Edition #11Sunday, May 31, 2026

Zcash Weekly — May 31, 2026

Zebra patches 12 vulnerabilities in two releases within 48 hours. Three wallets ship major features in one week. ZCG shuts down bounty program after AI slop overwhelms pipeline.

Jump to section

Two Critical Zebra Releases in 48 Hours

Zcash Foundation released Zebra 4.5.0 on May 29, patching 12 security vulnerabilities in a single release — including a consensus-critical P2SH sigop undercount (GHSA-gf9r-m956-97qx, reported by @samsulselfut). That fix itself contained a regression, prompting an immediate 4.5.1 hotfix the next day (GHSA-2prc-cj5x-4443, caught by @sangsoo-osec). 4.5.0 also added shielded coinbase support (ZIP-213) — miners can now receive block rewards directly to shielded addresses. All nodes must be on 4.5.1. 4.5.0 thread. · 4.5.1 thread.

4.5.0 thread.

Three Wallets Ship Major Features in One Week

Noir went public on Chrome Web Store and shipped ZECFi (one-click ZEC collateral, in-wallet swaps via RHEA/NEAR Intents). Vizor expanded to Windows and Linux with native swaps. Zwap launched trustless shielded cross-chain swaps — no MPC, no multisig, no custodian. The Zcash wallet space hasn't been this competitive since launch. Noir ZECFi. · Vizor. · Zwap.

Noir ZECFi.

ZCG Shuts Down Bug Bounties — AI Slop Killed the Program

ZCG terminated its Security & Vulnerability Disclosure Initiative on May 26 after AI-generated speculative reports overwhelmed the review pipeline. They cited curl's identical experience — Daniel Stenberg called it "death by a thousand slops." ZCG is now working with Zellic on access to V12, an AI-assisted auditing platform for proactive, repeatable review. Least Authority remains ecosystem security lead. Responsible disclosure stays open — but bounties are done. Forum.

Forum.

Ecosystem

Circle freezes >$12M in Zama's USDC contract.

Cypherpunk framed it perfectly: confidentiality built onto permissioned assets is fundamentally different from Zcash, where the asset itself is sovereign and private. When Circle can freeze your "private" stablecoin, it's not private — it's just hidden until someone decides otherwise. Tweet.

Tweet.

Jswihart publishes "Zcash Ecosystem May 2026."

A comprehensive ecosystem overview article that became the highest-engagement Zcash post of the week. Article.

Article.

NEAR founder on Unchained podcast:

@ilblackdragon went down the Zcash rabbit hole and made the case for private stablecoins — privacy on a volatile asset isn't enough, you need stable private money. Podcast.

Podcast.

ZODL Summit oversubscribed.

Applications closed within days. Prague in July.

ZecMap × CipherPay partnership.

Merchant integration guides coming to ZecMap — connecting the discovery layer with the payments layer. Announcement.

Announcement.

Red·bridge preparing for launch.

A decentralized ZEC↔EVM bridge backed by ZCG and the Avalanche Foundation, targeting Q3–Q4 2026. ZecHub and Zcash Brazil signed on as guardian/validator operators. Forum.

Forum.

ZecHub Hackathon 3.0 is live.

51 days, five tracks, 25 ZEC in prizes. zechub.wiki/hackathon

zechub.wiki/hackathon

Keystone 3 Pro ships Shamir Backup for Zcash.

33-word Shamir Secret Sharing backup now live on the "Cypherpunk Vault" edition.

Charles Hoskinson floats Cardano/Zcash/Monero cross-chain zone.

Early-stage but notable given the audience.

Zcash at Network School Malaysia.

400+ techno-optimists on-site. Zcash East Africa first meetup. Zcon Vozes 2 in Brazil.

Governance & Grants

NU7 Coinholder Vote — Final Phase

ZODL 3.5.0 shipped with voting enabled. Registration closes today (June 1, 11:59 PM UTC). Voting June 10–24. Results June 29. Forum.

Forum.

ZCG Elections

Two seats open. Nominations active.

