Zcash founder Zooko Wilcox says a security review of the privacy-focused protocol conducted using Anthropic’s Claude Mythos AI model did not uncover serious issues. The assessment was requested by Shielded Labs, a Swiss non-profit that supports Zcash development.

Wilcox shared the result in an X post on Saturday, adding that the audit found “no more serious bugs” in the Zcash protocol. The announcement follows earlier emergency steps taken by Zcash developers in early June after a vulnerability in the network’s shielded pool was identified and addressed.

Key takeaways

• Zooko Wilcox says Anthropic’s Claude Mythos security audit found no serious vulnerabilities in Zcash’s protocol after a Shielded Labs request.
• In early June, Zcash developers temporarily suspended Orchard shielded pool transactions, then restored functionality the same day via an emergency upgrade.
• The Orchard issue was linked to a four-year-old forgery bug, discovered with assistance from Anthropic’s Claude Opus 4.8 model and researcher Taylor Hornby.
• The Zcash Foundation stated there was no evidence of exploitation, no detected unauthorized value creation, and no impact on user privacy.
• Across crypto, the rapid rise of advanced AI security tooling is increasing both defensive capability and concern about who benefits from vulnerability-finding at scale.

Claude Mythos audit reports no serious Zcash protocol flaws

Wilcox’s update centers on an AI-assisted security audit carried out by Anthropic’s Claude Mythos model. According to his post, Shielded Labs—described as a Swiss-based non-profit supporting Zcash development—requested the review, which then concluded that there were no serious vulnerabilities in the Zcash protocol.

The timing of the claim matters for Zcash users watching for follow-up risk after an Orchard-related emergency earlier this month. While AI tooling can accelerate the discovery of potential issues, a “no serious vulnerabilities” outcome also signals that at least this specific protocol check did not reveal additional high-impact defects.

June Orchard disruption and the emergency upgrade

Before the Claude Mythos audit result, Zcash developers took more direct operational action on June 3. They temporarily suspended Orchard transactions after discovering a vulnerability inside the shielded pool that processes privacy-preserving transfers.

Functionality was restored later that same day through an emergency upgrade, indicating a rapid response once the risk was identified. The Zcash Foundation later characterized the situation as one without confirmed exploitation.

In its account of the incident, the Zcash Foundation said there was no evidence the vulnerability was exploited, that no unauthorized value creation was detected, and that user privacy remained unaffected. Those statements were made in connection with an emergency soft fork and related network activation details described by the foundation in its technical update.

What the Orchard vulnerability actually was

Based on the earlier reporting referenced in Wilcox’s broader context, the Orchard problem traced back to a forgery bug that had existed for four years. Security researcher Taylor Hornby is credited with discovering the issue with help from Anthropic’s Claude Opus 4.8 model.

This distinction is important for investors and builders because it frames the risk not as a newly introduced flaw, but as something that had been latent and only later surfaced through improved analysis. It also implies that even older vulnerabilities can re-emerge as new tooling and methods become available—particularly where complex cryptographic protocols are concerned.

AI security tools: faster discovery, heightened threat concerns

While Zcash’s development process appears to benefit from advanced AI assistance, the larger debate in crypto is whether the same tools can also be used to accelerate attacks. The industry has increasingly raised alarms that improved vulnerability discovery could shift advantage toward threat actors.

Anthropic released the first public version of Claude Mythos, and the company has previously said Mythos and related models uncovered more than 10,000 high or critical-severity vulnerabilities in “systemically important software.” That statement fueled scrutiny over whether such capabilities should be broadly accessible.

In response to concerns, Anthropic stated that its Fable 5 model was “made safe for general use” with safeguards designed to reroute certain topics—such as cybersecurity—toward a different model (Claude Opus 4.8). However, Anthropic also later said it suspended access to Fable 5 and Mythos 5 following a US government export control directive citing national security concerns.

From the perspective of crypto defense, this creates a complicated landscape: AI models may be able to identify vulnerabilities quickly, but access controls and evolving policy can change who can use that capability and for what purpose. The result is a growing asymmetry between attackers and defenders, especially in a market where fast-moving smart-contract ecosystems can become targets.

