The Fall of Two Worlds: MSTR and ZEC [FP Weekly 24]

1. Major News

[Crypto] Zcash’s Responsible Disclosure of a Vulnerability and the Resulting Valuation Repricing of the Privacy Sector

What Happened?

On June 5, Shielded Labs, a nonprofit organization that supports the development of Zcash, disclosed that a critical vulnerability had been discovered in Orchard, ZEC’s core privacy layer and shielded pool, and that it had been fixed through an emergency network upgrade. The bug, which had remained dormant for about four years, was a flaw that could have allowed unlimited, undetectable counterfeit ZEC to be created inside the Orchard pool. There was no confirmed evidence of actual exploitation or loss of funds, and the fix had already been completed. However, immediately after the disclosure, the price of ZEC plunged by about 50% from its high within 48 hours. Since ZEC had been one of the assets showing the strongest upward momentum since the second half of 2025, this decline was also a sharp correction that came on top of a major rally.

Around 30% of Zcash’s circulating supply is held in shielded addresses, and Orchard is Zcash’s latest shielded pool, activated in May 2022. The flaw discovered this time was a soundness bug in Orchard’s proof circuit. Soundness refers to the guarantee that a verifier accepts only valid proofs. However, because one constraint in Orchard’s circuit had been written too loosely, false inputs could pass as valid proofs. From an attacker’s perspective, this meant reusing the same shielded note multiple times, allowing unlimited counterfeit ZEC to be created inside the pool without detection.

However, Zcash has a turnstile system that tracks and enforces the movement of value at the boundary of each pool, so any attempt to break the total supply cap inside the pool would be caught and prevented by the turnstile. In fact, throughout the incident, ZEC’s total supply remained verifiable.

The market reacted sensitively for the following reasons, which led to ZEC’s sharp decline.

The first reason was how the bug was discovered. The flaw was found by Taylor Hornby, an independent security researcher hired by Shielded Labs in April for continuous protocol review. While reviewing the Orchard circuit using his own AI security audit framework combined with Claude Opus 4.8, he identified the vulnerability and delivered a working exploit and report to the development team that same night. In less than a day, he successfully created counterfeit ZEC in a local test environment. When this context was disclosed to the public through Zcash’s responsible disclosure, the market focused not just on the fact that the vulnerability had been discovered before an attack, but on the process by which it was found. The fact that a flaw that had withstood top-level review for four years was discovered and taken all the way to a proof of concept in just one day through AI security auditing raised concerns that the audit surface of complex proof circuits may be far wider than previously assumed, and that more undiscovered flaws may still exist. These tools are equally available not only to white hats but also to attackers.

The second reason was the patchability of the bug. The emergency network upgrade fixed the circuit and blocked future counterfeiting, but such a patch cannot go back in time. Because Orchard is structured to hide both the transacting parties and the amounts, there is no way to cryptographically prove after the fact whether counterfeit ZEC had already been created before the patch. Shielded Labs also made this clear in its responsible disclosure article. The circuit flaw itself was fixed, but overall integrity remained an unresolved issue. To address this, Shielded Labs proposed a follow-up upgrade to move all existing active capital inside the Orchard pool as quickly as possible to a new pool with a verifiable turnstile, as well as a formal verification project for the entire circuit. Moving active capital inside Orchard to another pool is closer to an emergency measure to prevent insolvency, while the formal verification project is realistically a task that requires a long time. As a result, the market concluded that a risk had emerged that would be difficult to resolve in the short term.

The third reason was the collapse of trust in the privacy narrative. The value of ZEC fundamentally rests on the premise that “privacy guarantees are valid,” and the moment that premise is questioned, the asset itself becomes unstable. The most symbolic example of this was the liquidation of Arthur Hayes’s position, as he had been one of the leading supporters of the privacy coin narrative. He exited ZEC on the view that the privacy narrative requires perfection, not merely an “acceptable” level of assurance, and the market interpreted this as a signal that the privacy thesis had broken.

Researcher’s Comment

The essence of this incident lies less in the scope of the bug itself and more in the nature of the uncertainty it leaves behind for privacy assets. Bitcoin experienced an unauthorized issuance attack caused by an integer overflow in 2010, and in 2018 it also faced a crisis after discovering a critical bug that, like the Zcash issue, could have enabled unauthorized issuance before an attack. In the case of the 2018 Bitcoin incident, because Bitcoin’s ledger is transparent, it was possible to audit supply afterward and verify whether actual exploitation had occurred. However, in Orchard, where both transacting parties and amounts are hidden, privacy itself is the product. Therefore, it is structurally impossible to convert “there is no evidence of exploitation” into “there was no exploitation.” This is not a problem limited to a specific bug, but rather closer to an inherent cost of shielded design.

