of this vulnerability, are a common weakness in ZK circuits. He added that AI is accelerating the discovery of such bugs across the industry. Andrews suggested that a long-term solution involves formal circuit verification coupled with a secondary proof system, an approach already being considered by Ethereum. “Both systems must agree for a state transition to be valid, which drastically lowers the chances of bugs being exploited,” he explained.

    Market Reaction and Potential Impact

    Arthur Hayes, former CEO of BitMEX, announced that he had divested his entire Zcash holdings following the disclosure. He expressed concern that while direct inflation from the exploit is unlikely, the Orchard pool itself could face insolvency. This could lead to the dilution of shielded ZEC holders if counterfeit assets were to compete with legitimate ones for a finite pool balance.

    However, not all industry figures share the same level of alarm. Craig Salm, chief legal officer at Grayscale, suggested that exploitation prior to the patch was improbable. He argued that proving such exploitation would require an individual to have a deeper understanding of the codebase than all core developers combined and to have resisted the temptation to drain the pool during a bull market. “Seems unlikely to me,” Salm tweeted.

    Proposed Solutions and Future Outlook

    Shielded Labs has put forth a proposal for a network upgrade that would introduce a new shielded pool featuring turnstile accounting. This mechanism would allow for independent verification of Zcash supply integrity.

    Andrews believes that the proposed upgrade, which mandates that all coins be unshielded before entering the new pool, effectively limits the risk of prior exploitation to the current volume of shielded assets. “Formal verification of the new upgrade reduces risks substantially further,” he stated.

  • Hayes Sells All Zcash Holdings Amid Major Flaw Discovery

    Hayes Sells All Zcash Holdings Amid Major Flaw Discovery

    Hayes Exits Zcash Holdings Amid Privacy Pool Vulnerability

    The cryptocurrency market was jolted on June 5 by the discovery of a significant vulnerability within Zcash’s Orchard privacy pool. The revelation prompted Arthur Hayes, co-founder of BitMEX, to liquidate his entire ZEC position mere hours after the flaw’s details became public.

    This sell-off has reignited a long-standing debate surrounding privacy-focused cryptocurrencies: can users truly trust systems where certain supply-related exploits might go undetected for extended periods?

    Hayes announced his decision on X, declaring “The Holy Trinity is dead” and confirming the sale of his ZEC holdings following reports of the Orchard Pool vulnerability. Zcash founder Zooko Wilcox and members of Shielded Labs initially disclosed the issue, noting that security researcher Taylor Hornby identified the flaw on May 29.

    According to the team, a malicious actor could have exploited this weakness to generate an unlimited supply of fake ZEC within Orchard, Zcash’s shielded transaction environment, without immediate detection.

    While developers acted swiftly to implement a fix by June 1, a critical concern remained: the inherently private nature of Orchard meant there was no cryptographic means to definitively prove whether the bug had been exploited prior to its resolution. This uncertainty appears to have been the decisive factor for Hayes.

    “While I think it’s extremely unlikely of any minting, it cannot be formally cryptographically proved impossible,” Hayes wrote, emphasizing that privacy-focused assets demand “perfection not improbability.”

    The market’s reaction was swift and severe. CoinGecko data indicated that ZEC plummeted by over 35% in the 24 hours leading up to the report, trading around $386 after reaching highs of $611 within the same timeframe. The token has also seen a nearly 27% decline over the past week and a more than 40% drop over two weeks. Trading activity surged by nearly 46% as investors scrambled to reassess risk, pushing daily spot volume above $1.7 billion.

    CoinGlass data revealed that the heightened volatility triggered approximately $49 million in liquidations over the past day, with long positions accounting for over $41 million of these losses.

    This marks the second instance in recent days where Hayes has divested a position shortly after expressing bullish sentiment. Just the previous day, he disclosed selling his HYPE and NEAR holdings, having previously projected HYPE could reach $150.

    The news of the vulnerability elicited varied responses from the crypto community. Investor Udi Wertheimer argued that privacy coins inherently carry a different risk profile than transparent blockchains, as counterfeit issuance can remain hidden for significant durations. He referenced a past Zcash inflation bug that was disclosed years after its existence.