Grant Tracker (verified via GitHub API)

Approved:
- #301 — Zcash Arabia — ✅ Approved + Milestone 1 Complete

Declined:
- #309, #308, #304 — Supa Community, Aweb Agent Receipts, Privacy Capsule

Under Review:
- #307 — Cross-Implementation ZIP Conformance Test Suite
- #306 — SAIHM Shielded-Identity Adapter ($50K)
- #305 — Zaino Maintenance & Upgrade Budget (June 2026–2027)
- #303 — Chain-Agnostic Cross-Chain Atomic Swaps
- #298 — Zcash Name Service
- #297 — Incrypted Educational Content (CIS)

Newly Filed:
- #311 — PCZT Interoperability Test Suite
- #310 — Great Minds In Tech Foundation

Approved:

#301 — Zcash Arabia — ✅ Approved + Milestone 1 Complete

Declined:

#309, #308, #304 — Supa Community, Aweb Agent Receipts, Privacy Capsule

Under Review:

#307 — Cross-Implementation ZIP Conformance Test Suite
#306 — SAIHM Shielded-Identity Adapter ($50K)
#305 — Zaino Maintenance & Upgrade Budget (June 2026–2027)
#303 — Chain-Agnostic Cross-Chain Atomic Swaps
#298 — Zcash Name Service
#297 — Incrypted Educational Content (CIS)

Newly Filed:

#311 — PCZT Interoperability Test Suite
#310 — Great Minds In Tech Foundation

Protocol & Development

Zebra 4.5.0 + 4.5.1

4.5.0 patched 12 vulnerabilities plus shielded coinbase (ZIP-213). 4.5.1 is a mandatory hotfix for the incomplete P2SH sigop fix. Upgrade immediately if on any earlier version. Release.

Release.

Zaino 0.3.1 + 0.4.0-rc.1

Stable release plus RC with wake-on-source-change notifications, CancellationToken shutdown, NFS sync race fix, and Tonic bind fix. Active development on the indexing layer. Release.

Release.

Shielded Labs proposes dynamic fees.

A detailed free-market fee system implementable without a network upgrade. Features priority delivery, "seal" pattern (commit-then-spend for privacy), and a fee oracle RPC. Forum.

Forum.

Zaino Unchained maintenance grant (ZCG #305).

Zingo Labs filed a 1-year proposal covering Tachyon integration, zcashd replacement, mixnet metadata privacy, and dedicated security roles. Forum.

Forum.

Arborist Call (May 28).

NU7-rc0 testnet feedback, ZIP 2005 wallet integration scope, Zallet alpha.4 milestones. Recording.

Recording.

Fauzec + Zexplorer launch.

Gustavo Valverde (ZF engineer) released Fauzec (testnet faucet) and Zexplorer (privacy-first block explorer with explicit public/private/unavailable labeling and WebSocket stream).

Fauzec

Zebra 4.5.0 + 4.5.1 — 4.5.0 patched 12 vulnerabilities plus shielded coinbase (ZIP-213). 4.5.1 is a mandatory hotfix for the incomplete P2SH sigop fix. Upgrade immediately if on any earlier version. Release.

Zaino 0.3.1 + 0.4.0-rc.1 — Stable release plus RC with wake-on-source-change notifications, CancellationToken shutdown, NFS sync race fix, and Tonic bind fix. Active development on the indexing layer. Release.

Shielded Labs proposes dynamic fees. A detailed free-market fee system implementable without a network upgrade. Features priority delivery, "seal" pattern (commit-then-spend for privacy), and a fee oracle RPC. Forum.

Zaino Unchained maintenance grant (ZCG #305). Zingo Labs filed a 1-year proposal covering Tachyon integration, zcashd replacement, mixnet metadata privacy, and dedicated security roles. Forum.

Arborist Call (May 28). NU7-rc0 testnet feedback, ZIP 2005 wallet integration scope, Zallet alpha.4 milestones. Recording.

Fauzec + Zexplorer launch. Gustavo Valverde (ZF engineer) released Fauzec (testnet faucet) and Zexplorer (privacy-first block explorer with explicit public/private/unavailable labeling and WebSocket stream).

Tweets of the Week

"note that zec has done all this in a bear market where capital has been exiting crypto — has not even seen a bull market yet"
— @mert (Helius/Solana) · link

"More devs are entering Zcash than ever before. Tough to keep up."
— @jswihart · link

"Zcash lore has no equal. @peterktodd literally participated in the first Zcash ceremony while in a moving car, with his laptop in a tin foil-lined box to ensure there could be no tampering. He then burned the laptop with a propane torch."
— @cypherpunk · link

"Edward Snowden on Zcash: 'I've been a fan of the technology behind Zcash for a long time.' He even participated in its creation back in 2016."
— @cypherpunk · link

Forum Highlights

"Zcash Dynamic Fees, Now!"

shieldedmark laid out a detailed, incrementally deployable proposal for dynamic fees without a network upgrade. The "seal" pattern (commit before spend) is a clever privacy primitive. Zooko and mrkit2u endorsed it. Forum.

