I believe the vulnerability was never exploited, because the hacker would have to be a huge Zcash fan to hold onto the coins, especially now that all the coins in the pool will be counted. I think the most dangerous scenario would be someone who created a small number of coins, maybe 100 or 1,000,000, and still wanted to hold onto them until the end, believing in the project.
I don’t want to send all my coins in a single month, but this worries me because, although I believe the vulnerability wasn’t exploited, assuming it was, I would lose a significant amount of assets. This is keeping me up at night.