fix

On May 29, 2026, Taylor Hornby discovered a critical forgery vulnerability in the Zcash Orchard funding pool. Taylor Hornby reported the vulnerability to the Zcash Open Development Lab, and all parties collaborated to complete the fix on June 2. This vulnerability could be exploited to secretly create an unlimited number of forged ZEC within Zcash Orchard. Due to the privacy features of Orchard, it is impossible to cryptographically prove whether the vulnerability was exploited before the fix was deployed. The vulnerability had existed since the activation of Orchard in May 2022, until an emergency fix was deployed on June 1, 2026.With the assistance of AI tools, Taylor Hornby wrote a complete exploit and generated unlimited and undetectable forged ZEC in a local testing environment. Currently, Shielded Labs is collaborating with other Zcash developers to explore network upgrade proposals that would allow anyone to verify the integrity of Zcash's supply.

The official announcement from the Zcash (ZEC) Foundation states that independent security researcher Taylor Hornby discovered a serious reliability vulnerability in the Orchard zero-knowledge proof circuit on May 29, which could allow double spending within the Orchard pool.Core engineers from ZODL confirmed the issue within hours and initiated a fix. To buy time, they temporarily disabled Orchard operations through an emergency soft fork of Zebra 4.5.3 in the early hours of June 2. Finally, today, they activated the NU6.2 hard fork through Zebra 5.0 — at 12:05 PM Beijing time, the mainnet successfully completed the upgrade at block height 3,364,600, re-enabling Orchard with the corrected circuit, and the vulnerability was permanently closed.This is the second time Zcash has triggered a protocol upgrade due to security issues since its launch in 2016, with no known exploits occurring during the process. The network's total supply guard mechanism confirmed that the total supply remained intact, and user privacy, as well as Sapling and transparent transactions, were not affected.

The Zcash Foundation announced the release of the Zebra 4.5.1 version update to fix a consensus-level security vulnerability and strongly recommends that all node operators upgrade immediately.The vulnerability, identified as GHSA-2prc-cj5x-4443, involves a sigop (signature operation count) statistical error in P2SH transactions, which could lead to potential consensus fork risks. This fix corrects the incomplete patch issue from the previous 4.5.0 version, which was just released yesterday.The Zcash development team stated that the problem originated from discrepancies in sigop counting logic across different implementations, which could cause nodes to produce different results when validating transactions, thereby affecting on-chain consensus consistency. The fix was implemented by reverting and adjusting the Rust implementation logic to ensure alignment with the expected behavior of the protocol.The Zcash Foundation emphasizes that there is currently no workaround for this issue, and upgrading to 4.5.1 is the only way to ensure that nodes remain on the correct chain and avoid potential fork risks.

According to The Block, the Sui Foundation released an incident analysis report on the recent three interruptions of the mainnet, attributing the three network outages that occurred last Thursday and Friday to two independent vulnerabilities introduced by the v1.72 version upgrade. The first interruption lasted about six and a half hours, while the second and third occurred on Friday morning and afternoon, respectively.The first two interruptions were caused by the "address balance" feature introduced in v1.72, which exposed flaws in the transaction fee deduction method. When a transaction was canceled due to insufficient funds, the network would still spend those funds, resulting in a negative balance that caused the validation node reconciliation process to crash. The foundation acknowledged that the temporary fix pushed urgently on Thursday carried known interruption risks, and the team accepted this risk to quickly restore on-chain services, which led to another network interruption on Friday morning.The third interruption was triggered by another undisclosed random state vulnerability, occurring when the validation nodes restarted to install the fix patch. Sui stated that user funds were never at risk, that both vulnerabilities have been fixed, and that a mechanism to forcibly terminate stalled epochs has been established. The foundation also mentioned that AI agents with access to its production systems significantly accelerated the diagnostic process.

