Cypherpunk Technologies (CYPH), a Nasdaq-listed Zcash treasury company, saw its shares fall more than 40% on Friday as investors reacted to the disclosure of a critical bug that was recently patched in the privacy-focused cryptocurrency. The ($ZEC) token itself also fell more than 50% during the selloff.
The decline followed the disclosure of a counterfeiting vulnerability in Orchard, Zcash’s shielded pool. The bug could have been exploited to undetectably create an unlimited amount of counterfeit $ZEC tokens within Orchard, according to a post by Zooko Wilcox-O’Hearn, Zcash co-founder and Shielded Labs head, alongside researchers Jason McGee and Taylor Hornby. The vulnerability was fixed through an emergency network upgrade, and the foundation said there is no evidence it was ever exploited.
Despite the recent developments and market reaction, Cypherpunk remains confident in Zcash’s long-term outlook.
“Please stop the FUD,” the company wrote in one X post. It also remains committed to its goal of accumulating 5% of Zcash’s fixed supply of 21 million tokens. Cypherpunk currently holds 314,185.70 $ZEC, representing about 1.88% of the cryptocurrency’s circulating supply.
“We are firmly committed to our 5% network accumulation target, as Zcash just demonstrated the institutional-grade security culture that will survive the AI era,” Will McEvoy, chief investment officer of Cypherpunk, told The Block.
“Cypherpunk’s investment thesis is multi-year and centered on Zcash’s position as the leading private, censorship-resistant store of value. Short-term price action is noise, and our long-term capital allocation strategy remains unchanged,” McEvoy added.
‘Finding a bug isn’t a security failure’
In a series of X posts, Cypherpunk argued that major cryptocurrencies, including bitcoin and Monero, have experienced vulnerabilities in the past and that the latest Zcash incident should not be viewed as a failure of the network. “Finding a bug isn’t a security failure. Not looking is,” the company wrote, arguing that advances in AI will increasingly help security researchers identify vulnerabilities across the crypto industry.
Cypherpunk further pointed to network activity, saying usage of the shielded pool has remained largely stable despite the disclosure. The company also highlighted ongoing work by Zcash development teams toward formal verification of Zcash’s shielded pool, which it says would provide mathematical assurances that the underlying zero-knowledge circuits are free from certain classes of bugs.
Cypherpunk is the largest and one of only two known Zcash treasury companies. In its latest first-quarter 2026 earnings report released last month, Cypherpunk reported a net loss of $77.2 million, largely due to unrealized losses on its $ZEC holdings.
Beyond accumulating $ZEC, Cypherpunk has also expanded its investment in the broader Zcash ecosystem. In March, the company invested $5 million in Zcash Open Development Labs, or ZODL, alongside investors including a16z crypto, Winklevoss Capital, Coinbase, and Paradigm.
Cypherpunk itself is backed by Winklevoss Capital, the investment firm of Gemini founders Cameron and Tyler Winklevoss, among other investors. The Winklevoss brothers also appear unfazed by the recent Zcash developments.
“In the age of AI, formal verification is the way forward for securing software and Zcash is leading the way,” Cameron Winklevoss wrote in an X post. He noted that Zcash plans to introduce formal verification in its next network upgrade, which he said would make “print money” bugs in shielded pools impossible.
“Encrypted money with provable correctness is unstoppable,” Winklevoss added.
The second public company with $ZEC exposure is Reliance Global Holdings (EZRA), though its holdings are far smaller. According to Reliance’s latest quarterly report, it held 213.14 $ZEC as of March 31, 2026. Reliance shares were down about 2% on Friday, a much smaller decline than Cypherpunk’s, reflecting the relatively modest size of its $ZEC exposure.