    Others adopted a more tempered perspective. Mert Mumtaz, CEO of Helius, pointed out that major software bugs have been a recurring issue across the cryptocurrency landscape, including Bitcoin. He stated that the immediate priority is determining whether exploitation occurred before the patch was applied.

    Furthermore, Mumtaz highlighted that Zcash developers are already working on a future network upgrade designed to verify supply integrity through a migration to a new shielded pool.

    Barry Silbert, founder of Digital Currency Group, also countered the prevailing negative sentiment, asserting that the disclosure underscored Zcash’s robust security processes rather than revealing a systemic failure.

    “The AI-enabled assault on blockchains is here and I’m proudly on Team Zcash,” he posted.

  • Zcash Patches Critical Orchard Flaw, ZEC Defends $600

    Zcash Patches Critical Orchard Flaw, ZEC Defends $600

    Zcash Deploys Emergency Upgrade to Patch Critical Double-Spending Vulnerability

    Zcash has successfully patched a critical vulnerability within its privacy-focused infrastructure that could have potentially allowed for double-spending. The network underwent an emergency upgrade to prevent any exploitation of the flaw.

    Critical Bug Discovered in Orchard Pool

    On Wednesday, the Zcash Foundation announced that developers had resolved a significant vulnerability affecting the Orchard shielded pool. This flaw could have permitted invalid state transitions, thereby enabling the double-spending of funds within the pool.

    The vulnerability was reportedly discovered on May 29 by Zcash researcher Taylor Hornby, who is conducting an ongoing protocol audit for Shielded Labs. Hornby identified a critical soundness vulnerability in the Orchard zero-knowledge proof circuit and immediately disclosed the issue to Zcash Open Development Lab (ZODL) core engineers on the same day.

    “A soundness vulnerability is one that could allow the system to accept something it should reject,” the foundation explained. “In this case, successful exploitation could have allowed the Orchard pool to accept invalid state transitions, potentially permitting double-spending of funds within Orchard, though with no ability to inflate the total ZEC supply, which is protected by Zcash’s turnstile mechanism.”

    Coordinated Response and Network Upgrade

    Following the discovery, Zcash developers, miners, and infrastructure operators collaborated in a private, coordinated effort to develop and deploy a fix. Details were kept confidential to mitigate the risk of exploitation.

    An initial soft fork attempt encountered technical challenges. However, engineers swiftly released a revised patch that was successfully activated on June 2, temporarily suspending Orchard-related transactions. On June 3, the network completed a full hard fork upgrade, designated NU6.2, which restored Orchard functionality with the corrected code, permanently resolving the vulnerability.

    The Foundation stated that there is no evidence the bug was exploited, as no unauthorized value creation was detected. They also affirmed that the total ZEC supply remains secure and that the issue did not compromise the privacy of funds held in any Zcash pool.

    Network Confusion Amidst Upgrade

    Following the upgrade, reports of the Zcash network being offline circulated on social media, causing confusion among community members. Some claimed that Zcash had failed to produce blocks for over four hours.

    However, Mert Mumtaz, CEO of Solana infrastructure firm Helius, refuted these claims, stating that the network was never down and that explorer applications were connected to a faulty node.

    CipherScan, a Zcash blockchain explorer, confirmed the issue via a series of posts on X, explaining that its nodes were undergoing upgrades to support the recent NU6.2 network upgrade. “What actually happened: Zcash pushed a coordinated network upgrade (NU6.2) that required all node operators to update. During that transition, some block explorers, including ours, showed stale or missing data while we upgraded,” the post stated. “That’s the explorer being out of sync, not the blockchain being broken. Important distinction. (…) Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale.”

    ZEC Price Resilience Amidst Market Volatility

    Despite the temporary confusion, ZEC’s price demonstrated resilience, rallying over 8% intraday on Wednesday morning to retest the $636 level. The cryptocurrency had surged approximately 20% over the preceding two days while the broader market experienced declines.

    After failing to sustain the $630 resistance level, ZEC saw a brief dip toward the $600 support before rebounding. As of this writing, Zcash is trading at $612, marking a 9.5% increase over the past week.

