Zcash just froze $15 million, and nobody knows whose money it is

On November 6, 2026, about $15 million worth of the cryptocurrency Zcash became unspendable. Nobody knows whose money it is: not the developers, not the exchanges, not the network itself. The coins sit in Sprout, Zcash’s very first private pool, launched almost exactly ten years earlier. At 02:34 UTC the network stopped accepting an old type of transfer, the only one that could get money out of Sprout. At that moment the pool held 12,224 ZEC. Sprout was built to hide owners and amounts, so from the outside only one number is visible: the total balance.

Stranger still is what happened before the freeze. In March 2026 the same pool held 25,424 ZEC, and the developers treated those coins as lost for good. Over the previous fifteen months the balance had barely moved. Then the pool got a closing date, and within a few months half the coins walked out. Money everyone assumed was dead had simply been waiting.

Money born at a bonfire

Zcash launched on October 28, 2016, as a kind of bitcoin with an invisibility mode. On bitcoin, every transfer is public: the sender’s address, the recipient’s address, the amount. On Zcash you could move coins into a “shielded pool”: a shared, opaque vault inside the network. Coins go in and come out, but nobody can see what is inside or whose it is. The network sees only a proof that each transfer is valid. Who paid whom, and how much, stays secret.

The trick is a zero-knowledge proof: a way to show that you own the money and aren’t spending it twice, without revealing either the money or yourself. Nobody had run anything like it at scale before 2016. Sprout was the first.

The math came with a nasty byproduct. Before launch, the system needed a set of shared parameters, generated once. The process also produced data that the developers themselves called “toxic waste.” Anyone who kept it could mint unlimited counterfeit coins, and nobody would ever notice.

The solution bordered on theater. Six people at six separate stations generated the parameters together. Each added a fragment of the secret, and if even one of them destroyed their fragment, the toxic waste could never be rebuilt. Journalist Morgen Peck watched the station in Boulder, Colorado, for IEEE Spectrum. Its computer was bought new in Denver and stripped of its wireless card and hard drive. Intermediate results went onto write-once DVDs, and five cameras recorded the room.

One station was on the move. Bitcoin developer Peter Todd computed his share on a laptop in a foil-lined cardboard box while driving across British Columbia. Afterward he burned the machine with a propane torch. His goal, he said, was to outdo every other station “in Canadian cypherpunk glory.”

Colorado skipped the torch but not the drama. Zcash founder Zooko Wilcox, his brother Za and Za’s wife Jessica destroyed the hardware in a Longmont backyard by the light of car headlights. Za cut into a Lenovo desktop with an angle grinder, Zooko took a sledgehammer to the tower, and the wreckage went into a fire pit doused with lighter fluid. The air smelled of melted plastic. “And this, children, is why on Oct. 23 we have fireworks,” Zooko said for the benefit of future generations.

A flaw only four people knew about

The bonfire guarded against one threat: someone secretly keeping the toxic waste. It did nothing about a mistake in the math itself.

On the night of March 1, 2018, Ariel Gabizon, a cryptographer at the Zcash Company, the firm behind the coin, was preparing a talk for an academic workshop. Along the way he found a hole in the scheme used to generate the parameters. The flaw meant the published record of the ceremony contained extra elements. With that record in hand, someone could forge a proof and mint an unlimited number of coins inside Sprout. Undetected.

At first only four people knew: Gabizon, fellow company cryptographer Sean Bowe, CEO Zooko Wilcox and chief technology officer Nathan Wilcox. The company deleted the public record of the ceremony and called the deletion an accident. The fix was tucked inside Sapling, a large scheduled upgrade that went live on October 28, 2018. According to the company, even its own engineers didn’t know what they were shipping. Later the record was rebuilt from the DVDs and republished. The flaw itself stayed secret until February 2019.

The company found no trace of an attack on the blockchain. To reach that conclusion, it relied on a detail that keeps coming back in this story. Sprout works like a turnstile. You can’t see what’s inside, but the network counts how many coins went in and how many came out. If someone had minted fake coins and withdrawn more than was ever deposited, the pool’s balance would have gone below zero. It never did, and the company chose its words carefully: as long as the balance stays above zero, no counterfeiting has been detected.

The turnstile has an honest limit. It guarantees that no more coins can leave the pool than went in. But if counterfeiting did happen and the fakes were withdrawn, the last Sprout holders would be left with the shortfall: there would not be enough real coins inside for everyone.

That same counter now reads 12,224 ZEC.

The door locked from the outside

After 2018, Sprout was obsolete. Zcash added newer pools, Sapling and later Orchard, which were faster, lighter and easier to use. Keeping the old design meant leaving a spare door for a burglar to find.

On November 18, 2020, the Canopy upgrade banned new deposits into Sprout. Withdrawals still worked. The developers’ reasoning included a line that looks almost prophetic six years later: the possibility of other cryptographic weaknesses “cannot be entirely ruled out.”