Arthur Hayes’s liquidation was interpreted as a signal that the privacy thesis had broken, but what this incident actually shook, in my view, was not the thesis itself but the price the market was assigning to that thesis. The structural drivers that had supported ZEC’s rise, such as demand for shielded transactions, concerns over financial surveillance, and improvements in the regulatory environment, did not disappear because of this bug. What changed is that the market now requires a larger risk premium to hold the same narrative.

In addition, the performance of AI security audits has improved significantly, and it seems clear that similar cases will continue to occur. In March this year, a separate flaw in Zcash’s legacy Sprout pool was also discovered and fixed through the same method, making this the second shielded pool-related bug to surface in about three months. Based on the current trend, the defensive side appears to be preparing for vulnerabilities earlier and more proactively. However, concerns that a vulnerability of the same level could be discovered and exploited by attackers in the future will likely be repeatedly reflected in prices.

The short-term point to watch is the follow-up upgrade proposed by Shielded Labs. A turnstile checkpoint is a tool that can prevent the worst-case scenario of insolvency for current active capital. At the same time, even if unauthorized ZEC had been issued, it would allow the maximum amount to be determined through the turnstile system. The subsequent formally verified, verifiable shielded pool would significantly reduce the likelihood of vulnerabilities at the same level occurring again, making it the update that would help restore trust in ZEC the most.

Until then, ZEC is likely to trade with a kind of unprovability discount. However, given that the price remains far above the previous cycle low and long-term holders are still in profit, I view this incident as a repricing of risk rather than a destruction of value. And considering the trend of AI-assisted auditing gradually becoming the standard, dormant flaws that have passed human review are likely to be revealed not only in Zcash but also in other zero-knowledge proof-based protocols. Taylor Hornby, the security researcher who discovered this vulnerability, has also previewed a security audit of Monero. Ultimately, I believe this incident has left a strong demand not only for Zcash but for all privacy projects to continue building their verification and trust stacks.

[Investment] The Butterfly Effect Triggered by Strategy’s Sale of 32 BTC

What Happened?

Strategy sold Bitcoin. In dollar terms, it was not a sale large enough to shake the market. But the issue was not the size, but the symbolism. Michael Saylor’s Strategy has long been perceived as a company that “buys and holds Bitcoin,” and the market has treated the company’s BTC holdings almost like an untouchable vault. The fact that Strategy became a net seller of Bitcoin for the first time since 2022 was therefore interpreted as a signal beyond a simple portfolio adjustment.

The background to the sale was STRC. STRC is a variable-dividend preferred stock issued by Strategy. It offers investors a high dollar-denominated yield, but leaves the company with a regular cash dividend obligation. Strategy said it plans to use the proceeds from this Bitcoin sale to pay dividends on preferred stock, including STRC. In other words, rather than abandoning its Bitcoin strategy, the company visibly demonstrated for the first time how its structure works: raising capital against Bitcoin, then having to bear the cost attached to that capital.

The market reaction was cold. What investors focused on was not “32 BTC,” but the possibility that Strategy may no longer be a player that only buys at all times. As the Bitcoin price fell, MSTR’s share price weakened, and STRC traded below par value, the cost for Strategy to raise new capital also rose. Until now, the structure of issuing common stock and preferred stock to buy more Bitcoin had worked like a leverage engine in a bull market. But in a bear market, the same structure can return as dividend burden, discounted share prices, and pressure to sell Bitcoin.

The impact also spread to DeFi. In particular, Apyx’s apxUSD was a synthetic dollar structure that used STRC as core collateral, so the decline in STRC’s price immediately led to concerns about the stablecoin’s credibility. apxUSD temporarily lost its peg, and Apyx explained that this was “not a bug, but part of the structure.” This means that if collateral value becomes unstable, the price can also move. However, this incident did not lead to a wave of liquidations across DeFi. The more important point is that as preferred shares in the form of traditional securities enter DeFi as collateral, a new type of interconnected risk has been created.

