Privacy token Zcash plunges after the disclosure of a 2022 vulnerability in its Orchard shielded pool that could have allowed undetectable ZEC counterfeiting

Zcash plunged double digits overnight after developers disclosed a critical vulnerability in the protocol's Orchard shielded pool …

Decrypt 2026-06-06 Akash Girimath

Discussion

NullTX Will Izuchukwu on x
Arthur Hayes Dumps Entire ZEC Position, Sends Zcash Crashing Over 43%
@zooko @zooko on x
The Orchard Counterfeiting Vulnerability — and next steps
@cryptohayes Arthur Hayes on x
The Holy Trinity is dead. Sadly due to the Orchard Pool exploit, I had to dump our entire $ZEC bag. - While I think it's extremely unlikely of any minting, it cannot be formally cryptographically proved impossible - The privacy from AI, govt, big tech narrative demands perfection
@craigsalm Craig Salm on x
From a non technical perspective, to believe this vulnerability was actually exploited before being patched, you'd have to believe someone (1) was looking at the Zcash codebase more thoroughly than any of the ECC, ZODL, Shielded Labs, Zcash Foundation and other core Zcash dev
@ja_akinyele J. Ayo Akinyele on x
Counterfeit Zcash bugs have been a concern around shielded pools for a long time, so I'm not surprised a missing-constraint bug in a ZK circuit went undetected for 4 years. The bigger takeaway is that AI models may be drastically changing the discoverability curve for
@elibensasson Eli Ben-Sasson on x
Very important update. There will be bugs in all software. The best hope is to have the very best teams find them first. Like this case. I strongly support Zcash.
@lopp Jameson Lopp on x
An unfortunate example of why I've long said not to expect Bitcoin to implement strong cryptographic privacy at the base layer. Doing so greatly increases risk of undetectable monetary supply inflation. Few folks value privacy more than supply integrity. https://x.com/...
@blknoiz06 @blknoiz06 on x
this is wild wow zcash found an exploit using opus 4.8 & patched it, unsure if it was abused before discovering it or not
@p3b7_ Charles Guillemet on x
👉For 4 years, 1 day, and 10 hours, anyone who understood the Orchard circuit could have minted ZEC out of thin air, silently, with no on-chain signature. The bug was disclosed this week. It was found by an AI-driven audit running Opus 4.8, not by an attacker. 1. Call the bug [ima…
@arjunkhemani Arjun Khemani on x
Zcash is strong and will get through this. The bug was found, disclosed, and fixed. There is no evidence it was exploited. It was discovered by a white-hat researcher whose job was to find vulnerabilities before attackers could. That's exactly how security should work. Over
@0xsammy @0xsammy on x
No wonder $ZEC nuked 25%, pretty wild to not know whether the token was mass printed Privacy becoming a bug not a feature TL;DR i) Bug found: May 29, 2026 by Taylor Hornby (AI-assisted audit - Opus 4.8 showing us what it's made of!) in Zcash's Orchard shielded pool ii) [image]
@0x_colt Colt on x
I've exited all DeFi positions for the foreseeable future. Zcash has some of the most talented developers in crypto, and they still missed a critical vulnerability that sat unnoticed for nearly four years until it was recently discovered with the help of Claude. If a team of

Chronicles

Privacy token Zcash plunges after the disclosure of a 2022 vulnerability in its Orchard shielded pool that could have allowed undetectable ZEC counterfeiting

Related Coverage

Discussion