A critical soundness bug in Zcash's Orchard zero-knowledge proof circuit — undetected for four years since the pool's May 2022 activation — allowed unlimited counterfeit ZEC creation inside the shielded pool. Security engineer Taylor Hornby discovered the flaw on May 29, 2026 using an AI-assisted...
"The vulnerability could have been exploited to undetectably create an unlimited amount of counterfeit ZEC within Orchard." — Zooko Wilcox-O'Hearn, Zcash Founder
A critical soundness bug in Zcash's Orchard zero-knowledge proof circuit — undetected for four years since the pool's May 2022 activation — allowed unlimited counterfeit ZEC creation inside the shielded pool. Security engineer Taylor Hornby discovered the flaw on May 29, 2026 using an AI-assisted auditing framework running Anthropic's Opus 4.8 model, one day after the model's release. Zcash developers coordinated an emergency soft fork on June 2 (block 3,363,426) and a hard fork on June 3 (block 3,364,600) to remediate the vulnerability.
ZEC shed over 50% in value post-disclosure, falling from approximately $630 to as low as $250 before partially recovering to ~$310. Liquidations topped $116 million. BitMEX co-founder Arthur Hayes liquidated his entire ZEC position. The incident marks the second counterfeiting-class bug in Zcash's history, following a similar 2018 flaw quietly patched during the Sapling upgrade. Shielded Labs has proposed a new network upgrade deploying a clean shielded pool with turnstile accounting to verify supply integrity.
The flaw resided in two lines of code within the Orchard circuit's variable-base scalar multiplication gadget, part of the halo2_gadgets crate. The constraint, intended to enforce an arithmetic check on transaction inputs, contained a gap that allowed arbitrary false values to pass validation.
Specifically, the vulnerability stemmed from an "under-constrained" element in the circuit that made it possible to input arbitrary false values into an elliptic curve multiplication and still receive valid approval from the proof system. This broke the "soundness" property — the fundamental guarantee that a zero-knowledge proof system will reject invalid state transitions.
The practical consequence: an attacker could spend the same shielded note multiple times by revealing a unique nullifier with each spend. Each forged transaction would produce a valid proof, minting unlimited, undetectable counterfeit ZEC within the Orchard pool.
Under-constrained elliptic curve checks rank among the most common weaknesses in production ZK circuits, according to security researchers. The Orchard circuit had passed multiple audits by expert cryptographers over four years without the flaw being identified.
Taylor Hornby, an independent security engineer hired by Shielded Labs in April 2026 for an ongoing protocol review, discovered the vulnerability on May 29 using a custom AI auditing agent framework. The framework was paired with Anthropic's Opus 4.8 model, released just one day prior on May 28.
According to reporting from BeInCrypto and Blockhead, the AI-assisted approach enabled examination of specific circuit constraints at a depth and speed that previous manual reviews had not achieved. Hornby subsequently wrote a complete exploit program that successfully generated unlimited counterfeit ZEC in a local testing environment.
The disclosure was made privately to the Zcash Open Development Lab (ZODL), which coordinated the emergency response across ecosystem participants including miners and exchanges. The public disclosure came on June 5, after the network had already been patched.
The role of AI in discovering a vulnerability that eluded multiple expert audits for four years raises questions about the adequacy of conventional security review processes for complex ZK circuits.
The response unfolded over six days:
| Date | Event | |------|-------| | May 29 (evening) | Hornby identifies vulnerability, discloses to ZODL engineers | | May 30–June 1 | Private coordination with miners, exchanges, and ecosystem stakeholders | | June 2, 02:00 UTC | Soft fork at block 3,363,426 — Zebra 4.5.3 temporarily disables all Orchard transactions | | June 3, 00:05 EDT | NU6.2 hard fork at block 3,364,600 — Orchard re-enabled with corrected circuit | | June 3 | Zcash blockchain experiences over 4 hours of downtime during the transition | | June 5 | Public disclosure by Zooko Wilcox-O'Hearn and Shielded Labs |
The decision to disable and then hard-fork the protocol within five days of discovery, before public disclosure, drew criticism. Seth for Privacy characterized ZODL's coordination process as an "abuse of insider access," highlighting governance centralization concerns in what is ostensibly a decentralized protocol.
This was only Zcash's second security-driven protocol upgrade since the network launched in 2016.
ZEC lost over $3 billion in market capitalization within approximately 24 hours of the June 5 disclosure.
Price action:
Liquidation data (CoinGlass):
Notable market participant exits: Arthur Hayes, BitMEX co-founder and Maelstrom CIO, disclosed he had sold his entire ZEC position and Maelstrom's holdings. According to crypto.news, Hayes framed the exit as reflecting a fundamental thesis failure, stating that "privacy trades need certainty rather than mere probability of soundness."