Ultimately, this incident is not a story about Strategy collapsing. Rather, its significance lies in the fact that the market has begun to view Strategy’s Bitcoin strategy not as an “infinite buying narrative,” but as a “capital-raising structure.” STRC attracted capital by promising a high yield, but that yield depends on the Bitcoin price, the MSTR premium, demand for preferred shares, and the ability to pay dividends. In a bull market, all of this looks like a single virtuous cycle. But when prices fall, the same structure becomes far more fragile. The sale of 32 BTC was a small transaction, but it was the moment when the new risks now shared by Strategy and DeFi were revealed to the market for the first time.

Researcher’s Comment

At first glance, the relationship between MSTR and STRC seems to resemble the past LUNA-UST structure, as they influence each other and form positive or negative feedback loops. However, the two only feel similar, while their internal mechanisms are completely different. In the case of MSTR and STRC, even in the worst-case scenario, there is a preferential claim on residual assets, and the current amplification figure is around 40%. Therefore, the probability that STRC investors lose all their money like UST investors is extremely low.

That said, we still need to monitor how long the MSTR and STRC structure can remain sustainable. Strategy currently holds $900M in USD reserves and incurs $1.712B in annual interest and dividend costs. In other words, if the current situation continues without additional capital raising, Strategy can survive for 6.3 months using its USD reserves. If the USD reserves are exhausted, Strategy has two ways to fund interest and dividend payments: 1) raise additional capital through common stock or preferred stock issuance, or 2) sell BTC. Assuming there is no additional capital raising, BTC sales would allow the company to survive for 31 years.

Ultimately, based on the current situation, Strategy appears to need additional capital raising in order to remain sustainable. Selling BTC could also be an option, but considering the butterfly effect triggered by the recent sale of 32 BTC, this could instead have an unnecessarily negative impact on the company’s financial structure.

The conditions under which Strategy can raise additional funds are an mNAV above 1.22 and a recovery in STRC’s price. In both methods, market “trust” is the key. There needs to be confidence that 1) the Bitcoin price will rise over the long term, and 2) Strategy will be able to create added value based on Bitcoin in the future, beyond simply accumulating BTC. However, given the current market situation, it seems difficult for Strategy to raise additional capital through common stock or preferred stock issuance for the time being. Without additional funding, what Strategy can do is endure using its USD reserves and wait for the market and trust to recover in the meantime.

The next six months will be crucial. During this cycle, there has been much debate over whether the Bitcoin four-year cycle theory has broken or not. But in hindsight, this cycle also appears to be following the four-year cycle theory. If this theory remains valid, the low point of this cycle is expected to occur in the second half of 2026. Coincidentally, Strategy’s USD reserves can last for about six more months. For Strategy to raise additional funds and restart its capital engine, market conditions need to provide some support. The next six months could be an extremely difficult period for Strategy.

We will need to watch whether Strategy can regain new capital-engine momentum through healthy deleveraging over the next six months, or whether it fails to raise additional funding and remains merely one of the interesting experiments in Bitcoin history.

Others

Crypto

• Unable to recover from roughly $50 million hack, Radiant Capital is winding down
• Polymarket faces backlash over disputed Strategy bitcoin sale market
• Binance Launches Stock Trading
• Cosmos Labs acquires block explorer Mintscan, forms Korea subsidiary to expand ecosystem

Institution

• MoneyGram debuts MGUSD stablecoin on Stellar for its global payments network
• Coinbase launches pre-IPO perpetual futures, starting with SpaceX
• JPMorgan, Citi-backed consortium plans to launch tokenized deposit network in early 2027
• Securitize clears SEC registration statement hurdle, sets path to NYSE listing as SECZ

Investment

• Bitmine to launch STRC-style preferred stock offering amid $9.2 billion unrealized ETH losses
• Hyperion DeFi to unwind $29 million in HYPE deals with Felix, Native Markets as USDH sunsets

Asia

• South Korean police investigate local Polymarket users on illegal gambling charges: report
• Hong Kong taps JPMorgan, HSBC for expert group to scale tokenized bonds

2. Data Spotlight

Ethereum Staking Diversification, Seen Through Lido's Market Share (Link)

Japan Yen Stablecoin Takes Off (Link)

3. Four Pillars Weekly

: : Citrea: An Engine That Puts Bitcoin to Work for Institutional Capital (Link)

