A Zcash Orchard vulnerability buried inside Zcash’s Orchard privacy pool could have allowed an attacker to mint unlimited counterfeit ZEC tokens without detection, according to nonprofit developer Shielded Labs. The disclosure sent ZEC tumbling roughly 30% to around $400 and quickly raised fresh questions about cryptocurrency supply integrity in one of crypto’s most privacy-focused networks.
The bug had apparently sat inside the Orchard privacy pool since its activation in May 2022. However, it was not uncovered during a routine audit or internal review. Instead, security engineer Taylor Hornby found the Zcash Orchard vulnerability on May 29, 2026, while working with Anthropic’s newly released Opus 4.8 AI model in a deliberate search for protocol-level flaws before attackers could find them first.
That matters because Hornby was brought on by Shielded Labs in April 2026 for one purpose: to find the kinds of bugs malicious actors would want to exploit. In this case, he did.
Summary
What the Zcash Orchard vulnerability could have done
The flaw sat inside the Orchard circuit, the cryptographic engine behind Zcash’s most advanced privacy pool. According to Shielded Labs, Hornby not only identified the vulnerability but also wrote a complete exploit. When tested locally, the exploit successfully generated unlimited, undetectable counterfeit ZEC tokens. If it had been run on Zcash’s main network, those tokens would have appeared in his mainnet wallet with no trace.
Shielded Labs compared the problem to someone secretly accessing a central bank’s printing press, except without any way for the central bank to see the extra money being printed. That is the level of invisibility the bug appears to have offered.
Just as important, the vulnerability had been in place since Orchard’s launch in May 2022. In other words, it remained undetected for approximately four years, despite multiple rounds of review by experienced cryptographers. It took a targeted AI-assisted analysis to finally surface it.
How Shielded Labs and Zcash responded
Once Hornby identified the flaw on May 29, he immediately escalated it to the Zcash Open Development Lab, or ZODL. The response moved quickly. By June 1, an emergency fix had been deployed and coordinated, closing the window within days of discovery.
That timeline is unusually fast. From identification to patched deployment in three days, the Zcash response suggests the disclosure was treated as urgent from the start. Shielded Labs also said the short gap between discovery and patching left very little room for exploitation, which helped frame the risk for users and investors.
The role of AI is also notable here. Hornby used Anthropic’s Opus 4.8 model to conduct a tightly focused review of the Orchard circuit. In practice, that kind of AI-assisted security analysis is becoming more common in cryptographic auditing. Still, this case shows it can expose vulnerabilities that years of human review missed.
Why the Zcash Orchard vulnerability shook the market
The market reaction was immediate. ZEC fell roughly 30% to around $400 after the disclosure, with selling pressure building as the details became public. More broadly, the drop reflected investor discomfort with the possibility that a supply flaw may have existed quietly for four years inside a network users assumed was trustworthy.
The most difficult part of Shielded Labs’ disclosure was not the bug itself. It was the admission that followed:
“Due to the privacy properties of Orchard and the nature of the bug, there is no definitive way to determine using only cryptography whether such exploitation occurred before the vulnerability was discovered and fixed.”
That statement changes the story. The same privacy design that makes Zcash attractive to many users also makes it impossible to prove the network was never exploited. Shielded Labs was direct about that limitation. However, transparency does not remove uncertainty, and the market priced in that uncertainty immediately.
The organization did offer reasons to think exploitation was unlikely. The bug had evaded years of expert scrutiny and was only found through deliberate AI-assisted research. Meanwhile, the window between discovery and the patch was brief. The level of sophistication required was also high. “We think he probably succeeded,” Shielded Labs said of Hornby’s effort to reach the bug before any bad actor could.
Still, the group was careful not to treat that view as proof.
Why supply integrity matters for ZEC
For a privacy-focused cryptocurrency, supply integrity is foundational. Unlike transparent blockchains, where token issuance can be publicly audited, Zcash’s shielded pools are designed to hide transaction details. That feature is central to the network’s appeal. However, it also creates a liability when the question becomes whether undiscovered inflation has occurred.
If a ZEC counterfeit bug of this kind had been exploited silently, the damage would go beyond price action. It would undermine the entire value proposition of the network. No one could know the true circulating supply, and that uncertainty would weaken trust in ZEC as a store of value.
That is the bigger significance here, and it reaches beyond Zcash. The episode also raises hard questions about the long-term security guarantees of shielded cryptographic pools across the wider industry.
What Shielded Labs plans next
Shielded Labs is not stopping at the emergency patch. The organization has proposed a full network upgrade that would let anyone independently verify ZEC’s supply integrity, addressing the cryptographic blind spot the disclosure exposed.
The plan includes deploying a new shielded pool and applying turnstile accounting to all coins coming out of the existing Orchard pool. The turnstile mechanism would add a verifiable accounting layer, making it mathematically harder to hide inflated supply in the future. A detailed technical post on the proposal was expected the following week.
Meanwhile, Shielded Labs said it is accelerating its security work in several ways:
- continued engagement with Taylor Hornby on ongoing vulnerability research
- a formal verification project aimed at producing a mathematical proof that no undiscovered bugs exist in the Orchard circuit
- new hires for a Head of Security and a dedicated Cryptographer
Those steps are more than reactive. Together, they point to a structural shift in how Shielded Labs approaches cryptographic security, shaped in part by the fact that traditional audit methods did not catch what a focused, AI-assisted engineer found in weeks.
If the proposed network upgrade is deployed, Zcash would move from a system where supply integrity is assumed to one where it can be independently verified. For a privacy coin trying to rebuild confidence after a four-year silent vulnerability, that may be the most important commitment on the table.
FAQ
What is the nature of the critical bug found in Zcash’s Orchard privacy pool?
The bug was a flaw in the Orchard circuit, the cryptographic system behind Zcash’s most advanced privacy pool. It could have allowed an attacker to generate unlimited counterfeit ZEC tokens that would have been undetectable, even cryptographically.
When was the Zcash Orchard vulnerability discovered and patched?
The vulnerability was discovered on May 29, 2026, and an emergency fix was deployed by June 1, 2026. According to Shielded Labs, the bug had been present since Orchard’s activation in May 2022, meaning it existed undetected for approximately four years.
Who discovered the vulnerability and what tools were used?
Security engineer Taylor Hornby, working with Shielded Labs, discovered the bug. He used Anthropic’s Opus 4.8 AI model to carry out a targeted review of the Orchard circuit.
Can it be confirmed if the bug was exploited before the patch?
No. Because of Orchard’s privacy design, Shielded Labs says there is no cryptographic way to definitively determine whether the vulnerability was exploited before it was discovered and fixed. The group believes exploitation was unlikely, but it says users should not rely solely on that assessment.
What actions is Shielded Labs taking to restore supply integrity and security?
Shielded Labs has proposed a network upgrade that would add a new shielded pool and use turnstile accounting to verify ZEC supply integrity. It is also pursuing formal verification for the Orchard circuit and plans to hire a Head of Security and a Cryptographer.
