About this Statement
Coinsquare Capital Markets Ltd. (“Bitbuy”) is offering crypto contracts to purchase and sell Zcash (ZEC) in reliance on a prospectus exemption granted by the Canadian Securities Administrators (CSA) in the amended and restated exemptive relief decision dated October 11, 2024. The statutory rights of action for damages and the right of rescission in section 130.1 of the Securities Act (Ontario) and similar legislation in the other CSA jurisdictions do not apply in respect of a misrepresentation in this statement to the extent that a crypto contract is distributed under the above-noted prospectus relief.
No securities regulatory authority in Canada or any other jurisdiction has expressed an opinion about any of the crypto assets (or crypto contracts) that are available through Bitbuy’s platform, including an opinion that the crypto assets are not themselves securities and/or derivatives.
Bitbuy has compiled the information contained in this Crypto Asset Statement to the best of its ability based on publicly available information.
About ZCash
ZCash is a privacy-focused Layer 1 cryptocurrency with a fixed supply of 21 million units. It uses zero-knowledge proofs to verify transaction integrity without disseminating wallet and transaction history. It was founded in 2016 by Zooko Wilcox-O'Hearn. The original code base was partly based on Bitcoin, with changes primarily to enable more transaction privacy.
Risks
As with all assets, investing in ZEC is not without some general risks. Many of these risks are identified and explained in our Risk Statement.. In addition to the general risks, we outline some risks that are specific to ZEC below. While we make an effort to identify every source of risk, we encourage you to do your own research and ensure you are comfortable investing in ZEC.
Unknown History of Custodied Funds
Due to the private nature of all transactions on ZCash, assets held in custody have unknown provenance further back that the original transaction between CCML and its Liquidity Providers. CCML conducts due diligence on all Liquidity Provider partners before trading with them.
Regulatory Risk of Privacy-Focused Projects
The privacy-first design of ZCash puts it in a category commonly referred to as “privacy coins”. There is a risk that in the future a domestic or international regulator may target ZCash founders, investors, holders, miners or other associated entities. This may negatively impact the future value of ZCash, or the ability to sell any ZCash in the future, including ZCash bought from CCML and/or held in custody by CCML.
OrchardCounterfeiting Vulnerability (June 2026)
On June 4, 2026, Shielded Labs (a nonprofit Zcash developerorganization) publicly disclosed a critical counterfeiting vulnerability inZcash's Orchard shielded pool. The flaw, caused by an under-constrained elementof the Orchard circuit, could have allowed an attacker to create an unlimitedquantity of undetectable counterfeit ZEC. It was present from Orchard'sactivation in May 2022 until an emergency fix was coordinated by the Zcash OpenDevelopment Lab (ZODL) and completed on June 1–2, 2026, after being identifiedon May 29, 2026. Due to the privacy properties of the Orchard pool, there is nocryptographic method to definitively determine whether the vulnerability wasexploited prior to remediation using existing on-chain data.
Shielded Labs has assessed prior exploitation as unlikelybut has stated users should not rely solely on that assessment. On June 5,2026, the Zcash team indicated via X that it may be able to audit the supply ofthe recently patched Orchard pool using a new method, with further details tofollow. Shielded Labs is also exploring a proposed Network Upgrade that woulddeploy a new shielded pool and enforce turnstile accounting on Orchard coins toallow independent verification of the ZEC supply, subject to communitygovernance.
Key risks for clients include: supply integrity risk, as counterfeit ZEC mayhave entered circulation before the fix and potentially exceeded the 21 millionunit cap, diluting legitimate holdings; price volatility risk, with ZEC downapproximately 30% in the 24 hours following disclosure and further movementlikely as audit results and governance discussions unfold; network upgraderisk, as any approved upgrade may require holders of ZEC in the Orchard pool tomigrate through a new shielded pool with turnstile accounting on undeterminedtiming and terms; residual security risk, given that the four-year detectiongap underscores the possibility of further undiscovered vulnerabilities in theprotocol; and liquidity and trading risk, as ongoing uncertainty may affectliquidity, spreads, and execution prices.
Bitbuy’s Due Diligence for Digital Assets
To be made available for trading on Bitbuy’s platform, a digital asset must pass the following due diligence reviews:
Bitbuy undertakes these three levels of due diligence in order to determine whether the digital asset is compliant with our legal and regulatory obligations, is secure, and has historical data supporting a beneficial business case. Bitbuy’s New Product Committee must provide final approval for a new digital asset to be made available on the platform.
References:
Zcash: Privacy-protecting digital currency. November 24th 2025. https://z.cash/
Last updated: June 8, 2026
