A critical bug in Zcash's Orchard shielded pool, undetected since its launch in May 2022, allowed the theoretical minting of counterfeit tokens. The flaw was discovered by researcher Taylor Hornby on May 29 during a commissioned audit using AI-assisted tools.
The news sent ZEC into a tailspin, with an intraday drop of up to 57%, sliding from around $640 to as low as $250. Cypherpunk Technologies, a firm with significant ZEC holdings-estimated between 203,000 and 290,000 tokens-saw its shares plummet roughly 37% to 40%. An emergency network upgrade, NU6.2, was activated between June 1 and June 3, patching the vulnerability.
Rather than shying away, Cameron and Tyler Winklevoss publicly endorsed Zcash. They framed the incident as proof of the network's robust security, highlighting the swift audit and fix. The twins called for improved supply verification and formal verification for future upgrades. Their backing is significant given their co-founding of Gemini and their financial ties to Cypherpunk Technologies.
The episode underscores the inherent tension in privacy coins: cryptographic complexity enables privacy but complicates supply verification. The market has repriced risk, with ZEC's drop reflecting that uncertainty.