For a few tense days, Zcash faced the kind of uncertainty that rattles even seasoned crypto holders. A serious vulnerability had been uncovered in its privacy infrastructure, triggering an emergency response from developers and raising uncomfortable questions about the protocol’s integrity. The mood has since shifted considerably — and for good reason.

An audit requested by Shielded Labs and conducted by Claude Mythos, Anthropic’s AI model specialized in identifying complex software vulnerabilities, found no additional major flaws in the Zcash protocol. For a privacy-focused network where trust is the entire value proposition, that outcome matters enormously.

How the Vulnerability Was Found

The story starts with independent researcher Taylor Hornby, who — with the assistance of Claude Opus 4.8 — identified a critical flaw in Zcash’s Orchard private pool. The vulnerability had been sitting dormant for roughly four years before being discovered. Its potential consequences were severe: if exploited, it could have allowed an attacker to mint an unlimited quantity of counterfeit ZEC within the Orchard pool, entirely undetected.

Zcash founder Zooko Wilcox didn’t downplay the severity. He confirmed publicly that the flaw represented a genuine threat to the protocol’s monetary integrity, while also noting — critically — that no exploitation had been detected on the main network. No ZEC was illegally created, and user privacy remained intact throughout. Developers moved quickly, temporarily suspending Orchard transactions before deploying a corrective patch.

The AI Audit That Followed

Once the patch was applied, Shielded Labs commissioned a comprehensive follow-up audit — less emergency surgery, more thorough post-operative review. Claude Mythos was the tool of choice. The result: no other serious vulnerabilities identified in the Zcash protocol.

Wilcox acknowledged Anthropic’s contribution publicly, thanking the team for its role in protecting network security. He also confirmed that security reinforcement work was continuing methodically, without any rushed decisions that might introduce new risks.

The scope of what Mythos is capable of is itself worth noting. Anthropic has indicated the model has identified more than 10,000 critical vulnerabilities across software considered strategically important to global digital infrastructure — a number that speaks to both the power of AI-assisted code review and the sheer scale of vulnerabilities quietly embedded in widely used systems.

The Double-Edged Sword AI Represents for Crypto Security

The Zcash episode arrives in the middle of a much larger conversation about what AI means for cybersecurity in crypto. The same capabilities that allowed Claude Opus 4.8 to help discover this flaw — and Claude Mythos to verify the protocol afterward — are equally available to malicious actors looking to find exploitable weaknesses before defenders do.

Mitchell Amador, CEO of Immunefi, has described the proliferation of advanced AI models as shifting the cybersecurity playing field toward attackers, warning of a “vulnerability apocalypse” that is driving a resurgence of DeFi hacks. The data gives that warning real weight. According to DefiLlama, crypto hacks reached $634 million in April alone — the worst single month recorded since the Bybit attack in February 2025.

For Zcash specifically, the outcome of this audit is a meaningful positive. The vulnerability was found, patched, and independently verified before any damage occurred. That’s the best-case scenario for a privacy protocol facing this kind of discovery. Whether the broader industry can keep pace with AI-assisted attackers using the same tools in the opposite direction is a question that has no clean answer yet.

Humanity Protocol’s H token collapsed on Tuesday following a security breach that drained more than $32 million from the project. The token opened the day near $0.67, fell sharply to around $0.13, and at one point briefly touched $0.05 as sell pressure intensified throughout the session. By the time trading settled, H had lost roughly 82% of its value in a single day.

The scale of the damage — and the speed of the collapse — put Humanity Protocol among the more severe crypto security incidents of 2026.

How the Attack Unfolded

Project founder Terence Kwok confirmed that the breach originated from the theft of private keys belonging to a member of the Humanity Foundation. Private keys grant complete control over a crypto wallet, and once an attacker has them, there’s little standing between them and the funds inside.

On-chain data revealed the attacker moved through approximately 17 wallets connected to the project. Beyond transferring existing tokens, they also minted around 100 million new H tokens — worth roughly $11 million — on the BNB Chain. Those tokens were then sold for Ether, amplifying the downward pressure on price and raising concerns about continued selling as the stolen supply continues to hit the market.

