TheBlock
Cypherpunk Technologies (CYPH), the Nasdaq-listed Zcash treasury company, watched its shares fall more than 40% on Friday while $ZEC itself dropped over 50% as traders reacted to the disclosure of a counterfeiting vulnerability in Zcash's Orchard shielded pool. The bug, disclosed by Zcash co-founder Zooko Wilcox-O'Hearn alongside researchers Jason McGee and Taylor Hornby, could in theory have allowed an attacker to mint unlimited counterfeit ZEC inside Orchard; an emergency network upgrade patched it, and the foundation says there is no evidence it was ever exploited. Liquidations across derivatives markets topped $100 million during the move.
Despite that drawdown, Cypherpunk said it remains firmly committed to its target of accumulating 5% of Zcash's fixed 21 million token supply. The company currently holds 314,185.70 ZEC, or roughly 1.88% of circulating supply — meaning another ~736,800 ZEC still stands between today's stack and the stated goal. CIO Will McEvoy framed the disclosure as evidence of the network's security maturity rather than a structural flaw, telling The Block that Zcash "just demonstrated the institutional-grade security culture that will survive the AI era."
Why it matters
Cypherpunk is the largest of only two known public-company vehicles for ZEC exposure — Reliance Global Holdings (EZRA) reported just 213.14 ZEC as of March 31, 2026 — which means CYPH is effectively the price-setting marginal buyer for institutional ZEC accumulation. Its $77.2 million Q1 2026 net loss, driven largely by unrealized ZEC mark-to-market, makes the "hold through drawdowns" thesis the load-bearing assumption of the entire corporate-treasury accumulation playbook for privacy assets. Cameron Winklevoss publicly reinforced that stance, posting that "in the age of AI, formal verification is the way forward for securing software and Zcash is leading the way," and pointing to the network's next upgrade as the point at which "print money bugs in shielded pools" become mathematically impossible.
Market impact
Cypherpunk's framing — "finding a bug isn't a security failure.
Frequently asked questions
-
What bug caused the Zcash selloff?
A counterfeiting vulnerability in Zcash's Orchard shielded pool, disclosed by Zooko Wilcox-O'Hearn alongside researchers Jason McGee and Taylor Hornby. An emergency network upgrade patched it, and the Zcash foundation said there is no evidence it was ever exploited.
-
How much ZEC does Cypherpunk currently hold?
Cypherpunk Technologies holds 314,185.70 ZEC, roughly 1.88% of circulating supply, against a stated target of accumulating 5% of Zcash's fixed 21 million token supply.
-
Did the bug weaken Zcash's long-term thesis according to Cypherpunk?
No. CIO Will McEvoy said Zcash "just demonstrated the institutional-grade security culture that will survive the AI era," and Cameron Winklevoss argued formal verification in the next upgrade will make shielded-pool "print money bugs" mathematically impossible.
-
What were the financial damage and market reaction?
CYPH shares fell more than 40% on Friday, $ZEC dropped more than 50%, and derivatives liquidations topped $100 million. Cypherpunk reported a $77.2 million Q1 2026 net loss, largely from unrealized ZEC mark-to-market.
-
Are there other public companies with ZEC exposure?
Yes — Reliance Global Holdings (EZRA) is the second known public-company ZEC holder, with 213.14 ZEC as of March 31, 2026. Its shares fell only about 2% on Friday, reflecting the much smaller size of its ZEC position.
CoinDesk
CryptoSlate
WuBlockchain
WatcherGuru
Altcoin Daily