Zcash Crash Wipes Billions After Four-Year Vulnerability Disclosure

A four-year-old vulnerability that could have fueled unlimited minting of ZEC was discovered in one of Zcash's private transaction pools—a core feature of the privacy-focused network—fueling investor panic and sending ZEC down more than 40% in a single day. The network's native token has fallen 35% in the last 24 hours, recently changing hands at $339. During the selloff, it briefly traded below $300, registering its lowest price since early April and cutting billions of dollars from its market cap. Prior to its steep decline, the token had ground up from below $200 in March to as high as $675 at the end of May. Now those gains are all gone—and investors who had been riding the coin's recent high are left wondering whether Zcash can ever regain that momentum. "The news came at a time when the privacy narrative was surging and ZEC was up about 3x since April, outperforming Bitcoin and other major cryptocurrencies," Bitwise Research Analyst Ish Asad told Decrypt. "As a result of that timing, ZEC plummeted 40%."

The ferocity of the drop also reflects the uncertainty hovering over the situation. Though the vulnerability was patched earlier this week, the design of the network means it's not yet certain whether malicious actors may have actually exploited the bug, which would have allowed them to mint counterfeit ZEC tokens. "The price reaction reflects that uncertainty more than the bug itself," Nicolai Sondergaard, a research analyst at blockchain analytics firm Nansen, told Decrypt. "A patched vulnerability in a minor privacy coin would ordinarily be a footnote," he added. "The -30% move is the market assigning non-trivial probability to the scenario where some counterfeiting did occur and is permanently undetectable without the proposed upgrade." The token, which nearly touched $700 in November and was recently back near that mark, has been one of crypto's top performers over the last year, jumping more than 580% during that time—even after accounting for its dramatic fall.

Zcash plunged double digits overnight after developers disclosed a critical vulnerability in the protocol's Orchard shielded pool that could have allowed undetectable counterfeiting for over four years. The privacy coin dropped from Wednesday's local top of $635 to an intraday low of $309 on Thursday, according to CoinGecko data. It has since recovered slightly to around $330, down 37.8% on the day.

But recapturing a bulk of its recent gains anytime soon seems unlikely, according to Jake Kennis, a senior research analyst at Nansen. Kennis cited the sizable price drop, plus growing trading volume on the move—over $3 billion in the last 24 hours, as of this writing. "It would likely require either a broader privacy coin narrative and need for privacy, a major protocol-level catalyst, or a larger rotation into privacy assets," he told Decrypt, adding that typically a token would need to "find its footing" after a selloff like this before it could rebound. In Asad's eyes, though, traders may be acting too quickly following the disclosure. "Oftentimes the market gets ahead of itself and reprices, sometimes dramatically, in real time," he said. "But the fundamental story does not change: Zcash is a clone of Bitcoin with added privacy/encryption features, which will have a market of its own."

BitMex founder Arthur Hayes falls into the camp acting out the real-time assessment, telling followers on social media on June 5, 2026, that he dumped his entire ZEC bag for profit partly because he "didn't appreciate how it violated his narrative mental map." The "Holy Trinity is dead," he posted, adding that while he thinks it's "extremely unlikely" any minting occurred, it cannot be formally cryptographically proved impossible. Nevertheless, the outspoken investor said "privacy is priceless"—a small comfort, presumably, for the bag he just sold.