The Humanity Protocol team has advised users to avoid the project’s bridge infrastructure and liquidity pools until the situation is fully contained. The team confirmed it is working with security firms and exchange partners on an ongoing investigation.

Where Humanity Protocol Fits in the Broader Landscape

Humanity Protocol is a decentralized identity platform built around palm-scanning biometrics and zero-knowledge cryptography. The concept allows users to prove they are human without exposing personal data — positioning it as a direct competitor to Sam Altman’s Worldcoin initiative. It’s a compelling use case, which makes the timing of this breach particularly damaging for the project’s credibility.

A Pattern That Keeps Repeating in 2026

What’s striking about this incident is how familiar it looks. The table below, drawn from recent on-chain records, captures the pattern:

Humanity Protocol — Tuesday — Over $32 million — Private key compromise Drift — April 2026 — About $285 million — Administrator key theft Kelp DAO — April 2026 — About $292 million — Single-validator bridge flaw

In April, Solana-based Drift exchange lost nearly $285 million after an administrator key was compromised. Kelp DAO suffered roughly $292 million in losses through a single-validator bridge vulnerability in the same month. All three incidents share a common thread — the vulnerability wasn’t a smart contract flaw buried in code. It was human-layer access control failing at a critical point.

That distinction matters. Smart contract bugs can be audited and patched before deployment. Private key security depends on operational practices, personnel trust, and storage hygiene — areas where even well-funded projects have repeatedly come up short this year. As crypto projects scale and handle larger treasuries, the weakest link increasingly isn’t the protocol itself.

H token was last seen trading around $0.13, with on-chain activity suggesting assets continued to flow out even as this article was being written.

Michael Saylor’s company Strategy has made another massive Bitcoin purchase, pushing its total holdings past 800,000 BTC and reinforcing its position as the largest public holder of the asset.

Massive $2.5 Billion Bitcoin Purchase

Strategy acquired 34,164 Bitcoin for approximately $2.54 billion between April 13 and April 19, according to a recent SEC filing.

The purchase ranks as the company’s third-largest Bitcoin buy ever, highlighting its continued aggressive accumulation strategy.

The coins were bought at an average price of $74,395 per BTC, slightly below Strategy’s overall average purchase price.

Total Holdings Now Above 800K BTC

Following the latest acquisition, Strategy now holds:

• 815,061 BTC total
• Purchased for roughly $61.56 billion

This milestone comes just one week after the company revealed a separate $1 billion Bitcoin purchase, showing how rapidly it continues to scale its position.

Funded Largely Through STRC Offering

A significant portion of the latest purchase was funded through Strategy’s preferred stock offering:

• $2.18 billion (85.7%) came from STRC issuance
• $366 million came from selling Class A shares (MSTR)

The STRC program has become a core funding mechanism for Strategy’s Bitcoin accumulation strategy.

Record-Breaking Buying Activity

The company also set new internal records during the buying period.

On April 13 and 14 alone, Strategy executed massive purchases tied to its at-the-market (ATM) program:

• ~7,741 BTC in one day
• ~9,364 BTC the next day

Combined, these two days accounted for over 17,000 BTC, marking a sharp increase compared to previous weekly averages.

Saylor Teased the Move

Michael Saylor hinted at the purchase ahead of time with a cryptic “Think Even Bigger” post, a pattern he has used before major acquisition announcements.

Dividend Strategy to Boost Demand

Alongside its Bitcoin buying spree, Strategy is also exploring changes to its investor offering.

The company recently proposed semi-monthly dividend payments for its STRC preferred shares, aiming to:

• Stabilize share price
• Increase liquidity
• Attract more investor demand

If approved, Strategy would become one of the few companies globally to offer such frequent dividend payouts.

Strategy Doubles Down on Bitcoin Conviction

This latest purchase reinforces Strategy’s long-term bet on Bitcoin as a primary treasury asset.

Despite market volatility and unrealized losses in prior quarters, the company continues to accumulate aggressively, signaling strong confidence in Bitcoin’s future value.