Cameron Winklevoss has come out in support of Zcash following the discovery of a severe vulnerability that sent the privacy token into a tailspin. The bug, which lay hidden in the Orchard shielded pool for four years, could have allowed the creation of unlimited counterfeit ZEC. Winklevoss emphasized that while all blockchains face bugs, what matters is the response. He pointed to Zcash’s commitment to security research as evidence of its resilience.
The bug was uncovered by security researcher Taylor Hornby during an AI-assisted audit on May 29. Shielded Labs confirmed that Hornby demonstrated the exploit in a test environment, generating fake ZEC without detection. An emergency patch was deployed by June 2, temporarily suspending Orchard activity before restoring it with corrected code. However, due to the privacy features of Orchard, it is impossible to cryptographically prove whether the exploit was used in the wild before the fix.
Market reaction was swift and severe. Zcash plunged over 45% to a low of $264.80 before recovering slightly to around $361. Shares of Cypherpunk Technologies, a company focused on accumulating ZEC, tumbled 37% to $0.59. Gemini-linked shares also fell. BitMEX co-founder Arthur Hayes sold his entire ZEC position, stating that the uncertainty undermined the privacy narrative he had invested in. He noted that the inability to prove innocence was unacceptable for a privacy coin.
Cypherpunk Technologies pushed back against fears of a supply inflation, stating there is zero evidence that the bug was exploited. The company argued that an attacker would have little incentive to hold counterfeit coins during a bull market. The Zcash Foundation released Zebra 5.0.0 via the NU6.2 hard fork, re-enabling Orchard with a corrected circuit, and stated no unauthorized value creation was detected.
Winklevoss’s defense highlights the ongoing tension between privacy coins and the expectation of perfection. While the bug was patched, the episode raises questions about the trustworthiness of privacy-focused protocols that cannot fully audit their own supply. The market’s panic reflects deep uncertainty, even as developers insist the network is now secure.