Zcash disclosed an Orchard bug found May 29, 2026, that could have minted unlimited ZEC; a fix was completed by June 2.
Zcash revealed a critical Orchard pool bug found on May 29, 2026, that could have allowed unlimited, undetectable ZEC minting.
Shielded Labs said the flaw existed since May 2022, was patched by June 2, and may lead to a network upgrade to verify the integrity of the Zcash supply after coordinated emergency response efforts worldwide.
Bug Found During Orchard Security Review
Shielded Labs said security researcher Taylor Hornby found the bug during a review of the Zcash Orchard circuit.
The work began after Shielded Labs hired Hornby in April 2026 for ongoing protocol security research.
According to the group, Hornby used AI-assisted audit methods and traditional review work. The post said he used Anthropic’s Opus 4.8 model during a targeted Orchard review.
CLAUDE OPUS 4.8 JUST BROKE A $9 BILLION PRIVACY COIN. 🚨
A security researcher used Anthropic’s new model to find a 4-year-old soundness bug in Zcash’s Orchard pool.
The flaw could create unlimited, undetectable counterfeit $ZEC.
Discovered May 29. Patched June 3.
Could have… pic.twitter.com/IRiB6PHNcc
— Crypto Rover (@cryptorover) June 5, 2026
The bug involved an under-constrained part of the Orchard circuit. Shielded Labs said this allowed false inputs in an elliptic curve multiplication check.
“The vulnerability was real and exploitable,” Shielded Labs said. It added that Hornby built a working exploit in a local test setting.
Unlimited ZEC Could Have Been Minted
The reported bug could have allowed an attacker to create unlimited ZEC inside Orchard.
Shielded Labs said the counterfeit coins would not be detected by normal cryptographic checks.
Orchard has strong privacy features, so the team cannot prove whether the bug was used before the fix. The group said it was being clear about that uncertainty.
The bug was active from Orchard’s launch in May 2022 until the emergency repair in June 2026. That placed the exposure period at more than four years.
Still, Shielded Labs said prior exploitation seemed unlikely. It said the issue had escaped years of review by skilled cryptographers and security experts.
Read Also:
Zcash Emergency Upgrade Fixes Critical Bug as ZEC Eyes $610 Breakout
Zcash Plans Supply Check Upgrade
Shielded Labs said it is working with Zcash developers on a network upgrade plan. The plan would aim to let users verify the Zcash supply.
The proposal includes creating a new shielded pool and using turnstile accounting for Orchard coins.
This process would seek to prove that no counterfeit ZEC remains in the Orchard pool.
https://t.co/v7BiOdzU9E
— zooko🛡🦓🦓🦓 ⓩ (@zooko) June 4, 2026
The group said more details will be shared in a later post. Any upgrade would need support from Zcash users and the normal governance process.
Shielded Labs also said it will expand security work. The group plans formal verification for the Orchard circuit and new hiring for security roles.