The Zcash Orchard exploit and what it means for privacy coins

For four years, a critical bug sat hidden at the heart of Zcash’s privacy system. In theory, it could have allowed anyone with the right knowledge to mint unlimited, completely untraceable ZEC. No one noticed – not the core developers, not external auditors, not even the cryptographers who designed the system. It only came to light when an AI-assisted audit dug into the code and found what humans had missed for years.

This incident isn’t just another crypto bug story. It forces some uncomfortable questions about privacy coins, supply integrity, and how AI is changing security audits.

What went wrong inside Zcash’s Orchard pool

Zcash’s strongest privacy comes from its shielded pools, and the most recent of these is called the Orchard Shielded Pool. Orchard uses zero-knowledge proofs to hide transaction details: amounts, senders, and recipients are all concealed while still being cryptographically valid.

Zero-knowledge systems rely on a core property called “soundness.” Soundness means you can’t create a valid proof for something that’s actually false – for example, you can’t prove you own coins you don’t really have. If soundness breaks, the whole system is at risk.

The Orchard bug lived in a Rust library called Halo 2 gadgets, specifically in the elliptic curve multiplication gadget used inside the proof circuit. The problem was that the circuit didn’t fully constrain its inputs. In simple terms, it was “under-constrained”: mathematically invalid values could slip through checks that were supposed to reject them.

Because of this, an attacker could, in principle, construct zero-knowledge proofs that looked valid to the network but were based on false statements. The result: they could mint unlimited counterfeit ZEC inside the Orchard shielded pool, and those fake coins would be indistinguishable from real ones on-chain.

Since Orchard transactions are fully private, the blockchain would show no obvious red flags. A fake coin would look exactly like a real one, and the attacker could potentially double-spend the same shielded ZEC over and over.

This flaw was present from the launch of the Orchard pool in May 2022 and remained live for roughly four years. It survived multiple audits by top-tier cryptographers – all because of two subtle lines of code.

How AI helped find a four-year-old flaw

The bug was finally uncovered by security researcher Taylor Hornby, who had been hired by Shielded Labs in April 2026 to proactively audit Zcash’s cryptographic infrastructure. But Hornby didn’t do it alone – he leaned heavily on an AI model, Anthropic’s Claude Opus 4.8.

Claude Opus 4.8 was released publicly on 28 May 2026. Hornby discovered the bug on 29 May, meaning the model helped find a four-year-old vulnerability within about 24 hours of going live.

Instead of simply pasting code into a chatbot and asking “what’s wrong?”, Hornby built a custom auditing framework, reportedly called “Zcash full stack auditor.” He crafted detailed prompts aimed specifically at hunting for constraint failures in zero-knowledge circuits – the kind of subtle issues that are notoriously hard for humans to spot.

The AI didn’t just point out the potential bug. It also helped Hornby write a full proof-of-concept exploit. When he ran this exploit in a local test environment, it successfully generated unlimited, undetectable counterfeit ZEC inside the shielded pool.

According to Shielded Labs, the exploit worked exactly as described, and they believe Hornby found the issue before any real attacker did. The key word, though, is “probably” – and that uncertainty is at the heart of the controversy.

How Zcash reacted and patched the bug

Once the vulnerability was confirmed, the Zcash ecosystem moved quickly. The response unfolded over a few intense days:

1–2 June: Developers deployed an emergency soft fork that temporarily disabled all Orchard transactions. This effectively closed the window for any new exploitation attempts while a permanent fix was prepared.

3 June: The NU6.2 hard fork activated with a corrected circuit. A hard fork was necessary because even a tiny change to a zero-knowledge circuit (like fixing two lines of code) changes its cryptographic verifying key, so every node needed to upgrade to stay in sync.

The transition wasn’t perfectly smooth. Many block explorers suffered synchronization issues for over four hours, briefly giving the impression that the network had halted. In reality, the Zcash mainnet continued producing blocks, but Orchard transactions remained suspended for about 24 hours during the full remediation window.