Bug bounty platform Immunefi CEO Mitchell Amador warned in an interview that the proliferation of these new AI tools is changing the cybersecurity playing field toward attackers, calling it a “vulnerability apocalypse.” He tied that dynamic to a resurgence in DeFi hacks. Separately, DefiLlama’s data shows crypto hacks reached $634 million in April—the highest monthly total since the Bybit incident that led to roughly $1.4 billion in losses in February 2025.

Why the Zcash audit matters now

Zcash’s latest update is not just about whether one vulnerability was found—it’s also about whether the privacy protocol has additional serious problems after a high-scrutiny period. The combination of a June Orchard emergency response and a later Claude Mythos audit outcome suggests the team is continuing to stress-test the system with modern security approaches.

Still, Zcash users should treat the audit result as one datapoint among many. The Claude Mythos review reportedly found no serious issues, but the broader crypto environment remains sensitive to rapidly evolving AI-assisted security research—meaning the key question going forward is not whether AI can find problems, but how quickly vulnerabilities (and any exploitation attempts) can be detected, patched, and validated across different platforms.

Readers should watch for whether Zcash developers share additional post-audit assurance steps, and whether the industry’s ongoing AI model access changes—driven by export controls and “safety” restrictions—shift the tempo of both defensive research and attack activity.

“ETFs were referred to as weapons of mass destruction,” Hoffman said, recalling the skepticism that surrounded the structure before it became one of the dominant ways investors access markets.

When he joined the ETF industry in the early 2000s, the market held roughly $200 billion in assets, he said. Today, it’s nearly a $20-trillion global asset class, according to a PwC report.

He said tokenization is following a similar path, but much faster than ETFs.

“Every market that digitizes gets larger,” he said. “And tokenization is really the digitization of capital markets.”

Building for an agent-driven future

For Hoffman, tokenization will become the foundation for what comes next: AI-driven financial services.

He said he envisions a future where autonomous agents continuously monitor markets and allocate capital through professionally managed portfolios that update in real time as conditions change.

“Our end state will be portfolios that are professionally managed, real-time and adjusting to market circumstances and data changes,” he said.

To get there, the industry first needs tokenized assets, onchain prime-brokerage infrastructure and asset-management strategies that can be executed natively on blockchain networks.

Ondo is building toward that vision, he said. The firm already offers tokenized U.S. Treasury products and plans to expand into stocks, ETFs and perpetual futures through its tokenized marketplace.

Zcash founder Zooko Wilcox said a security audit by Anthropic’s Claude Mythos artificial intelligence model found no serious vulnerabilities in the privacy-preserving cryptocurrency’s protocol.

Requested by Shielded Labs, a Swiss-based non-profit supporting the development of Zcash, the AI security audit did not find “any more serious bugs” in the Zcash protocol, according to a Saturday X post by Wilcox.

On June 3, Zcash developers temporarily suspended Orchard transactions after discovering a vulnerability in the shielded pool. Functionality was restored later that day through an emergency upgrade.

The issue stemmed from a four-year-old forgery bug in the Orchard shielded pool that was discovered by security researcher Taylor Hornby with the help of Anthropic’s Claude Opus 4.8 model. The Zcash Foundation said there was no evidence that the vulnerability was exploited, nor was there any unauthorized value creation detected, while user privacy was unaffected.

Source: Zooko Wilcox

AI models spark crypto security concerns

While developers are using new AI models to identify vulnerabilities, the technology is simultaneously raising security concerns across the crypto industry.

On Tuesday, Anthropic released the first public version of its Claude Mythos model, Fable 5. The company said last month that the Mythos model uncovered more than 10,000 high or critical-severity vulnerabilities in “systemically important software,” leading to concerns about whether it should be publicly released.

The company said users that Fable 5 was “made safe for general use” and has safeguards that reroute some topics, such as cybersecurity, to a different model, Claude Opus 4.8.  

On Friday, Anthropic said it suspended access to its Fable 5 and Mythos 5 AI models due to a US government export control directive citing national security concerns.

