News linked to both this project and an event.
Odaily reports: According to on-chain detective Specter, the Bloom drainer stole nearly $1 million and moved the funds in a manner consistent with handling eight-figure amounts. The transaction patterns suggest the operation may have been automated, including repeated splitting, consolidation, and cross-chain transfers through thousands of addresses. The attacker used 2,152 unique routing and destination addresses, of which 1,326 were Solana addresses, 822 were EVM addresses, and 5 were Zcash addresses. The attacker also bridged to Zcash, with 26.099 ZEC entering the Sapling shielded pool.
According to official reports, privacy blockchain project Pirate Chain disclosed that it suffered a transaction verification vulnerability exploit, resulting in the unauthorized minting of approximately 39.8 million ARRR and an increase in the total token supply of about 20%. The attacker transferred the newly minted funds into the Sapling shielded pool, after which part of the funds flowed into the NonKYC exchange, with related deposit accounts restricted from withdrawals; due to the shielding features of the transactions, the complete subsequent flow of funds cannot be traced.
: The Zcash Foundation has released version 4.5.0 of its node client, Zebra. This update includes multiple security fixes, addressing a critical consensus vulnerability and several high-severity Denial of Service (DoS) issues. All node operators are strongly urged to upgrade immediately.Key fixes in this release include a sigop counting error in P2SH script parsing (which could cause a consensus fork with zcashd), a logic flaw in NU5 block validation caching, a crash risk related to transparent address balance overflow, along with multiple crash and resource exhaustion vulnerabilities in RPC interfaces and mempool processing. The Foundation stated that some vulnerabilities could be exploited by malicious nodes, leading to node stalls, restart loops, or even permanent stoppage.Additionally, this version adds support for ZIP-213 (enabling shielded coinbase outputs to Sapling) and optimizes network performance and security boundaries. This includes limiting resource allocation during the pre-handshake phase, fixing risks related to multi-threaded queue abuse, and enhancing the misbehavior scoring mechanism.The Zcash Foundation stated that this update addresses over 80 security reports from the ZCG Vulnerability Disclosure Program (spanning April to May 2026), covering multiple layers including consensus security, memory management, RPC processing, and the P2P network attack surface. Officials emphasized that there is no alternative to this upgrade; upgrading is the only way to ensure nodes do not experience a chain split and remain secure.