  • Zcash Completes Landmark Upgrade, ZEC Price Surges

    Zcash Completes Landmark Upgrade, ZEC Price Surges

    Critical Flaw in Zcash Transaction System Patched in Emergency Upgrade

    The Zcash Foundation announced Wednesday that it has quietly addressed a critical vulnerability within the privacy cryptocurrency’s core transaction system, implementing a rare emergency network upgrade. The bug, discovered by a security researcher, could have potentially allowed malicious actors to spend funds they did not possess.

    The vulnerability was identified on May 29 by independent security researcher Taylor Hornby. It was located within the Orchard Action circuit, the cryptographic mechanism that powers Zcash’s most advanced privacy pool. The Orchard pool, introduced in 2022, is considered a cornerstone of Zcash’s privacy features, requiring no trusted setup and holding a substantial portion of the circulating ZEC tokens.

    Hornby reported the flaw to engineers at Zcash Open Development Lab (ZODL) the same evening. Within hours, a team of protocol developers confirmed the issue and initiated a carefully managed, confidential response aimed at preventing exploitation before a fix could be deployed.

    The coordinated repair process spanned five days. Initially, developers enacted an emergency soft fork, a temporary rule change that completely halted Orchard transactions while the patch was finalized. Private discussions with miners and exchanges commenced on the evening of May 31. An initial attempt to activate the fix encountered deployment challenges, but a second effort succeeded early Monday morning, effectively stopping all Orchard activity at block 3,363,426.

    A permanent solution was implemented on Wednesday with a full network upgrade, designated NU6.2. This upgrade restored Orchard functionality by incorporating a corrected circuit. Such a hard fork was deemed necessary because rectifying a zero-knowledge proof system requires updating a cryptographic verifying key, a change that cannot be achieved through standard software patches.

    Officials have stated that the total supply of ZEC was never compromised. Zcash’s internal “turnstile” mechanism, which monitors value across all transaction pools, confirmed that no unauthorized coins were generated. There is currently no evidence that the bug was ever exploited.

    Josh Swihart, founder of ZODL, described the operation on X, stating, “Given the time available and the number of parties involved (the devs at ZODL and Zcash Foundation, miners, exchanges, others), this was the most ambitious network upgrade in Zcash’s history.”

    The Foundation has urged all node operators to upgrade immediately to Zebra 5.0.0, the software release that implements the corrected network rules.

    Following the upgrade, some block explorers initially appeared to show a period of network inactivity, leading to speculation about downtime. However, experts and the block explorers themselves clarified that the network remained operational. The apparent lack of activity was attributed to block explorers temporarily pausing as they upgraded their own network nodes.

    CipherScan, a block explorer, explained on X, “Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale. The chain itself kept producing blocks the entire time. Miners didn’t stop. Transactions kept confirming.”

    The price of Zcash (ZEC) has shown no adverse reaction to the disclosure of the emergency upgrade. The privacy-focused coin has continued its recent upward trend, trading at approximately $629, marking a more than 10% increase over the past 24 hours and a 53% rise over the last 30 days. ZEC has surged 1,084% over the past year, reaching a recent high near $700, though it remains significantly below its all-time peak of $3,191 set in 2016.

  • Gravity Bridge Hit in $5.4 Million Exploit

    Gravity Bridge Hit in $5.4 Million Exploit

    Gravity Bridge Suffers $5.4 Million Exploit in Key Compromise Attack

    Gravity Bridge, a cross-chain protocol native to the Cosmos ecosystem, was targeted in a compromised-key attack over the weekend, resulting in the theft of approximately $5.4 million. This latest security breach adds to the escalating number of exploits plaguing the decentralized finance (DeFi) space in 2026.

    Attack Traced to Signing Key Compromise

    On Saturday, May 31st, blockchain investigator Specter reported that Gravity Bridge may have been exploited through a signing key compromise. A signing key compromise involves the unauthorized disclosure or theft of a cryptographic key, enabling an attacker to decrypt sensitive information, forge digital signatures, or gain unauthorized access to systems and funds.

    The stolen assets included approximately $4.3 million in USDC, 274 wrapped Ether valued at roughly $553,000, $434,000 in USDT, and 14.16 PAXG tokens, worth about $64,000. According to security firm PeckShield, the attacker has laundered a portion of the stolen funds through the ChangeNOW and Binance exchanges but still holds over 2,100 Ether, valued at approximately $4.23 million.

