Zipcoin, an Ethereum-based privacy project, has announced its shutdown following an exploit that drained tokens locked vesting positions and a separate warning that its codebase and private keys may have been compromised.

The October 22 decision follows a security breach at UNCX Network that exposed approximately 1.1% of ZC's total supply. Zipcoin initially attempted to contain the fallout through treasury-funded token buybacks, but has now abandoned development after the additional security concerns surfaced.

The team announced the wind-down on X, giving holders a six-hour to exit their positions before a planned liquidation of the project's remaining treasury allocation, representing approximately 2.2% of the token supply. The sale was scheduled for noon U.S. Eastern Time on October 22.

UNCX Vesting Exploit Drained Nearly 11 Million ZC

Zipcoin's difficulties began with the UNCX Smart Token Vesting V2 exploit on October 14, when attackers manipulated internal share-accounting calculations to withdraw tokens belonging to other vesting positions. Vesting contracts of this kind are commonly used to lock team, investor and treasury allocations on fixed release schedules, and the exploited flaw sat in UNCX's shared vesting infrastructure rather than in code specific to Zipcoin.

The vulnerability affected 10 tokens across Ethereum, BNB Chain, Base and Robinhood Chain, with 11 confirmed unauthorized withdrawal transactions, according to UNCX's incident disclosure.

On Ethereum, attackers removed approximately 10.84 million ZC from the vesting manager after accounting for returned tokens, equivalent to roughly 1.1% of Zipcoin's one-billion-token maximum supply. The primary attacker subsequently converted the stolen ZC into approximately 6.52 ETH, while separate copycat transactions extracted additional proceeds.

Zipcoin initially continued operating and used treasury resources to support token buybacks. However, a subsequent security warning reportedly indicated that its entire codebase had been compromised, potentially exposing private keys and sensitive project infrastructure. The team cited this additional threat in its decision to close. Warnings of this kind carry direct operational consequences, since exposed private keys would allow unauthorized access to any funds those keys control.

The full extent of the alleged codebase compromise, including which keys may have been exposed, has not been established through a public technical investigation. A different codebase exposure affected Grafana earlier this year, when unauthorized GitHub access allowed an attacker to download company repositories. Zipcoin's reported concerns extend to potentially compromised private keys, although independent confirmation remains unavailable.

Stockereum Demands Return of 12.66 ETH as Holders Protest

The closure has triggered criticism from investors and from Stockereum, the Ethereum launchpad through which ZC originally entered circulation. In a post on X, Stockereum demanded the return of 12.66 ETH, alleging that the funds had been transferred to Zipcoin's foundation wallet and should be returned following the shutdown.

The launchpad's transaction dashboard also records a 12.660 ETH entry associated with the ZC Foundation, although the precise repayment obligation remains disputed.

Community members questioned why the project was shutting down rather than isolating compromised infrastructure, rotating exposed credentials and conducting an independent security review. Those steps are the standard incident-response measures projects typically take when assessing whether operations can safely continue, and critics questioned the decision to move straight to a wind-down instead. Some holders reported substantial investment losses, including individual claims reaching approximately $10,000.

The backlash also focused on the planned treasury liquidation. Selling the remaining project-controlled tokens into an already weakened market could create additional pressure on ZC liquidity during the closing trading window.

ZC Market Value Collapses as Project Prepares Final Sale

Zipcoin previously reached an all-time high near $0.043 on October 4, implying a fully diluted valuation of approximately $43 million, according to market data tracked on DefiLlama. The token's value subsequently collapsed, with its market capitalization falling sharply as the security incidents and shutdown announcement damaged investor confidence.

Zipcoin's planned closure follows other cryptocurrency projects abandoning compromised infrastructure. In August, BounceBit shut down its Layer 1 following a $3 million authorization exploit, although it opted to migrate its token to BNB Chain rather than discontinue its broader operations.

Zipcoin has not announced a replacement token, compensation program or formal recovery arrangement for affected investors. The team's immediate plan centers on the six-hour holder exit period and liquidation of approximately 22 million remaining ZC tokens. Whether proceeds will fund any recovery or repayment process has not been disclosed. The open items to watch are Stockereum's disputed repayment demand, the undisclosed use of liquidation proceeds and the unconfirmed scope of the reported codebase compromise, none of which the wind-down announcement has so far resolved.