Audit finds Zcash Orchard flaw; ZEC plunges 30%

An audit using Opus 4.8 identified a counterfeiting vulnerability in Zcash’s Orchard shielded pool. Engineers deployed an emergency patch on June 2 and Shielded Labs shipped an upgrade to close the flaw. The token ZEC dropped more than 30% to an intraday low of $385.80 during early Asian trading, its lowest level since early May.

Taylor Hornby discovered the issue on May 29, 2026 while running a custom auditing agent framework together with the Opus 4.8 model, Zooko Wilcox, Zcash’s founder, posted on X. Developers implemented a fix over the following days and Shielded Labs released the emergency update to address the vulnerability.

Shielded Labs reported that the bug had been present in Orchard since the pool launched in May 2022. The team wrote that exploitation before the patch appears unlikely but cannot be proven cryptographically. In the post Shielded Labs said: “What makes this particularly challenging is that, due to the privacy properties of Orchard and the nature of the bug, there is no definitive way to determine using only cryptography whether such exploitation occurred before the vulnerability was discovered and fixed. We believe it is important to be transparent about that uncertainty.”

Orchard is a shielded pool designed to protect transaction privacy. The same privacy properties that hide sender, recipient and amounts also make it difficult to audit whether extra coins were created and spent. Shielded Labs said it is examining a network upgrade that would enable public verification of the ZEC supply while preserving privacy.

The proposed change would add a new shielded pool and enforce turnstile accounting on coins leaving Orchard so that issuance and movement can be audited without exposing private transaction details. Shielded Labs intends to publish a detailed upgrade proposal next week. Any change that affects consensus or how supply is verified must pass Zcash’s governance process before implementation, the team said.

Market participants reacted to the disclosure and the subsequent uncertainty. The price drop erased gains from an initial post-patch bounce and occurred during early Asian trading. Investor Arthur Hayes wrote on X that he sold his entire ZEC position, adding, “I had to dump our entire $ZEC bag” and that fresh minting “cannot be formally cryptographically proved impossible.” Independent commentator Udi Wertheimer referenced an earlier incident in which a similar bug had been in the wild for more than a year and said that past disclosures had sharply depressed the token’s value for an extended period.

Shielded Labs reiterated that it believes exploitation before the patch is unlikely and said further technical work on a supply-proof mechanism will be presented for community review. The team noted any technical path chosen will need to align with Zcash’s privacy goals and move through the network’s governance procedures before being enacted.