Cypherpunk Defends Zcash After Bug, Stays Committed to 5% Supply Target

Cypherpunk Technologies (CYPH), a Nasdaq-listed Zcash treasury company, saw its shares fall more than 40% on Friday as investors reacted to the disclosure of a critical bug that was recently patched in the privacy-focused cryptocurrency. The (ZEC) token itself also fell more than 50% during the selloff. Nothing like a vulnerability disclosure to remind everyone that "fixed supply" still depends on the software actually working.

The decline followed the disclosure of a counterfeiting vulnerability in Orchard, Zcash's shielded pool. The bug could have been exploited to undetectably create an unlimited amount of counterfeit ZEC tokens within Orchard, according to a post by Zooko Wilcox-O'Hearn, Zcash co-founder and Shielded Labs head, alongside researchers Jason McGee and Taylor Hornby. The vulnerability was fixed through an emergency network upgrade, and the foundation said there is no evidence it was ever exploited.

Despite the recent developments and market reaction, Cypherpunk remains confident in Zcash's long-term outlook. "Please stop the FUD," the company wrote in one X post. It also remains committed to its goal of accumulating 5% of Zcash's fixed supply of 21 million tokens. Cypherpunk currently holds 314,185.70 ZEC, representing about 1.88% of the cryptocurrency's circulating supply.

"We are firmly committed to our 5% network accumulation target, as Zcash just demonstrated the institutional-grade security culture that will survive the AI era," Will McEvoy, chief investment officer of Cypherpunk, told The Block. "Cypherpunk's investment thesis is multi-year and centered on Zcash's position as the leading private, censorship-resistant store of value. Short-term price action is noise, and our long-term capital allocation strategy remains unchanged," McEvoy added. Spoken like someone who has stared at a red candlestick before and blinked first.

In a section it could have titled "Finding a bug isn't a security failure," Cypherpunk argued in a series of X posts that major cryptocurrencies, including bitcoin and Monero, have experienced vulnerabilities in the past and that the latest Zcash incident should not be viewed as a failure of the network. "Finding a bug isn't a security failure. Not looking is," the company wrote, arguing that advances in AI will increasingly help security researchers identify vulnerabilities across the crypto industry.

Cypherpunk further pointed to network activity, saying usage of the shielded pool has remained largely stable despite the disclosure. The company also highlighted ongoing work by Zcash development teams toward formal verification of Zcash's shielded pool, which it says would provide mathematical assurances that the underlying zero-knowledge circuits are free from certain classes of bugs. In other words, fewer "whoops" moments in the future.

Cypherpunk is the largest and one of only two known Zcash treasury companies. In its latest first-quarter 2026 earnings report released last month, Cypherpunk reported a net loss of $77.2 million, largely due to unrealized losses on its ZEC holdings. A paper loss, but paper has weight when the stack is large enough.

Beyond accumulating ZEC, Cypherpunk has also expanded its investment in the broader Zcash ecosystem. In March, the company invested $5 million in Zcash Open Development Labs, or ZODL, alongside investors including a16z crypto, Winklevoss Capital, Coinbase, and Paradigm. Cypherpunk itself is backed by Winklevoss Capital, the investment firm of Gemini founders Cameron and Tyler Winklevoss, among other investors.

The Winklevoss brothers also appear unfazed by the recent Zcash developments. "In the age of AI, formal verification is the way forward for securing software and Zcash is leading the way," Cameron Winklevoss wrote in an X post. He noted that Zcash plans to introduce formal verification in its next network upgrade, which he said would make "print money" bugs in shielded pools impossible. "Encrypted money with provable correctness is unstoppable," Winklevoss added. A pitch that ages well, assuming the proofs check out.

The second public company with ZEC exposure is Reliance Global Holdings (EZRA), though its holdings are far smaller. According to Reliance's latest quarterly report, it held 213.14 ZEC as of March 31, 2026. Reliance shares were down about 2% on Friday, a much smaller decline than Cypherpunk's, reflecting the relatively modest size of its position. Sometimes the smallest bag carries the least drama.