• Bitcoin is the largest cryptocurrency and the most thoroughly tested asset, yet it is also the least utilized. The arrival of spot ETFs has opened a path for institutions to hold Bitcoin, but the path to putting that Bitcoin to productive use remains closed. The constraint stems not from a lack of yield or products, but from a structural problem: every attempt to use Bitcoin requires trusting some specific party.
• Citrea positions itself as the first zero-knowledge rollup (zk-rollup) on Bitcoin, relying on Bitcoin for both data availability and settlement. The core idea is to build a programmable execution layer on top of Bitcoin without altering Bitcoin's consensus rules.
• Citrea's utilization strategy rests on three pillars. The first is Clementine, a trust-minimized bridge based on BitVM2 that transfers Bitcoin into cBTC under a 1-of-N trust assumption. The second is ctUSD, a regulation-aligned stablecoin issued by Moonpay, backed by M0's infrastructure, and collateralized 1:1 with short-term U.S. Treasuries and cash. The third is CTR, a token that coordinates capital flows within the Bitcoin economy, aligning capital deployment through vote-escrow staking, a dual treasury, and over $50 million in institutional commitments for its ecosystem liquidity.

: : MetaMask: Beyond Wallet, Open Money Platform (Link)

• Ethereum's status as infrastructure is being confirmed, and MetaMask sits at the gateway. Mirae Asset Securities defined Ethereum as a "global settlement layer and supreme court." Network activity is at an all-time high. MetaMask is the gateway that has occupied that position the longest and at the broadest scale on top of this infrastructure.
• MetaMask is moving beyond a simple wallet toward an open money platform. Swaps, perpetual futures, prediction markets, and Mastercard merchant payments are integrated into a single interface, while self-custody keeps asset control in the user's hands. It pursues the same abstraction as super apps like Robinhood and Revolut, but the direction of asset control is the opposite.
• MetaMask is already preparing for the next stage of Korea's onchain economy. As the leading wallet among Korean users, the habits and inertia built on top of it only grow stronger over time. The self-custody infrastructure integrating trading, payments, and asset management is already in place. Ready to move fastest the moment the regulatory environment opens up.

: : [Podcast] Why Blockchain VCs are Betting On Korea (Link)

• Korea moved fast in AI. Blockchain may be the next major unlock.
• In this Stateful episode, Steve and Heechang unpack why Korea is becoming one of the most important emerging markets for crypto from fintech and institutional adoption to agentic payments, STOs, and Asia expansion.

: : OpenGradient: Inference as the foundational layer of trust (Link)

• The five gaps a16z crypto laid out, identity, governance, payment, trust, and user control, ultimately converge on a single question: was this agent's judgment and execution produced in the agreed environment, without tampering? When intelligence becomes cheap, what turns expensive is verification, and verifiable inference is the precondition for the other four gaps to function on top of trust.
• An inference infrastructure that becomes a trust layer sells not the answer but the execution record. Models keep changing, but the ledger of who made which judgment, when, and from which verified call remains. The moment payment records, call histories, and verification proofs accumulate in one infrastructure, users are bound not to the model but to the record layer. This is the position OpenGradient is after.
• OpenGradient pulls verification down from a concept into a product. The explorer turns the trust chain into a record anyone can query in a browser; the Sybil detection built with Pond puts verified inference into a workflow; x402 binds payment and inference into a single call; and private inference keeps even the model provider from knowing who is asking. All four point in one direction: making verification the default of the call.
• As cheaper, faster, and smarter models keep arriving, a moat built on the model alone weakens. The durable moat lies in how models are called, verified, and recorded. Now that hundreds of billions of dollars are pouring into compute and models, what is actually missing is the layer that verifies who ran what. The moment the call, not the model, becomes the moat, verifiable inference moves past being an add-on to AI infrastructure and becomes its foundation.

: : Is MSTR-STRC The Next LUNA-UST? (Link)

• UST and STRC may look very similar in that 1) their prices are guided toward a specific reference level, 2) holders can earn a high yield, and 3) both structures contain the possibility of a death spiral. However, they are fundamentally different in terms of their price-stabilization mechanisms, the existence of legal claims, how interest/dividends are paid, and their internal operating structures.
• For Strategy to remain sustainable, continuous capital raising is essential. To do so, it needs a certain degree of investor confidence—both in the broader market and in Strategy itself. In a worst-case scenario, Strategy may fail to raise additional capital, but that does not necessarily imply a catastrophic “game over” event like LUNA–UST.
• Strategy’s current Net Leverage is around 11%, while its Amplification is around 42%. Even if MSTR and STRC were to enter a negative feedback loop, preferred shareholders would likely be able to preserve their principal through claims on residual assets as long as BTC remains above roughly ~$26K. Meanwhile, as long as BTC stays above roughly ~$8K, the probability of bankruptcy caused by debt appears low.
• The next six months will be critical. According to the Bitcoin four-year cycle theory, a bottom is expected in the second half of this year. Coincidentally, Strategy’s USD reserve is estimated to last for roughly six months. The key question is whether Strategy can regain momentum for its capital engine through healthy deleveraging over the next six months.

