Zcash fell about 30% to $400 in the last 24 hours after Shielded Labs disclosed a critical flaw in the network’s Orchard privacy pool that could have let an attacker mint unlimited counterfeit ZEC without detection. The bug was fixed on June 1, but the company says it still cannot determine whether anyone exploited it before the patch.
The disclosure landed late Thursday and immediately put supply integrity at the center of the conversation around zcash. Taylor Hornby, who was hired in April 2026 to hunt for protocol weaknesses before malicious actors could find them, discovered the bug on May 29 after a tightly focused review of the Orchard circuit. Using Anthropic’s recently released Opus 4.8 model, Hornby built a full exploit that produced unlimited, undetectable counterfeit ZEC in a local testing environment.
Shielded Labs said the same tool would have generated unlimited counterfeit tokens in Hornby’s mainnet wallet if it had been run on Zcash mainnet. Hornby disclosed the flaw immediately to the Zcash Open Development Lab, which coordinated the emergency fix on June 1. The lab also said the issue had likely been sitting in Orchard since May 2022, when the privacy pool was activated, meaning the weakness may have gone unnoticed for four years.
That is what makes the disclosure so hard to resolve cleanly. Shielded Labs said there is no definitive way to determine, using cryptography alone, whether the vulnerability was exploited before it was repaired. In its own words, the company said that because of Orchard’s privacy design and the nature of the bug, it cannot know for certain whether abuse happened, while adding: “We think he probably succeeded.”
The gap leaves ZEC holders with a problem that cannot be audited away after the fact. Shielded Labs has proposed a network upgrade that would let anyone independently verify the integrity of the ZEC supply by deploying a new shielded pool and enforcing turnstile accounting on all coins from the Orchard pool. Whether that proposal is adopted will now shape how quickly confidence can be rebuilt after one of the sharpest security scares Zcash has faced.