According to developer donnoh, due to a vulnerability that occurred during a recent upgrade, the status updates of the Base network have been stagnant for over 30 hours. However, since the withdrawal from Base to the Ethereum mainnet requires about a 7-day challenge period, most ordinary users have not yet noticeably perceived this anomaly.Subsequently, the official Base status page released an announcement confirming that the issue originated from a fault related to the TEE (Trusted Execution Environment) enclave, which caused the network proposal process to be interrupted, thereby affecting the status update process.The official statement indicated that the withdrawal function of the Base mainnet is currently experiencing delays, and the team is working on repairs. Aside from the withdrawal process, other core network components have not been directly affected.

The Zcash Foundation has released the node client Zebra version 4.5.0 update, which includes multiple security fixes, including a critical consensus vulnerability and several high-risk denial of service (DoS) issues. All node operators are strongly advised to upgrade immediately.It is reported that this core fix includes a sigop counting error caused by P2SH script parsing (which may lead to a consensus fork with zcashd), a defect in the NU5 block validation cache logic, a risk of transparent address balance overflow crashes, as well as multiple crashes and resource exhaustion vulnerabilities in RPC interfaces and memory pool handling. Additionally, some vulnerabilities can be exploited by malicious nodes, leading to node freezes, reboot loops, or even permanent shutdowns.

The Polymarket development team stated, "The current trading functionality is experiencing issues. The team has confirmed the cause of the problem and is deploying a fix. Real-time status updates can be viewed on the official status page."

Morpho officially released the "Morpho Midnight White Paper," announcing the launch of a new non-custodial protocol designed specifically for the fixed-rate, fixed-term credit market. At the same time, the complete codebase of Midnight has been open-sourced, and developers can access it directly through GitHub.

Decentralized USDD announced that its yield-bearing token sUSDD officially launched on Pendle's Ethereum chain 91-day fixed income market, marking another breakthrough for USDD in the DeFi yield scenario and capital efficiency layout.This event will take place on May 28 at 8:00 AM (Singapore time), and sUSDD holders can participate by locking in fixed rates, trading yield rights, providing liquidity, and more. During the event, YT users can share over $300,000 in incentives, combined with Pendle's official 30% exclusive rewards, and have the chance to receive random airdrops of TRX.The official stated that they will continue to explore diversified yields in the future, effectively meeting market liquidity demands and promoting USDD's deep integration into the mainstream DeFi ecosystem.

According to Cointelegraph, Bitcoin recently fell below $79,000 after facing significant selling pressure around $82,000. Market analysis suggests that the current BTC trend is highly correlated with the U.S. small-cap stock index, indicating that it is still viewed by the market as a "risk asset" rather than a safe-haven tool. Analysts point out that the escalating situation in Iran, rising oil prices, and concerns about a global economic recession are continuously suppressing market risk appetite. Meanwhile, the funding rate for Bitcoin perpetual contracts has recently turned negative, indicating a significant lack of demand for leveraged long positions, and traders remain cautious about short-term increases. However, the report suggests that in the medium term, large-scale capital outflows from the fixed income market may actually be beneficial for BTC.As global government bond yields rise to decades-high levels, investors are gradually withdrawing from the bond market, and some liquidity may flow back into risk assets, including Bitcoin. Currently, the yields on 10-year U.S. and European government bonds have both reached multi-year highs, while Brent crude oil prices have also surpassed $100, exacerbating market concerns about inflation and economic pressure.

Cryptocurrency analyst Marcel Pechman stated that Bitcoin rapidly fell back after being rejected at $82,000 on Friday, dropping below $79,000. The movement is highly synchronized with the U.S. small-cap stock index, indicating that macro factors are the main driving force behind this round of decline. The Russell 2000 index, which covers small and medium-sized enterprises, has a higher capital cost and is more sensitive to interest rate trends. The high correlation between Bitcoin and this index suggests that the market currently characterizes Bitcoin as a risk asset rather than a safe-haven tool.The funding rate for Bitcoin perpetual contracts briefly turned deeply negative on Thursday and remained close to 0% on Friday, with continued absence of long leverage demand—this indicator has been below the neutral threshold of 6% for several weeks. Multiple attempts to breach $82,000 have failed to boost market confidence. Macro pressures have been piling up: the outcome of the U.S.-China summit disappointed the market, with no specific tariff agreements reached aside from a commitment to accelerate U.S. agricultural exports over the next three years; meanwhile, the ongoing war in Iran continues to weigh on market sentiment, with Brent crude oil prices jumping from $99 to $106 in the past week, further exacerbating inflationary pressures.Additionally, the inflation-adjusted Shiller price-to-earnings ratio shows that the S&P 500 index is currently only about 5% lower than its peak during the internet bubble in January 2000, indicating a significant contraction in overall market risk appetite. However, the massive sell-off in the fixed income market may provide mid-term support for Bitcoin. The yield on Japan's 10-year government bonds has risen to its highest level in over 20 years, while the yield on the Eurozone's 10-year government bonds has also surged to 3.18%, a 15-year high. Analysts believe that in response to recession risks, central banks may be forced to inject liquidity, and funds flowing out of fixed income may ultimately seek other asset allocations, with Bitcoin likely to benefit from this.

