Zcash Foundation Releases Critical Zebra Update Amid $651M Crypto Exploits
Severity: High (Score: 72.0)
Sources: Mexc, Panewslab, coinmarketcap.com, Cryptopolitan, zfnd.org
Summary
On May 2, 2026, the Zcash Foundation announced the release of Zebra version 4.4.0, addressing multiple critical security vulnerabilities that could lead to network consensus issues. The update comes in the wake of a record $651 million in crypto losses reported for April 2026, marking it as the worst month for crypto hacks. The vulnerabilities include a denial-of-service flaw that could prevent nodes from discovering new blocks, consensus disagreements due to incorrect signature counting, and risks associated with memory allocation. If exploited, these flaws could allow Zebra nodes to accept blocks that are rejected by legacy zcashd clients, potentially causing chain splits. The Foundation has urged all node operators to upgrade immediately to mitigate these risks. Security researcher Sangsoo-osec identified three of the five vulnerabilities, which include GHSA-28xj-328h-72vm, GHSA-jv4h-j224-23cc, and GHSA-gq4h-3grw-2rhv. The update is critical as it addresses issues that could lead to significant disruptions in the Zcash network. Key Points: • Zcash Foundation released Zebra 4.4.0 to fix critical consensus vulnerabilities. • April 2026 saw $651 million in crypto losses, the highest in history. • Immediate upgrades are necessary to prevent potential chain splits and denial-of-service attacks.
Key Entities
- Lazarus Group (apt_group)
- DDoS (attack_type)
- Bybit (company)
- Drift Protocol (company)
- KelpDAO (company)
- LayerZero (platform)
- Zcash (platform)
- Zcashd (platform)
- Zebra (platform)
- North Korea (country)
- cryptopolitan.com (domain)
- GHSA-28xj-328h-72vm (vulnerability)
- GHSA-438q-jx8f-cccv (vulnerability)
- GHSA-cwfq-rfcr-8hmp (vulnerability)
- GHSA-gq4h-3grw-2rhv (vulnerability)
- GHSA-jv4h-j224-23cc (vulnerability)