    The Gravity Bridge team confirmed the attack on Saturday, advising validators and orchestrators to halt operations while investigating the exploit. “Thanks to the swift action of validators, the bridge is currently halted while investigations continue,” the protocol announced on social media.

    Gravity Bridge functions by locking tokens on the Ethereum network and creating replicas of the crypto assets on the Cosmos network, relying on validator signatures to authorize each transfer. If a bad actor obtains the appropriate signing keys, the protocol would treat even forged transactions as legitimate.

    Crypto Bridge Vulnerabilities Highlighted

    If confirmed as a key compromise, the Gravity Bridge incident aligns with the trend of crypto bridge attacks, where breaches often stem from access control vulnerabilities rather than flaws in the underlying smart contract code. This pattern is evident in most recent exploits, including the $292 million Kelp DAO attack.

    DeFi Sector Faces Mounting Security Challenges

    The $5.4 million Gravity Bridge hack contributes to the growing list of attacks impacting the crypto industry, particularly the DeFi sector, in 2026. Bridges have proven to be a frequent target for attackers during this period. A TRM Labs report identified April 2026 as the most heavily targeted month, with the highest number of incidents in crypto history. These attacks included the aforementioned Kelp DAO hack and the $285 million loss suffered by Drift Protocol.

  • DxSale Exploit Hits Liquidity Providers for $7.3 Million

    DxSale Exploit Hits Liquidity Providers for $7.3 Million

    More than 1,400 liquidity pools associated with outdated DxSale contracts on BNB Chain were exploited in a $7.3 million attack, according to blockchain security firms on May 29.

    Growing Threat

    The attack contributes to a rising number of DeFi breaches this month, prompting security experts to caution that older smart contracts and inadequate access controls are leaving protocols vulnerable.

    Attack Details

    According to the on-chain security account PeckShieldAlert, a user identified as “Tahax” first discovered the exploit. Their report indicates that attackers targeted at least 1,400 old DxSale liquidity pool contracts on BNB Chain, extracting approximately $7.3 million worth of cryptocurrency. The stolen funds were then routed through AnySwap in an attempt to conceal the transaction trail.

    PeckShield further noted that an address identified as “0xC457…FA69” transferred 2,958 BNB from the hack, valued at $1.87 million, into two primary wallets. These wallets subsequently moved the funds through several deposit addresses on Binance.

    DxSale is a launchpad platform that allows crypto projects to create tokens and liquidity pools without developing their own infrastructure. The platform was popular about five years ago, with many projects launching tokens on BNB Chain locking their liquidity pools with the protocol.

    According to Tahax, the locker still held liquidity pools from projects that had been untouched for years, with founders and holders believing they were secure. However, nearly nine months ago, the DxSale deployer transferred ownership of the locker to a new wallet without any public announcement or migration notice. The on-chain investigator claims that the locker contract was unverified and likely contained a backdoor, which the attacker exploited.

    Two days prior, 0xC457…FA69, a new wallet funded from Bybit and possibly routed through AnySwap, reportedly took ownership of the locker and, within hours, began draining the liquidity pools.

    DxSale has yet to release a statement regarding the exploit.

    Broader Context

    The DxSale hack is part of a larger trend. The crypto sector lost at least $650 million in April due to similar incidents. May has also seen its share of attacks, including one last week where an individual stole over $11 million from the Verus bridge by exploiting a flaw in its payment verification process. Security researchers reported that the attacker submitted a small transaction that passed verification while still unlocking large withdrawals from the bridge’s reserves.

    Earlier in the month, liquidity provider TrustedVolumes was also hit for approximately $5.9 million after a hacker exploited weaknesses in its custom settlement system. Analysts pointed out that the exploit succeeded because the protocol checked authorization against one address while pulling funds from another.

    THORChain was also affected, with on-chain sleuth ZachXBT stating it may have lost over $10 million, causing its RUNE token to plummet 15% within minutes.

    This ongoing series of exploits has prompted a reaction, with OpenZeppelin co-founder Manuel Aráoz declaring “all of DeFi unsafe,” arguing that AI-assisted attackers are discovering vulnerabilities faster than security teams can fix them.