After the patch, the official line was that there was no evidence of exploitation. However, due to the very nature of Zcash’s privacy, that statement comes with a massive asterisk.

The privacy coin paradox: you can’t see what you need to prove

Here’s the core problem: Orchard is fully private. It hides all amounts and participants from everyone, including the developers and auditors. That’s great for user privacy, but it makes it impossible to cryptographically prove that no counterfeit ZEC was ever created.

If someone had exploited the bug three years ago, minted a million fake ZEC, and simply left it sitting in the shielded pool, there would be no visible trace. No abnormal balances, no obvious on-chain anomalies – just a black box of shielded value.

The Zcash Foundation has openly admitted this limitation. They simply cannot prove that the bug was never used. At best, they can say they haven’t seen any evidence of exploitation, which is not the same as proving it didn’t happen.

This is the privacy coin paradox in a single sentence: the same feature that hides your transactions also makes total supply integrity unverifiable.

Turnstiles, hidden reserves, and why uncertainty remains

Zcash developers do have one line of defense: a mechanism known as a “turnstile.” This tracks value as it moves between different pools (for example, from shielded to transparent addresses). If someone tried to cash out a huge stash of counterfeit ZEC to a transparent address or an exchange, the turnstile could, in theory, detect a surplus of coins leaving the pool compared to what went in.

However, this defense only works if the attacker actually moves their fake coins out. If they simply keep a large, invisible reserve inside the shielded pool and never cross the turnstile, there’s nothing to detect. The system can’t see inside the pool; it can only watch what goes in and out.

So the current “probably fine” verdict rests on a behavioral assumption: that any attacker sophisticated enough to find and exploit the bug would also be impatient enough to cash out during the huge bull run, rather than quietly sitting on the stash for years.

It’s a reasonable assumption to some, but it’s not a proof. And that gap between “probably” and “provably” is exactly what has shaken confidence in Zcash and privacy coins more broadly. For a deeper look at how this uncertainty hit the wider market, you may want to read our breakdown of the Zcash bug, the mega crash, and why some investors rotated back into Bitcoin.

The market’s brutal reaction

Once the full details of the vulnerability became public around 5 June, the market response was swift and severe.

Before disclosure, ZEC was trading in the $620–$640 range. Within a day or two, it plunged to intraday lows between $255 and $310 – a drop of roughly 50–57%. Around $5 billion in market cap was wiped out.

Analysts noted that this wasn’t just a leveraged wipeout driven by derivatives. The selling was largely spot-driven, suggesting real holders were capitulating, not just overleveraged traders getting liquidated. That said, liquidations were still heavy, with some trackers reporting nine-figure totals in a single 24-hour period.

Institutional holders were hit hard as well. Cypherpunk Technologies, a NASDAQ-listed ZEC treasury company backed by the Winklevoss twins, saw its stock drop about 37%, closing at $59. The firm held around 303,900 ZEC at an average cost of roughly $333 per coin, leaving them deeply underwater during the worst of the crash.

If you’re interested in how this exploit rippled out into the broader crypto market, including Bitcoin’s reaction, check out our coverage of Bitcoin dipping below $62k as the Zcash exploit spooked investors.

Exit vs. hold: how major players responded

The incident split prominent investors and commentators into two clear camps.

The exit camp: supply must be provable

On one side, some high-profile figures decided the risk wasn’t worth it. Arthur Hayes, co-founder of BitMEX, sold his entire ZEC position on the day the vulnerability was disclosed. He had previously described ZEC as part of his “holy trinity” of narratives, but after the bug, he declared that narrative effectively dead.

Hayes’ argument was simple: for a coin whose main selling point is “privacy from AI, governments, and big tech,” you need perfection, not just high probability. If you can’t cryptographically prove the total supply, then the “sound money” story breaks down.

His move was controversial. On-chain investigator ZachXBT accused Hayes of using his followers as exit liquidity, pointing out that he had exited four publicly hyped positions in about 15 days. Regardless of the drama, Hayes articulated a concern many investors quietly share: unverifiable supply is a deal-breaker for some.

