Zcash has patched a major vulnerability that would have allowed bad actors to drain funds from the protocol’s deprecated Sprout shielded pool.

A disclosure report from security researcher Alex “Scalar” Sol, published on Tuesday, claims that a critical flaw was discovered in zcashd nodes that resulted in skipping proof verification for transactions involving the legacy Sprout pool.

Zcash’s Sprout pool is the original “shielded pool” that launched with the network in 2016. It was the first implementation of zero-knowledge proofs (zk-SNARKs) in a production cryptocurrency, allowing users to send and receive ZEC privately.

Although the pool was closed to new deposits in November 2020, it still holds approximately 25,424 ZEC, which are yet to be migrated to newer shielded pool versions.

According to the disclosure, the vulnerability spanned releases from July 2020 onward but was fixed through v6.12.0, which was released on Tuesday. So far, the flaw has not been exploited, and user funds remain safe.

Major mining pools, including Luxor, F2Pool, ViaBTC, and AntPool, have already deployed the fix by March 26, the report added.

The report added that the Zebra full node implementation was not affected. In the event of an attempted exploit, it would have resulted in a chain fork, acting as an additional safeguard.

Despite the severity of the issue, the Zcash Open Development Team has clarified that the network’s “turnstile” mechanism, which enforces that any coins exiting the Sprout pool must have previously entered it, would have prevented broader supply inflation.

For the Zcash network, this marks the second time a critical, systemic vulnerability has been uncovered within its shielded pools. In 2019, the Zcash team disclosed a “counterfeiting” bug, a flaw in the underlying cryptography that could have allowed an attacker to create an infinite amount of ZEC without detection.

Bitcoin BTC$66,453.48 gave back a large portion of its recent gains on Thursday, now trading at $66,700 having lost 2.4% of its value since midnight UTC.

Ether (ETH) performed even worse, tumbling by 4.4% as the broader crypto market struggles to deal with continued risk-off sentiment.

The latest plunge was spurred by U.S. president Donald Trump, who said on Wednesday evening that the war in Iran would continue with extensive strikes on Iran.

“Over the next two to three weeks, we’re going to bring them back to the stone ages where they belong,” he said.

The comments led to an immediate spike in oil prices, with brent crude rising by around 10% to $108 per barrel as U.S. equities diverged.

Nasdaq 100 and S&P 500 futures lost 1.5% and 1.1% respectively while the U.S. dollar increased by 0.5% to above 100 points.

Derivatives positioning

• BTC’s price has dropped over 2% since midnight UTC hours alongside a slightly uptick in open interest in major USD- and USDT-denominated futures. Plus, perpetual funding rates have dropped to their most negative since March 12. This combination suggests that traders are bearish and shorting the falling market.
• In ether’s case, funding rates are most negative since October last year, a sign of strong bias for bearish bets. Meanwhile, bearishness in solana (SOL) is surprisingly more measured despite the overnight hack.
• Privacy-focused zcash (ZEC) and ADA$0.2378 have seen a notable decline in open interest (OI) in 24 hours, a sign of capital outflows.
• Nearly $400 million in futures positions have been liquidated due to margin shortfalls. That’s a 17% increase in losses compared to the previous day.
• Despite renewed risk-off tone, bitcoin and ether’s 30-day implied volatility indices remain flat in recent ranges. It points to orderly selling in the spot market rather than panic.
• There is little scope for panic because traders are already positioned for market swoon. They have been consistently chasing bitcoin and ether put options (downside hedges) since the start of the year. As of writing, bitcoin and ether puts remained pricier than calls across all tenors on Deribit.
• Block flows featured demand for ether straddles, a volatility strategy, and put spreads and bitcoin call spreads.

Token talk

• The worst performing benchmark on Thursday was CoinDesk’s DeFi Select Index (DFX), which lost 5.9% since midnight UTC, closely followed by the CoinDesk Computing Select Index (CPUS) that tumbled by 5%.
• Ethena (ENA) led the downside move as it fell by more than 10% on Thursday, there was also a heavy drawdown among DeFi tokens UNI, LDO, SKY and AAVE – all shedding between 4.2% and 6.5% during Asian and European hours on Thursday.
• Algorand (ALGO) bucked the bearish market trend, rising by around 0.8% on Thursday as it continues its rich vein of form having rallied by 22% in the past week.
• CoinMarketCap’s “altcoin season” index is down from 50/100 to 42/100 since March 30, highlighting relative weakness across the sector.

Coinbase chief legal officer Paul Grewal said the US Digital Asset Market Clarity Act is “moving toward” a markup hearing in the US Senate Banking Committee and could eventually move to a floor vote if senators resolve the stablecoin yield dispute and schedule a markup.

Speaking in a Wednesday interview on Fox Business, Grewal said lawmakers are nearing agreement on core elements of the crypto market structure bill, even as debate continues over stablecoin yield. “I think we’re very close to a deal,” he said.

The remarks point to possible movement on one of the last major sticking points in Senate talks over crypto market structure legislation: whether stablecoin issuers or platforms should be allowed to offer yield or similar rewards. The dispute has helped delay a Senate Banking Committee markup, leaving the broader effort to set federal rules for digital asset oversight still unresolved.

US banks have pushed for restrictions, arguing that such incentives could draw deposits away from traditional institutions and disrupt the banking system. Grewal pushed back on that claim, saying there is no evidence to support fears of deposit flight.

The US House of Representatives passed the CLARITY Act on July 17, 2025. In January, Senate Banking Committee Chair Tim Scott delayed a planned markup, which has yet to be rescheduled.

Related: Crypto investor sentiment will rise once CLARITY Act is passed: Bessent

Trump blames banks for stalling crypto bill

Last month, US President Donald Trump accused banks of undermining efforts to pass crypto market structure legislation, saying they are blocking progress over disagreements on stablecoin yield payments. “The Banks should not be trying to undercut The Genius Act, or hold The Clarity Act hostage,” he wrote.

It was later reported that Trump met privately with Coinbase CEO Brian Armstrong just hours before issuing the statement.

In January, Armstrong said Coinbase could not back the market structure bill “as written,” pointing to draft amendments that would eliminate stablecoin rewards and let banks restrict competition.

Related: CLARITY Act 2026 odds ‘extremely low’ if not passed before April: Exec

CLARITY delay could expose crypto to crackdowns

Last week, Coin Center executive director Peter Van Valkenburgh warned that failure to pass the CLARITY Act could leave the crypto industry vulnerable to a future US administration taking a tougher stance. He argued that rejecting developer protections in favor of short-term business interests risks creating a system shaped by political shifts rather than clear law.

“The point of passing CLARITY is not to trust this administration. It is to bind the next one,” he said.

Magazine: Bitcoin may take 7 years to upgrade to post-quantum — BIP-360 co-author