AI-assisted security research helped uncover a potential threat, but the official disclosure unexpectedly triggered a sell-off in the long-standing privacy coin Zcash.
On May 28, Anthropic released its general-purpose model Claude Opus 4.8. The next day, security researcher Taylor Hornby used the new model to locate a critical 'infinite mint' vulnerability hidden for nearly four years in Zcash's Orchard privacy pool. He also completed a local attack simulation. Upon receiving the report, the Zcash team quickly launched an emergency fix and successfully patched the bug via a hard fork on June 3.
The security alert seemed to be resolved. But on June 5, Zcash founder Zooko Wilcox published a lengthy disclosure that directly sparked market panic. The official intention was to demonstrate the team's efficient response and transparency. However, revealing the bug's non-auditable nature quickly turned into a trust crisis that affected the entire privacy coin sector. The nine-year-old privacy coin ZEC plunged within hours, with its price briefly dropping to $250 and its market cap nearly halving. It also dragged down the already bearish crypto market.
The core cause of the crash lies in the cryptographic audit black box inherent to shielded privacy pools. Because the Orchard shielded pool fully encrypts transaction amounts and paths, even though the bug has been fixed and the existing Turnstile mechanism can limit the total outflow of tokens, outsiders have no way to prove whether counterfeit assets ever appeared inside Orchard or whether fake coins secretly replaced genuine ones.
This mechanism flaw — impossible to verify or disprove — directly led investors to reprice the credibility of the supply. It forced BitMEX founder Arthur Hayes and several other prominent traders to liquidate overnight. Added to that, Anthropic is about to release a stronger security audit model called Mythos to the public. Investors fear that more legacy project codebases will face indiscriminate AI vulnerability scanning, prompting a defensive withdrawal from the entire privacy track.