The stock hit an intraday low of $0.53 before recovering to approximately $0.59 in the same session, marking its lowest level since early March 2026. The sell-off followed public disclosure of a flaw in the Orchard zero-knowledge proof circuit that, in theory, could have allowed an attacker to mint unlimited counterfeit ZEC within the shielded pool without detection. ZEC itself fell roughly 38% on the day, dropping from a session high near $635 to an intraday low around $309.

---

What the bug actually did and did not do

The vulnerability involved two lines of code in the halo2_gadgets cryptographic library, specifically an under-constrained elliptic curve check that governs how the Orchard shielded pool verifies transactions. The flaw survived four years of external audits and academic review undetected since Orchard's launch in May 2022.

At the time of disclosure, the Orchard shielded pool held more than 30% of ZEC in circulation, approximately 4.9 million ZEC, illustrating the scope of what was theoretically at risk of internal counterfeiting. The bug could have allowed counterfeit ZEC to circulate inside the shielded pool without an on-chain signature. It could not, however, inflate Zcash's total supply. A protocol-level accounting mechanism called the turnstile prevented any fake coins from crossing out of the shielded pool into the transparent layer. The distinction matters: counterfeiting within the shielded pool and inflating the total on-chain supply are fundamentally different outcomes, and the vulnerability was limited to the former.

Developers discovered the bug on May 29. An emergency soft fork disabled Orchard transactions at block 3,363,426 on June 2, and the permanent fix, a hard fork called NU6.2 (or Network Upgrade 6.2), activated at block 3,364,600 on June 3. Public disclosure followed two days later, on June 5.

Shielded Labs acknowledged there is "no definitive way to determine using only cryptography whether such exploitation occurred before the vulnerability was discovered and fixed," though Cypherpunk Technologies stated there is zero evidence of exploitation.

Security researcher Taylor Hornby identified the flaw during an independent audit for Shielded Labs, using Anthropic's Claude Opus 4.8 as part of the review. The same AI model was used to write a working proof-of-concept exploit that successfully generated counterfeit ZEC in a local test environment. The discovery is a notable example of AI tooling surfacing a production zero-knowledge circuit vulnerability.

---

Cypherpunk pushes back

Cypherpunk Technologies was rebranded from a biotech-adjacent holding company in late 2025 to pursue a Zcash treasury strategy modelled on MicroStrategy's Bitcoin accumulation approach. The company retains a subsidiary cancer drug pipeline alongside its digital asset holdings, a dual identity that shapes how investors and analysts read its ZEC commitment.

Cypherpunk currently holds 314,185.70 ZEC, or roughly 1.88% of circulating supply, at an average purchase price of $337.86 per coin. At approximately $329 per ZEC at one point during the June 5 session, the market value of those holdings stood near $103.3 million, though that figure shifted materially given intraday volatility that ranged from roughly $309 to $442 across the day. Zcash's market capitalisation stood near $5.06 billion before the sell-off.

The company reported a Q1 2026 net loss of $77.2 million, reflecting ZEC price weakness during the January-through-March reporting period.

Despite the losses, Cypherpunk CIO Will McEvoy was direct in his response to the sell-off. "We are firmly committed to our 5% network accumulation target, as Zcash just demonstrated the institutional-grade security culture," he said. "Short-term price action is noise, and our long-term capital allocation strategy remains unchanged."

The company invested $5 million in the Zcash Open Development Lab (ZODL) in March 2026, alongside co-investors including a16z, Winklevoss Capital, Coinbase, and Paradigm. ZODL supports core Zcash protocol development and the Zodl wallet.

Not everyone shared Cypherpunk's conviction. Former BitMEX CEO Arthur Hayes exited his full ZEC position following the disclosure, triggering a secondary wave of selling. Hayes stated his reasoning directly: "The Holy Trinity is dead... it cannot be formally cryptographically proved impossible." In zero-knowledge proof systems, the Holy Trinity refers to the three foundational properties of completeness, soundness, and zero-knowledge that together guarantee a proof is both correct and private. For Hayes, the inability to rule out past exploitation retroactively was sufficient reason to abandon the position.

Grayscale CLO Craig Salm offered a more measured view, calling exploitation "[u]nlikely, requiring someone to surpass core developer scrutiny then resist draining the pool during bull markets."

Crypto commentator Udi Wertheimer added a pointed structural observation: "Privacy coins enable a unique class of bugs where if exploited, no one would know." The remark captured a sceptical position that the disclosure is likely to keep in circulation well beyond the immediate sell-off.

---

Regional stakes

The disclosure lands unevenly for users outside the United States. In India, the Financial Intelligence Unit issued a directive on January 25, 2026 restricting exchange activity in privacy coins including ZEC, with a partial softening arriving in a clarification issued on March 10, 2026. The admission that Orchard exploitation cannot be ruled out cryptographically is likely to reinforce regulator skepticism ahead of any future policy review. Indian retail holders already face constrained access via regulated platforms.

In Nigeria, where Zcash Community Grant-funded programs have built grassroots adoption among students, freelancers, phone sellers, and small traders, community educators will need to communicate the technical nuances clearly and quickly. The distinction between "possible counterfeiting inside the shielded pool" and "total supply inflation" is not intuitive, and misinformation spreads fast in high-trust peer networks.

South Africa's Zcash community, which launched formally in May 2026 and is planning its first university outreach event, faces a test of credibility at the worst possible moment. The rapid patch and transparent disclosure could, with careful framing, become a demonstration of protocol maturity rather than a source of doubt.

---

What comes next

Shielded Labs has proposed a follow-on network upgrade that would redeploy the shielded pool with turnstile accounting, expand formal verification of the Orchard circuit, and add dedicated security staff including a Head of Security and a cryptographer. The practical question for developers integrating ZEC in South Asia and Africa is how quickly that upgrade arrives and whether it delivers cryptographically verifiable supply proof. That timeline will shape confidence in Zcash's core value proposition as much as any recovery in token price.