Brutal Zcash Bug Sat Hidden for 4 Years

A critical zero-knowledge proof vulnerability in Zcash's Orchid privacy layer, which allowed for undetectable infinite minting of ZEC, remained undetected for four years—until it was disclosed in June 2026. Initially downplayed by the Zcash Foundation as a double-spending bug with no supply inflation, the truth emerged only after founder Zuko Wilcox clarified that counterfeit ZEC could have been created without trace. This revelation triggered a 30% one-day crash—the worst in Zcash’s history—exacerbating broader crypto sell-offs. The market’s reaction exposed a deeper crisis: trust in crypto’s 'trustless' promise now hinges on faith in developers and auditors, especially after a second major trust event—the infamous key ceremony. Meanwhile, Polymarket faced backlash when its UMA oracles ruled that MicroStrategy’s Bitcoin sale didn’t count because it wasn’t publicly confirmed by the deadline, despite the company’s own filing proving the sale occurred. Traders called it a 'scam' and a 'retroactive rule change,' highlighting a systemic flaw in decentralized dispute resolution. Yet, the episode ends on a cautiously hopeful note: Bitcoin and Ethereum ETFs broke their 13-day outflow streak, with BlackRock’s IBIT leading a $3.2M inflow, signaling potential stabilization. The episode underscores a paradox at crypto’s core: the more secure and private the system, the more we must trust those who build it.