How Likely Was Zcash Exploited? Grayscale CLO Points To On-Chain Odds

Grayscale Chief Legal Officer Craig Salm has suggested that Zcash’s own shielded user base may be offering a more meaningful signal on exploit risk than external prediction markets. His comments came after Polymarket opened a market on whether Zcash’s Orchard pool vulnerability, publicized on June 4, is ultimately confirmed to have been exploited on mainnet.

The Polymarket contract, opened on June 5, currently shows a 10% chance of confirmation, with $14,306 in volume. The market asks whether the Orchard pool vulnerability was exploited before it was fixed, with resolution dependent on explicit confirmation from Shielded Labs, the Zcash Foundation, or the Zcash Open Development Lab, known as ZODL. It can also resolve “Yes” if there is an overwhelming consensus of credible reporting that a qualifying exploit occurred.

How Likely Was Zcash Exploited?

Salm’s argument was not that the Polymarket odds are wrong. Rather, he pointed to a different group of participants with a much more direct financial incentive to assess the risk: users who still hold funds inside the Orchard pool.

“Perhaps a better ‘prediction market’ is the Zcash Orchard pool itself,” Salm wrote on X. “These are the users with potentially billions of dollars at stake in whether the vulnerability was exploited, since they’re most directly affected if excess ZEC claims exist in Orchard and the turnstile limit is reached. Yet Orchard balances appear to have declined by only ~5% since the exploit was disclosed, which may also simply reflect users preparing to move to a new shielded pool.”

That framing shifts attention away from prediction-market pricing and toward observed user behavior. If Orchard users believed there was a high probability that invalid or unbacked ZEC had been created inside the pool, the economic incentive to exit would be substantial. Instead, according to Salm, balances appear to have fallen by only around 5% since disclosure.

He cautioned, however, that the data does not prove the vulnerability was unexploited. “Not proof of anything, but an interesting signal from the users with strong economic incentive to assess the risk correctly,” he added.

Notably, Polymarket market is not simply asking whether a serious bug existed. Its rules are narrower. A “Yes” outcome requires confirmation that the June 4 Orchard vulnerability was exploited on Zcash mainnet before the fix was activated by December 31, 2026, at 11:59 p.m. ET. Qualifying evidence includes confirmation that the bug was exploited, that extra or unauthorized ZEC was created through the vulnerability, or that a future upgrade, migration, audit, turnstile-accounting process, or official investigation reveals excess or invalid ZEC attributable to this specific issue.

New or separate exploits after the original vulnerability was fixed are explicitly excluded. That means the market is effectively pricing the odds of a specific historical exploit being confirmed by official sources or broad credible reporting, not the broader question of whether Zcash faces future shielded-pool risk.

Additional on-chain commentary from CipherScan pointed in a similar direction. The analytics account said 380,000 ZEC had been deshielded, but argued that the headline number overstated actual exit pressure. According to CipherScan, only half of the deshielded amount had moved, while 45% remained parked at transparent addresses.“

Only 21% of the deshielded ZEC actually left Zcash,” CipherScan wrote, putting that figure at 82,000 ZEC, or 1.6% of the shielded pool and 0.5% of total supply. It also said 47,000 ZEC went to exchanges, describing that as “the total sell pressure from Orchard holders,” equal to 0.28% of supply against a reported $6.7 billion market capitalization.

CipherScan also noted that roughly 118,000 ZEC was shielded during the same period, arguing that even during peak concern, some users were still moving into shielded balances rather than only exiting them. “Holders parked. They didn’t panic,” the account wrote. “The selling was traders who were already on exchanges. Security is hardened and will be even more so.”

At press time, ZEC traded at $425.