Zcash has completed a two-phase emergency network upgrade to fix a critical vulnerability in its Orchard shielded pool — a flaw that sat undetected for four years, could theoretically have allowed unlimited undetectable counterfeit ZEC creation, and triggered a 50% price collapse before the network’s swift response began restoring confidence and driving a recovery in ZEC’s price.
Josh Swihart, CEO of Electric Coin Company — the primary developer of Zcash — posted on X on June 7 confirming the fix was complete and the network secure, as ZEC began its recovery from the lows reached after the vulnerability’s disclosure.
The post arrived at a critical moment for the asset: ZEC had crashed approximately 50% from a June 4 peak of $624 to $309 on June 5, wiping more than $3 billion from its market capitalization, per the BitMEX Blog’s documented timeline of the incident.
How The Zcash Bug Was Found — And What It Was
The vulnerability was discovered on May 29, 2026 by security researcher Taylor Hornby during a protocol audit commissioned by Shielded Labs. Hornby identified a “soundness” flaw in Zcash’s Orchard zero-knowledge proof circuit — specifically an under-constrained element in the Orchard Action circuit that could allow invalid state transitions, creating a theoretical double-spending risk within the shielded pool.
The discovery was made using Anthropic’s Claude Opus 4.8 AI model alongside a custom analysis suite, per Shielded Labs’ official disclosure. Hornby and the AI developed a working proof-of-concept that successfully generated unlimited, completely undetectable counterfeit ZEC in a local test environment — described by one independent analyst as “about the worst kind of bug a cryptocurrency can have,” per Yahoo Finance’s reporting of the disclosure.
Critically, the flaw did not permit inflation of the total ZEC supply on the live network. Zcash’s internal turnstile accounting mechanism — which tracks the total value moving into and out of the shielded pool — confirmed no unauthorized value creation occurred while the flaw was active, per Shielded Labs’ official statement.
However, the organization acknowledged directly that due to the privacy properties of Orchard and the nature of the bug, there is no definitive cryptographic way to determine whether exploitation occurred — a limitation inherent to the shielded pool’s design that became its own source of market concern. The vulnerability had been present since Orchard’s activation in May 2022 — four years — without detection.
The Emergency Response
Zcash’s development ecosystem responded with unusual speed. The first phase was an emergency soft fork deployed through Zebra 4.5.3, activated at block 3,363,426 on June 2, which temporarily disabled all Orchard transactions to remove the attack path while developers prepared the permanent fix.
Transparent and Sapling transactions continued operating normally throughout, per the Zcash Foundation’s official announcement on X. The second phase arrived on June 3 through the NU6.2 hard fork — activated at block 3,364,600 via Zebra 5.0.0 — which introduced a corrected circuit and a new verifying key, patching the flaw and re-enabling Orchard transactions, per the Foundation.
The market’s initial reaction to the hard fork was positive. ZEC rose from $544 on June 2 to $603 on June 3, continuing to $624 on June 4 — its highest level since the rally began. Then Arthur Hayes publicly disclosed he had exited his entire ZEC position intraday on June 4 — the same day as the peak — citing five macro factors including higher energy prices and upcoming AI IPOs, per his X post covered in prior reporting. The combination of Hayes’ exit and lingering uncertainty about whether exploitation had occurred before the patch sent ZEC to $309 on June 5.
The Recovery And What It Means
Swihart’s June 7 X post — reassuring the community that total ZEC supply remained intact throughout and that the network had passed through the emergency without confirmed exploitation — appears to have been the catalyst for the recovery now underway. The swift two-phase response, combined with the Foundation’s transparent disclosure and Swihart’s direct communication, provided the confidence signal the market needed.
This development marks a pivotal and genuinely uncomfortable moment for Zcash’s long-term positioning in the nascent sector. A four-year-old vulnerability in the Orchard pool — the very component that defines ZEC’s core privacy value proposition — has been fixed cleanly and without confirmed exploitation.
But the structural irony that the privacy properties that make Zcash valuable also make it impossible to confirm the vulnerability was never used will remain a question mark the community will need to address as the recovery continues.
As of this writing, ZEC trades at around $430, recovering from its June 5 lows as confidence in the network’s security response gradually rebuilds.
Cover image from Grok, ZECUSD Chart from Tradingview