The selloff occurred against a backdrop of ZEC's prior 900%+ gain over twelve months, gains that some analysts attributed to trader rotation into privacy assets rather than measurable adoption growth.
The core unresolved issue: due to the privacy properties of the Orchard pool, there is no cryptographic way to determine whether the flaw was exploited before the June 2 patch.
The Zcash Foundation stated that "no evidence of unauthorized value creation" was found. However, the privacy architecture that makes Zcash's shielded transactions unlinkable also makes proving negative exploitation mathematically impossible through on-chain analysis alone.
Approximately 30% of ZEC's circulating supply — roughly 5 million of 16.7 million ZEC — sits in the shielded pool. The Orchard pool specifically holds approximately 4.2 million ZEC.
Shielded Labs' proposed remedy: Shielded Labs has proposed a network enhancement that would:
The proposal aims to prove that counterfeit ZEC does not remain inside the affected pool. Shielded Labs stated it plans to publish full technical details the following week. The upgrade would require community support and must pass Zcash's governance process before activation.
This is the second counterfeiting-class vulnerability in Zcash's history. In March 2018, a cryptographer employed by the Zerocoin Electric Coin Company discovered a bug that theoretically allowed unlimited counterfeiting. That flaw was quietly fixed during the Sapling network upgrade, which activated on October 28, 2018 — a seven-month disclosure-to-fix cycle, compared to five days for the current Orchard bug.
The recurrence of the same vulnerability class — counterfeiting enabled by ZK circuit flaws — raises structural questions about the long-term auditability of zero-knowledge proof systems in production cryptocurrency deployments.
The Orchard vulnerability has reignited the comparison between Zcash's optional-privacy, ZK-proof-based architecture and Monero's mandatory-privacy, ring-signature-based model.
| Metric | Zcash (ZEC) | Monero (XMR) | |--------|-------------|--------------| | Privacy model | Optional (shielded pool) | Mandatory (all transactions) | | Current tech | Halo 2 zk-SNARKs | FCMP++ (deployed late 2025) | | Shielded/private usage | 59.3% of transactions (Feb 2026 ATH) | 100% | | Daily public tx count | ~8,500 | ~3x Zcash volume | | Supply auditability | Impaired (post-bug) | Not cryptographically auditable | | Exchange delistings | Partial (viewing keys provide opt-in compliance) | Extensive (70+ exchanges by late 2025) |
According to CryptoTimes reporting, Monero remained price-stable during Zcash's selloff, with some capital rotation toward XMR. However, Monero's own architecture does not offer supply auditability either — a fundamental limitation shared by both privacy-coin approaches.
Zcash retains one structural advantage: its optional privacy model and viewing keys allow selective disclosure, enabling centralized platforms to maintain listings. By contrast, Monero's mandatory privacy has led to delistings from over 70 exchanges.
The incident surfaces systemic concerns for the broader zero-knowledge proof ecosystem, which underpins not only privacy coins but also Ethereum Layer 2 rollups, cross-chain bridges, and identity systems.
Under-constrained circuits — where proof systems fail to enforce all necessary arithmetic checks — represent a known vulnerability class. The Orchard bug persisted through multiple expert audits over four years, suggesting conventional code review processes may be insufficient for the mathematical complexity of ZK circuits.
The AI-assisted discovery method — using a custom agent framework paired with a large language model — represents a new vector for protocol security. If an AI model can identify a flaw that human auditors missed for 48 months, the economics of ZK circuit auditing may shift. The question is whether this extends to other production ZK systems, including those securing billions in Layer 2 TVL.
For protocols deploying ZK proofs in production, the Zcash incident provides a concrete data point: four years of expert review were insufficient. The surface area for soundness bugs in complex circuits remains large, and the consequences of a missed constraint — particularly in privacy-preserving systems where exploitation is undetectable — are severe.
The Orchard vulnerability represents the most severe security event in Zcash's ten-year history. The flaw's four-year dormancy, its discovery by AI rather than conventional audit, and the fundamental inability to verify whether it was exploited each compound the damage to market confidence.
The proposed turnstile migration offers a path to supply verification, but requires community governance approval and user action to migrate funds. Until that process completes, a persistent uncertainty hangs over Zcash's monetary integrity — the very property a cryptocurrency cannot afford to have questioned.
For the broader ZK ecosystem, the lesson is concrete: under-constrained circuits in production represent an existential risk class. The mathematical complexity of zero-knowledge proof systems may exceed what manual auditing can reliably catch. Whether AI-assisted security review becomes standard practice — and whether it arrives before the next four-year bug is exploited rather than discovered — will shape the reliability of ZK infrastructure across the industry.