Cypherpunk Affirms 5% Zcash Target After Orchard Bug

Cypherpunk Technologies said it will continue its plan to accumulate 5% of Zcash’s fixed 21 million supply after a vulnerability was found and patched in Zcash’s Orchard shielded pool. The company’s shares fell more than 40% on Friday and the ZEC token dropped over 50% during the market selloff.

Researchers identified a counterfeiting flaw in Orchard that could have allowed undetectable creation of counterfeit ZEC inside the shielded pool. Core developers deployed an emergency network upgrade to fix the issue and reported no evidence the vulnerability was exploited.

Cypherpunk reported holdings of 314,185.70 ZEC, about 1.88% of the cryptocurrency’s circulating supply, and reiterated its target to hold 5% of the total supply. The company posted “Please stop the FUD” and added “Finding a bug isn't a security failure. Not looking is.” Will McEvoy, chief investment officer, described recent price moves as noise and maintained the firm’s long-term capital allocation strategy.

In its first-quarter 2026 results, Cypherpunk recorded a net loss of $77.2 million, mainly driven by unrealized losses on ZEC holdings. The company has also increased ecosystem investments; in March it committed $5 million to Zcash Open Development Labs and counts Winklevoss Capital among its backers. Cameron Winklevoss wrote that formal verification is the way forward and called encrypted money with provable correctness “unstoppable.”

Orchard is Zcash’s latest shielded pool design. It uses zero-knowledge proofs to hide sender, recipient and amount in a private transaction. Developers say formal verification, which uses mathematical proofs to check properties of code or cryptographic circuits, will reduce the risk of similar vulnerabilities when applied to Zcash’s privacy circuits.

Other public companies with ZEC exposure saw smaller moves. Reliance Global Holdings reported holding 213.14 ZEC as of March 31, 2026, and its shares fell about 2% on the same trading day.

Cypherpunk said the incident highlights the role of active security research and defensive upgrades and confirmed it will continue pursuing its 5% accumulation target.