The privacy coin project Monero has released the graphical wallet software GUI version 0.18.5 "Fluorine Fermi". This update is a recommended upgrade version, mainly containing a large number of bug fixes and functionality optimizations.Key highlights of this update include: migrating the P2Pool installation path to LocalAppData on Windows systems, fixing boundary case issues in URI parsing, prohibiting the creation of offline transactions in long payment ID scenarios, escaping untrusted text in QR code scanning to enhance security, upgrading P2Pool to v4.15, and multiple detail bug fixes and stability improvements.Monero's official team stated that this version has been open-sourced on GitHub, and users can download the upgrade through official channels to obtain the latest security fixes and stability improvements.

The Zcash Foundation officially announced the release of Zebra version 4.4.0. This update fixes multiple consensus-level critical security vulnerabilities and strongly recommends that all node operators upgrade immediately. This includes a denial-of-service vulnerability that can cause new blocks to stop being discovered permanently, consensus divergences caused by errors in block signature operation (sigops) counting, anomalies in the processing of transparent transaction signature hashes, and risks of memory allocation amplification attacks.The Zcash Foundation stated that some of these vulnerabilities could cause Zebra nodes to accept blocks that are rejected by zcashd, leading to chain forks. If not updated in a timely manner, nodes may face risks such as interruption in block discovery, consensus forks, and resource consumption amplification, and there are currently no alternative mitigation solutions.

According to BBX data, yesterday the credit management of mining companies, the update of Ethereum treasury reserves, and the expansion of Bitcoin reserves were synchronized. The core dynamics are as follows:Riot Platforms, Inc. (NASDAQ: $RIOT) signed and publicly disclosed SEC Form 8-K reported by CoinDesk on April 28, stating that the company has completed the second amendment to its credit agreement with Coinbase Credit, Inc., switching the original floating rate $200 million secured term loan to a fixed rate and extending the maturity date by 364 days, while retaining the option for a further extension of 364 days; the loan scale and collateral structure remain unchanged, with the collateral still being Bitcoin, USDC, and cash held in Coinbase Custody. The company's Bitcoin holdings have decreased from 19,368 coins at the beginning of the year to 15,680 coins; if the BTC price continues to decline, the selling pressure under the loan-to-value ratio constraint will persist, which is an analytical judgment and not an official disclosure from the company.Bitmine Immersion Technologies, Inc. (NYSE: $BMNR) released its latest holdings update on April 27, stating that as of that day, it holds 5,078,386 ETH (valued at approximately $2,369 at the market price, with a market cap of about $12.04 billion), along with 200 BTC, $200 million in Beast Industries (under MrBeast) equity, and $91 million in cash, bringing the total of combined crypto assets and strategic investments to about $13.3 billion; the ETH holdings account for approximately 4.21% of the total circulating supply, which is the scale accumulated by the company since launching its Ethereum treasury strategy in June 2025.Strive, Inc. (NASDAQ: $ASST) disclosed through an official announcement on GlobeNewswire on April 27 that the company has purchased approximately 789 BTC (costing about $61.43 million, with an average price of about $77,890), bringing the total holdings to approximately 14,557 BTC as of April 24; during the same period, it held $90.5 million in cash and equivalents, and $50.3 million in Strategy preferred shares (STRC), with a total market value of BTC reserves of about $1.13 billion, surpassing Hut 8 to rank ninth among publicly listed companies in Bitcoin reserves globally.