: : Has India’s Crypto Market Gone Quiet or Grown Up? (Link)

• During the 2020 to 2021 bull market, India emerged as a key global crypto market as retail adoption, DeFi, NFTs, and the developer ecosystem grew at the same time. Since 2022, tax and regulatory burdens have significantly reduced the visible exchange-driven momentum, but this does not necessarily mean that market demand has disappeared. The Indian market is now at an inflection point where both interpretations, “maturation” and “stagnation,” remain plausible.
• India remains one of the strongest crypto adoption markets in the world. According to Chainalysis, India ranked first in the Global Crypto Adoption Index from 2023 to 2025, with strong indicators across centralized exchanges, retail activity, DeFi, and institutional transactions. However, because these rankings are influenced by PPP-adjusted GDP per capita and population size, India’s crypto market should be evaluated by distinguishing between absolute usage and per-capita penetration.
• The positive shift in India’s crypto market is that it is expanding beyond exchange-driven speculative demand into developers, startups, infrastructure, and payment and settlement use cases. Series B and later-stage funding rounds are reappearing, and India has grown into a major developer hub, accounting for around 15.2% of global Web3 developers. At the same time, however, the value created by these developers and founders does not necessarily accrue to Indian entities, Indian employment, or Indian IP. Many projects are choosing overseas jurisdictions in search of clearer regulatory environments and more favorable investment structures.
• Stablecoins, cross-border payments, and tokenization could become important growth pillars for the Indian market, but they are also among its most sensitive regulatory challenges. Companies are experimenting with remittance, settlement, and on/off-ramp infrastructure, but Indian authorities prefer CBDC and UPI-centered institutional digital payment infrastructure over private stablecoins, citing monetary sovereignty, financial stability, and capital control concerns. As a result, India is a market with strong stablecoin demand, but the role private stablecoins will play within the domestic financial system remains uncertain.
• The biggest question for India’s crypto market is not whether demand exists, but whether that demand and talent can be kept within a transparent and regulated domestic market. High transaction taxes, AML-focused but limited regulation, exchange security incidents, withdrawal restrictions, and regulatory uncertainty could weaken the competitiveness of the onshore market and push users and founders overseas. Conversely, if India adjusts its tax structure, establishes user protection standards, and provides clear rules for stablecoins, DeFi, and tokenization, its strong adoption and developer base could translate into real financial infrastructure innovation.

: : Has STRC Killed DeFi? (Link)

• One of the hottest topics in the DeFi ecosystem these days is Strategy’s STRC. STRC is a floating-rate perpetual preferred stock issued by Strategy, and it aims to provide an annual dividend of around 11.5% centered on a reference price of $100.
• Looking at the period since STRC launched last August, total DeFi TVL, which reached $136B last August, has now fallen by 46% to $73B. During that time, the size of STRC increased by as much as 270%. Did STRC kill DeFi?
• Considering 1) that the decline in DeFi TVL is not large compared with the overall decline in token prices, and 2) that there are actually yield-bearing stablecoins whose TVL has risen as much as STRC’s, the claim that STRC’s emergence killed the DeFi ecosystem does not seem very reasonable.
• STRC has instead led to the emergence of new types of DeFi protocols onchain, such as Apyx and Saturn, and has brought vitality to various protocols derived from them. The STRC-based onchain ecosystem can be divided into three layers: 1) Issuance, 2) Tokenization, and 3) Yield.
• The size of stablecoins issued based on STRC is over $680M, and the tokenized amount is also over $130M. STRC-based assets are also exerting significant influence in yield-structuring protocols such as Pendle and Strata. Although there are sustainability concerns around STRC, separate from that, I would argue that STRC has not killed DeFi. Rather, it has revitalized the ecosystem.

Comments

• Strategy Sold 32 BTC. Is It in Trouble?
• Strategy’s Magic Number 1.22

4. Macro & Onchain Metrics

Some of the charts below are powered by CryptoQuant. For those interested in exploring the underlying data in greater detail, CryptoQuant provides access to a comprehensive suite of onchain and market analytics used by institutional participants.