So who kept coins in there all this time? Almost certainly not ordinary people with a phone app. A Zcash developer who posts on the project forum as nuttycom pointed out that no consumer-grade wallet ever supported Sprout. Only people running their own full node could use it: early miners, enthusiasts and the first investors of 2016 and 2017. Some of them have probably lost their passwords. Others simply stopped paying attention once the coin’s price fell.

A second hole, found with AI

In March 2026 that caution proved justified. Researcher Alex Sol, who goes by Scalar, used AI to discover that zcashd, the main Zcash node software, had not been checking proofs in Sprout transactions at all since July 2020. A malicious miner could have drained more than 25,000 ZEC from the pool, then worth about $6.5 million.

The report arrived on March 23, and within three days the biggest miners had installed the fix. Nobody exploited the bug. Even in the worst case, the same turnstile would have capped the damage: an attacker could have stolen other people’s coins from the pool but could not have taken out more than it held. Sol received a 200 ZEC bounty.

For those who wanted Sprout gone, this became the strongest argument. Almost nobody uses the old code, so almost nobody checks it. But the money sitting in it is real.

Half the “dead” coins came back to life

In October 2024 cryptographer Daira-Emma Hopwood proposed switching Sprout off for good. Her reasoning: almost nobody used it, yet every node on the network had to check its transfers, which made it a needless target for attacks. And the only software with a Sprout wallet was about to be retired.

In December 2024, with 26,054 ZEC still in the pool, the Zcash forum ran a poll, and the debate got heated. One participant called the freeze “total disrespect to early holders, miners, investors, privacy and to immutability.” Another worried about people who had simply forgotten about Zcash and asked for a “plan B” so the coins could be recovered later. Hopwood replied that recovering them later was theoretically possible. But she urged anyone who still had keys to move their money now, while the old software still worked. Everyone else, she wrote, had unfortunately most likely lost their keys.

Then, for more than a year, nothing happened. By March 2026 the balance had dropped by just 630 coins.

Then everything moved at once. From March on, ZEC’s price rose roughly fivefold, and a forgotten stash was suddenly worth real money. NU7 got a date: first November 5, then an exact block height. In September the warnings spread through the crypto press, Zooko Wilcox repeated them on X, and forum members urged everyone to check their old wallets. Within a few months 13,200 coins left the pool, more than half of what had been written off as lost.

The closest parallel is a government pulling old banknotes out of circulation. On November 8, 2016, eleven days after Zcash launched, India declared its 500 and 1,000 rupee notes invalid, and people had until the end of the year to deposit them at a bank. In the end, 99.3% of the notes came back. A deadline works better than any amount of persuasion. But someone with old banknotes can walk into a bank. Someone with Sprout coins has nowhere to go: the network has no teller who can look you in the eye and decide to believe you.

Frozen, not burned

Technically, the 12,224 ZEC haven’t gone anywhere. Hopwood’s proposal, ZIP 2003, stresses that the coins are not burned and still count as issued. The network simply refuses the transactions that could move them. A future upgrade could bring the old format back or invent another way to retrieve the funds. The document is candid about the odds, though: the ability to spend Sprout funds “may never be re-enabled.”

Ideas for getting the money out are already circulating. Sean Bowe, one of the four people who kept the 2018 flaw secret, has sketched a recovery mechanism, though nothing had been approved by activation day. Back in 2024 the forum discussed a “last resort”: gather the remaining balance in a single wallet and pay out to anyone who can prove they own an old key. The proof, again, would be zero-knowledge. Even its proponents admitted the result would be “glaringly centralized.” Someone would have to hold that wallet, and everyone would have to trust them.

Bitcoin faces the same fight

Zcash has done what bitcoin is still arguing about. In April 2026 developer Jameson Lopp and five co-authors proposed BIP-361: five years after activation, freeze coins at addresses that future quantum computers could crack. That covers about 6 million BTC, including roughly 1.7 million at the very earliest addresses, Satoshi Nakamoto’s coins among them. The logic matches Zcash’s: better to freeze the coins than wait for someone else to steal them.

The authors promise owners who still have their recovery phrase a way to reclaim their funds. For the earliest addresses, Satoshi’s included, they admit nobody has found such a rescue yet. Like Sprout, those coins may be left with no keyhole at all. A week ago FUTURMAG looked at why old coins are the most exposed.

Reaction to Lopp’s proposal was fierce. Phil Geiger of Metaplanet, a Japanese company that stockpiles bitcoin, summed up the main objection in one line: “We have to steal people’s money to prevent their money from being stolen.”

Cryptocurrencies promised money that nobody can take away: not a bank, not a government, not the developers. Sprout shows where that promise ends. Old code eventually becomes a hole, and a community has to decide which is more dangerous: leaving it open, or sealing it with other people’s money inside. Zcash chose to seal it and set a public deadline. More than half the coins got out in time.

The other 12,224 coins sit behind a turnstile that still counts them faithfully. If someone finds an old hard drive with a Sprout key five years from now, who decides whether they get their money back: the code, the developers or a forum poll?