AAVE announced the technical implementation plan for the recovery of rsETH, which aims to advance the repair in three phases: supplementing ETH collateral, clearing affected positions, and restoring market parameters, in order to restore complete collateral support for rsETH and return the market to normal operations.The plan indicates that DeFi United has coordinated to obtain the ETH commitments needed for recovery, which will be restored through batch conversions and injected into the bridging locked contract to support rsETH; at the same time, it plans to clear the affected positions in Aave and Compound through a governance proposal, recovering approximately 107,000 rsETH related excess collateral and gradually lifting the freeze status on related assets.

Litecoin disclosed in a post on platform X that a recent zero-day vulnerability had caused a DoS attack, affecting the operation of major mining pools. Mining nodes that were not updated allowed an invalid MWEB (MimbleWimble Extension Block) transaction to be executed, enabling the related tokens to be withdrawn to a third-party DEX.The Litecoin network rolled back these invalid transactions through a reorganization (reorg) of 13 blocks, confirming that they would not be included in the main chain. All valid transactions during this period were unaffected, and the vulnerability has been completely fixed, with network operations restored to normal.

LayerZero posted on platform X that it is aware of the rsETH vulnerability incident and has been actively working with the KelpDAO team on handling and remediation since the incident occurred, while continuing to monitor the situation.LayerZero stated that, aside from the rsETH-related incident, other applications remain secure. Regarding the root cause of the incident, LayerZero is collaborating with SEAL_Org and others to investigate and has indicated that it will release a complete post-incident analysis report in conjunction with KelpDAO once all information is gathered.

The Zcash Foundation tweeted that it has released version 4.3.1 of Zebra. This version includes several critical security fixes, and all node operators are advised to upgrade immediately. Additionally, this version introduces a Dockerized mining environment, automated checkpoint management, and several CI enhancement improvements.

According to official news, the Rayls public chain mainnet will go live on April 30, along with the launch of the staking program and the Rayls native USD stablecoin USDr, marking the official implementation of the $RLS token economics.After the mainnet activation, transaction fees (paid in USDr on the public chain, RLS can be used on the private chain) will be converted, accumulated, burned, and redistributed through an automated mechanism: 50% of the transaction fees will be permanently burned, creating deflationary pressure; 50% will be injected into the network security pool to reward validators. The total supply of Rayls token RLS is fixed at 10 billion, with most tokens locked until 2028 to ensure long-term incentives and stable development, with a TGE circulation ratio of less than 15%; the majority of shares held by investors and the team will have a 12-month cliff period followed by a 36-month unlocking period, and additionally, 10% of the tokens unlocked by the foundation each month will be burned, further accelerating deflation.

The privacy coin Zcash recently disclosed and fixed a critical security vulnerability that could have been exploited by malicious miners to transfer over 25,000 ZEC (approximately 6.5 million USD) from the deprecated Sprout privacy pool. Security researcher Alex "Scalar" Sol disclosed on March 23 that the vulnerability stemmed from the zcashd node skipping proof verification when processing transactions involving the Sprout pool.The official statement indicated that the vulnerability had existed since July 2020 but had not been actively exploited, and user funds remained safe at all times. The development team has released version 6.12.0 to complete the fix, and mainstream mining pools have completed the upgrade deployment within a few days. Additionally, the unaffected Zebra full node implementation has the capability to trigger a chain fork, providing extra protection in the event of exploitation.It was disclosed that although the Sprout pool closed to new deposits in November 2020, approximately 25,424 ZEC remained untransferred. Even if the vulnerability were exploited, Zcash's "turnstile" mechanism would prevent inflationary issuance, ensuring that the total supply would not be breached. This vulnerability was discovered with the assistance of AI, and the researcher will receive a total bounty of 200 ZEC (approximately 51,000 USD). It is worth noting that this is not the first time Zcash has encountered a significant vulnerability; as early as 2019, it had fixed a serious flaw that could lead to unlimited issuance.