Related: Recovery hopes fade as Kelp DAO hacker launders nearly all $220M in stolen funds 

The proliferation of these new AI models has shifted the cybersecurity playing field in favor of the threat actors, causing a “vulnerability apocalypse” that is fueling a resurgence in decentralized finance (DeFi) hacks, Mitchell Amador, the CEO of bug bounty platform Immunefi, told Cointelegraph in a recent interview.

Crypto hacks surged to $634 million in April, the highest monthly value since the Bybit hack led to about $1.4 billion in losses in February 2025, according to DefiLlama data. 

Magazine: The legal battle over who can claim DeFi’s stolen millions 

Michael Saylor, executive chairman of Strategy, has defended the company’s first reported Bitcoin sale since 2022, arguing that the ability to sell BTC when necessary is integral to issuing “digital credit” products. The comments come as Strategy continues to frame Bitcoin not just as a treasury asset, but as the backing for securities designed to generate yield.

In a June 1 filing with the U.S. Securities and Exchange Commission, Strategy disclosed it sold 32 BTC—an action that contrasted with Saylor’s long-standing public message to “never sell your Bitcoin.” Speaking to Cointelegraph at the BTC Prague conference, Saylor said the logic is simple: digital-credit instruments only retain value if the issuer can manage its collateral and obligations.

Key takeaways

• Strategy disclosed a 32 BTC sale on June 1, marking its first reported BTC sale since 2022.
• Saylor argues “digital credit” requires the practical ability to sell Bitcoin to support credit-linked products and dividends.
• He positioned Strategy’s STRC preferred stock as a credit instrument backed by the company’s Bitcoin balance sheet.
• Saylor described digital credit markets as a potential “trillion-dollar opportunity,” including yield targets he claimed could reach up to 8%.
• Recent stress in apxUSD highlights how digital-credit collateral and liquidity can be tested when BTC and related assets move sharply.

Why Strategy sold Bitcoin after “never sell” messaging

Strategy’s filing—covering a sale of 32 BTC—was widely notable because it came after years in which Saylor’s rhetoric emphasized holding. In his remarks at BTC Prague, Saylor reframed the issue around the function of Bitcoin within Strategy’s business model.

He said that Bitcoin treasury companies that issue credit-linked securities must retain the ability to sell holdings when needed. In his explanation, if a company commits to never selling its BTC, the resulting credit products lose the flexibility investors rely on—meaning the securities’ perceived value could deteriorate.

“If the company’s policy is that we won’t sell the Bitcoin, then the credit won’t have value and the equity won’t have value,” Saylor said, adding: “The company is in the business of selling digital credit. The credit is backed by capital. Bitcoin is capital.”

The distinction Saylor drew matters for investors trying to understand the risk structure of Bitcoin-backed credit instruments. For holders of treasury-backed securities, the question is not whether BTC is “sold or not” in every scenario—it’s whether the issuer can actively manage collateral to meet obligations without undermining the product’s credit economics.

“Digital credit” as a Bitcoin use case

Saylor described digital credit markets as the next phase of Bitcoin finance, asserting they could enable yield-bearing digital money products. He argued that Bitcoin is a “digital transformation of capital,” and that instruments such as STRC represent a transformation of credit.

According to Saylor, digital credit products can offer yields “of up to 8%,” which he said is multiple times higher than traditional savings accounts. While the headline yield claim is framed as an outcome possible in these markets, the underlying premise is that Bitcoin collateral can be structured to support credit obligations and dividend-style distributions.

For Strategy, that thesis is not abstract. Saylor pointed to STRC preferred stock as an example of a “digital credit” instrument that uses Strategy’s Bitcoin balance sheet to support credit responsibilities. He also suggested that these securities have become a primary pathway for raising capital to acquire additional Bitcoin.

That broader model shifts the lens for market watchers. Instead of treating Strategy as only a spot BTC holder, Saylor’s comments place the firm inside a credit origination and balance-sheet engineering framework—one where collateral liquidity, market drawdowns, and dividend mechanics may determine whether the product performs as designed.

Market stress test: apxUSD depeg linked to STRC collateral

Saylor’s bullish framing on digital credit came alongside a concrete example of how these systems can face pressure during volatile market moves. On June 4, Apyx Finance’s dividend-backed synthetic stablecoin, apxUSD, reportedly depegged to as low as $0.90 while Bitcoin traded below $63,000 and STRC shares fell below their $100 par value.