Forum.

Incentivizing Critical Vulnerability Disclosure

@scalar, the researcher who disclosed the zcashd/Zebra exploit chain, published a retrospective arguing for formalized disclosure incentives after ZCG's bounty shutdown. A thoughtful counterpoint. Forum.

Forum.

Zcash Flutter Wallet

An independent developer (mrhaydari) publicly posted architecture questions about Merkle sync, nullifier indexing, and light-client patterns. New wallet builders entering unprompted is exactly what "more devs than ever" looks like. Forum.

Forum.

ZecWorld.app

A 3D globe where Zcashers pin shields and profiles. No GPS, no IPs, every field user-controlled Public/Private. A privacy-native social layer experiment. Forum.

Forum.

Privacy Corner

Confidentiality Is Not Privacy

This week Circle froze over $12 million in USDC sitting inside Zama's smart contract. One phone call, one blacklist entry, funds gone. The users thought they had "confidential" transactions. They did — right up until someone with a key decided otherwise.

This is the distinction people keep missing: confidentiality means someone chose not to look. Privacy means they can't.

A confidential stablecoin on a permissioned ledger is a curtain. Anyone with authority can pull it open. The issuer can freeze you. The chain operator can censor you. The regulator can compel disclosure. Your "privacy" exists at the pleasure of a counterparty.

Zcash doesn't work that way. There is no issuer to call. No admin key to revoke. No blacklist to add you to. The cryptography is the guarantee — not a policy, not a terms-of-service clause, not a pinky promise from a compliance department.

Eric Hughes wrote it in 1993: "Privacy is the power to selectively reveal oneself to the world." The operative word is power. If someone else holds the off switch, you don't have privacy. You have a favor.

When you hold shielded ZEC, the privacy is yours. Not delegated. Not revocable. Yours.

Network Snapshot

ZEC Price

$541.68 · -17.9%

Market Cap

$9.02B · —

24h Volume

$530.27M · —

Block Height

3,361,916 · +7,356

Network Upgrade

NU6.1 (Zebra 4.5.1) · —

Chain Size

256.21 GB · +0.16 GB

Zcash Privacy Index

Privacy Score

30 / 100 · -1

Shielded Pool

30.56% of supply · -0.21%

Orchard Pool

4.50M ZEC · -0.03M

Avg Shielded TX/Day

1,598 · +13

Cross-Chain Activity (24h)

Inflows

$1.81M · —

Outflows

$756K · —

Total

$5.05M · 533

Top Inflows: Ethereum ($1.30M), Tron ($160K), NEAR ($133K)
Top Outflows: Ethereum ($344K), NEAR ($218K), Tron ($94K)

All-time cross-chain swaps: 134,983 | All-time volume: $1.66B

Network Health

Active Nodes

369 · -50 (-12%)

Countries

39 · -2

Tor Nodes

6 · -1

Node count dropped from 419 to 369 — a correction after the 48% surge noted last edition. Likely cause: operators cycling through the rapid 4.5.0 → 4.5.1 security update sequence. Cross-chain volume remains healthy at $5M/day with 533 swaps, and shielded transaction average (1,598/day) held steady despite the 18% price pullback. The Orchard pool shed ~30K ZEC, likely profit-taking rather than a privacy behavior shift.

Live data at cipherscan.app/privacy-stats

Tool Updates

CipherScan

No new features this week.

CipherPay

No new features this week.

What's Ahead

June 1NU7 coin snapshot / registration deadline (today)
June 2Noir Wallet v1.0.20 + RHEA DApp integration
June 2Zcash Engineering Office Hours (15:00 UTC)
June 10–24NU7 Coinholder Vote (via ZODL + ZCAP)
June 13Q2 Retroactive Grants review closes
June 17–19Blockspäti Berlin
July 8–10ZODL Summit, Prague
July 15ZecHub Hackathon 3.0 deadline