The hold camp: a sign of maturity, not failure

On the other side, long-term ZEC backers doubled down. Cypherpunk Technologies and Cameron Winklevoss reaffirmed their support, arguing that the bug was discovered by a researcher the project itself hired, not by an attacker, and that it was patched within days. To them, this showed a mature, self-correcting ecosystem.

Grayscale’s legal chief added another point: if someone had been capable of exploiting this bug, the most rational move would have been to cash out during the 20x bull run, not to sit on the coins for years. From this perspective, the lack of any visible anomaly during the peak mania is indirect evidence that no one used the exploit.

Both sides have valid points, and that’s what makes this situation so uncomfortable. Zcash wasn’t “hacked” in the traditional sense – as far as we know, no fake ZEC was minted. But we can never be 100% sure, and that lingering doubt is exactly what undermines confidence in a supposedly trustless system.

Ironwood and the push for verifiable supply

To restore as much certainty as possible, Zcash developers have proposed an upgrade known as Ironwood, targeted for late July 2026. The key feature is a stricter turnstile accounting mechanism that will govern migration out of the old Orchard pool.

Under Ironwood, all coins moving from the old Orchard pool into the new system must pass through a publicly auditable checkpoint. This would finally allow the community to verify that no more value is leaving the old pool than was ever put into it.

However, it’s important to understand what Ironwood can and cannot do:

What it can do: Prove that no counterfeit coins are carried forward into the new pool. If the numbers reconcile cleanly at the turnstile, that’s the strongest signal we’ll ever get that the supply is honest going forward.

What it cannot do: Retroactively prove that no exploitation happened in the old pool. If fake coins were minted and then burned or left behind, they may never show up in the migration. The past will always remain partly unknowable.

In other words, Ironwood is about drawing a clean line under the incident and ensuring that, from that point on, supply integrity is auditable again – at least at the boundaries between pools.

AI audits and the future of privacy coin security

Beyond Zcash itself, this episode highlights a bigger shift: AI is now good enough to spot subtle cryptographic bugs that world-class human experts missed for years. That’s both reassuring and unsettling.

On the reassuring side, AI-assisted audits could dramatically raise the security bar across crypto. If one model, properly guided, can uncover a four-year-old inflation bug in one of the most heavily audited privacy systems, it’s likely that similar tools will become standard for protocol reviews.

On the unsettling side, it raises the question: what other long-standing bugs are hiding in “battle-tested” codebases? Reports suggest that Taylor Hornby may be exploring audits of other privacy coins, including Monero, though nothing has been formally announced yet. If similar flaws exist elsewhere, AI might be the tool that finally exposes them – for better or worse.

The real trade-off: perfect privacy vs. provable supply

At the end of the day, this incident forces every privacy coin holder to confront a hard truth: unverifiable supply is not a bug you can fully patch away; it’s a consequence of strong privacy by design.

If a system hides all transaction details from everyone, then by definition it also hides the information you’d need to prove that no extra coins were ever created. You can add turnstiles, audits, and migration checkpoints to reduce uncertainty, but you can’t eliminate it entirely without weakening privacy.

So the key questions become:

• Is Zcash’s rapid, transparent response a sign of a mature, self-correcting protocol that caught its own flaw before disaster – something to be bullish about?

• Or did this event expose a permanent, unfixable crack in the privacy coin thesis, where “perfect privacy” always comes at the cost of fully provable supply – something fundamentally bearish?

For some, the answer will be to step away from fully shielded systems and favor assets where supply can be audited directly on-chain. For others, the benefits of strong financial privacy will still outweigh the risks, especially if AI-driven audits and mechanisms like Ironwood can keep those risks tightly contained.

Either way, one thing is clear: in a world where AI can read code better than most humans, and where privacy can hide both users and bugs, the line between trustless and trusted systems is getting blurrier. As privacy tech evolves, so must our expectations about what “sound money” really means.