In a report on the depeg, Apyx attributed the decline to changes in the value of STRC, which is described as the stablecoin’s primary collateral asset. As STRC’s value dropped, Apyx said the protocol’s reserve value was reduced. The company also pointed to factors including falling Bitcoin prices, thinning liquidity, and derivative-driven market dynamics.

At press time in Cointelegraph’s reporting, apxUSD was trading around $0.96—still below its $1 peg. The episode underscores a key investor question for digital credit products: even if the mechanism is designed to create yield, what happens when the underlying collateral and the market plumbing both deteriorate at the same time?

The implication is that issuers and borrowers in these structures may rely not only on long-term collateral value, but also on short-term liquidity conditions. In that sense, Saylor’s insistence on having the ability to sell Bitcoin when necessary directly intersects with the kind of collateral stress that depegs and drawdowns can trigger.

What to watch next for Bitcoin-backed credit

Saylor’s defense of the Bitcoin sale is ultimately a statement about operational flexibility in digital-credit systems—particularly how issuers manage collateral across market downturns. For investors, the next signals to monitor are how Strategy and similar operators disclose collateral management policies, and whether stablecoin and synthetic credit products can hold their structure when BTC and collateral-linked securities move quickly.

Michael Saylor, executive chairman of Strategy, defended the company’s recent Bitcoin sale, saying the ability to sell the asset is necessary to continue issuing “digital credit.”

Strategy disclosed its first reported Bitcoin sale since 2022 in a June 1 filing with the US Securities and Exchange Commission, offloading 32 BTC in a move that appeared at odds with Saylor’s long-running “never sell your Bitcoin” mantra.

In an interview with Cointelegraph at the BTC Prague conference, Saylor said that Bitcoin treasury companies must retain the ability to sell holdings when necessary to support dividend-paying securities and other Bitcoin-backed credit products. 

“If the company’s policy is that we won’t sell the Bitcoin, then the credit won’t have value and the equity won’t have value,” he said, adding:

The company is in the business of selling digital credit. The credit is backed by capital. Bitcoin is capital.”

Cointelegraph’s Ciaran Lyons (left) and Strategy founder Michael Saylor (right) at BTC Prague. Source: Cointelegraph

Saylor described products like Strategy’s STRC preferred stock as “digital credit” instruments that use the company’s Bitcoin balance sheet to support credit obligations. For Strategy, such securities have become a primary vehicle for raising capital to acquire more Bitcoin.

Digital credit is a “trillion-dollar” opportunity for Bitcoin finance, Saylor says

Digital credit markets are emerging as the next “trillion-dollar opportunity” in finance, a development that Saylor said could enable yield-bearing digital money products.

“I see Bitcoin as the digital transformation of capital. I see STRC as the digital transformation of credit,” Saylor said, explaining that digital credit products can offer yields of up to 8%, which is three to four times more than traditional savings accounts.

Related: Saylor downplays Bitcoin slide as Strategy faces $11B paper loss

Saylor said digital credit products could transform how people see credit markets, while also bringing billions of dollars into the Bitcoin ecosystem.

He cited projects such as Saturn and Apyx as examples of yield-bearing products built on top of digital credit markets. One of those products recently faced a test of its resilience.

On June 4, Apyx Finance’s dividend-backed synthetic stablecoin (apxUSD) depegged to as low as $0.90 as Bitcoin traded below $63,000 and STRC shares fell below their $100 par value.

According to Apyx, the decline in STRC, the stablecoin’s primary collateral asset, reduced the protocol’s reserve value. The company also cited falling Bitcoin prices, thinning liquidity and derivative-driven market dynamics as factors behind the depeg.

At press time, apxUSD traded at $0.96, below its $1 peg. Source: Coingecko

The full interview with Saylor will be available on Cointelegraph’s YouTube channel in the coming days.

Magazine: Bitcoin ETFs bleed $1B, Aave’s $71M ETH unfreeze bid delayed: Hodler’s Digest, May 10 – 16