Someone knew.

Three days before a critical vulnerability in Zcash’s privacy architecture was publicly disclosed, five wallets quietly opened $72 million worth of short positions on Hyperliquid. Perpetual futures volume for ZEC surged 12-13 times normal levels on May 26, according to blockchain analytics firm Allium Labs. When the bug hit the news on May 29, ZEC’s price cratered 38-45% within 24 hours, and those five wallets walked away with roughly $3.43 million in profit.

The bug, the shorts, and the timeline

On May 26, ZEC futures trading volume on Hyperliquid exploded well beyond anything resembling normal activity. Five specific wallets opened massive short positions totaling approximately $72 million. At this point, there was no public knowledge of any vulnerability in the Zcash protocol.

Three days later, on May 29, security researcher Taylor Hornby publicly identified a critical flaw in Zcash’s Orchard shielded transaction pool. The vulnerability affected the zero-knowledge proof circuit, which is the cryptographic backbone that makes Zcash’s privacy features actually work.

The bug wasn’t new, either. It had existed since Orchard’s activation in May 2022, meaning it sat undetected for roughly four years.

Once the disclosure went live, ZEC’s price plummeted. The token fell to lows of roughly $247 to $265, representing a 38-45% decline in just 24 hours. The five wallets that had positioned themselves short before the news closed out their trades with $3.43 million in gains.

An emergency hard fork was executed on June 1-2 to patch the vulnerability.

Trading frenzy on Hyperliquid

On June 5, Hyperliquid recorded $560 million in ZEC trading volume in a single hour. Allium Labs flagged the pre-disclosure volume spike as a clear anomaly, with trading activity ballooning by more than a factor of 12 in the days before the market-moving event.

The on-chain data doesn’t prove insider trading in a legal sense. But the pattern, massive shorts placed days before a catastrophic disclosure, followed by a precisely timed exit, is the kind of thing that would trigger an investigation in traditional markets.

What this means for Zcash and privacy coins

The emergency hard fork on June 1-2 patched the specific flaw, but a 38-45% price drop in 24 hours is the market’s way of repricing that trust deficit in real time.

The pre-disclosure shorting activity raises a question that goes beyond Zcash itself. If five wallets can accumulate $72 million in shorts before a vulnerability goes public, it suggests either a leak in the responsible disclosure process or a level of independent security research happening in private that the broader market has no visibility into.

The $560 million single-hour trading volume on Hyperliquid on June 5 also highlights how decentralized perpetual futures platforms have become the arena where these events play out, and the difficulty of monitoring for suspicious activity in real time on decentralized infrastructure.