BlockBeats News, June 5th, Zcash founder Zooko Wilcox revealed in a post that the Zcash Orchard Pool had a serious counterfeiting vulnerability that could be exploited to create an unlimited and undetectable amount of counterfeit ZEC within the Orchard Pool. The vulnerability was discovered by security researcher Taylor Hornby on May 29th through a targeted audit using the Anthropic Opus 4.8 model and was disclosed to the Zcash Open Development Lab (ZODL). ZODL then coordinated an emergency response with the Zcash ecosystem, and the related fix was implemented on June 2nd.
Taylor Hornby wrote a complete exploit tool using Opus 4.8 in a local regtest environment, which could generate an unlimited and undetectable amount of counterfeit ZEC during testing. If this tool were to run on the Zcash mainnet, it could potentially generate an unlimited and undetectable amount of counterfeit ZEC in mainnet Zcash wallets. The vulnerability is related to a insufficient constraint in an element of the Orchard circuit, allowing an attacker to feed arbitrary false inputs to elliptic curve multiplication and still pass the multiplication check. This vulnerability has been present since Orchard activated in May 2022 until an emergency fix was deployed on June 1, 2026.
Due to the privacy nature of Orchard and the exploitative potential of the vulnerability prior to the fix, it is currently impossible to determine solely through cryptographic means whether the vulnerability was exploited before the patch. However, Shielded Labs believes the likelihood of prior exploitation is low and is exploring deploying a new privacy pool through a network upgrade, conducting a reconciliation of all tokens in the Orchard Pool to allow anyone to verify the integrity of Zcash's supply and prove the absence of counterfeit ZEC in the Orchard Pool.
Impacted by the Orchard Pool vulnerability, according to HTX market data, ZEC plunged over 31% in the past 24 hours, currently trading at $410.5.
