Zcash’s Invisible Money Problem: The Orchard Bug

A flaw that could mint invisible money

On May 29, 2026, independent security researcher Taylor Hornby discovered a critical counterfeiting vulnerability in Zcash's Orchard shielded pool — the private corner of the network where transaction amounts and recipients are hidden by design. According to Shielded Labs, the organization that had engaged him a month earlier precisely so that someone would go looking for flaws like this before attackers did, Hornby was running a highly targeted review of the Orchard circuit with the help of Anthropic's Opus 4.8 model, released the day before, when he found the bug and disclosed it to Zcash Open Development Lab engineers that same evening.^[1]

The technical cause was deceptively small. Shielded Labs reports that an under-constrained element of the Orchard circuit made it possible to feed arbitrary false inputs into an elliptic curve multiplication and still have the multiplication check pass. A zero-knowledge circuit works like an exam every transaction must pass before the network accepts it; an under-constrained question is one that is too easy, letting a dishonest answer slip through with correct-looking work shown. The network was not checking the wrong math — it was failing to fully pin down what the math was allowed to be about.^[1]

To prove the danger was real, Hornby built a complete exploit. Shielded Labs reports that in a local regtest environment — a private sandbox, not the live network — the tool generated unlimited, undetectable counterfeit ZEC. The disclosed demonstration took place in that test environment; it does not establish that counterfeiting occurred on mainnet. Its significance was clear: this was not a theoretical wobble in a proof, it was a working mint for money that leaves no visible trace, sitting inside a pool that had been live since May 2022.^[1]

According to Shielded Labs, the vulnerability had been present since Orchard’s activation in May 2022, roughly four years before the emergency response in early June 2026. The organization reported that it had escaped years of expert scrutiny. The same privacy that hid legitimate transaction details also limited what the public transaction record could reveal about possible misuse.^[1]

Stopping Orchard, then repairing it

The response began the evening of Friday, May 29, when Hornby responsibly disclosed the issue to ZODL core engineers. The Zcash Foundation reports that within hours, engineers Daira-Emma Hopwood, Kris Nuttycombe, and Jack Grigg confirmed the issue and began evaluating remediation options, while keeping details of the flaw private to reduce the risk of exploitation before a fix was ready.^[3]

Private coordination with miners and exchanges began on the evening of Sunday, May 31. A first soft-fork activation attempt ran into coordination problems during patch deployment, so ZODL engineers quickly produced a second patch targeting block height 3,363,426, which successfully activated at approximately 02:00 UTC on June 2. This soft fork worked like an emergency stop: nodes began temporarily rejecting every transaction and block containing Orchard actions, freezing the pool while the real repair was finished.^[3]

The repair itself could not be a quiet patch. The Foundation explains that a direct patch would have revealed too much about the flaw to anyone reading the updated code, and that fixing a zero-knowledge proof circuit bug requires updating the pinned verifying key — a consensus change no ordinary software update can make. So the fix arrived as NU6.2, a hard-fork network upgrade that activated on Wednesday, June 3 at 00:05 EDT at block height 3,364,600, re-enabling Orchard with the corrected circuit. It was only the second security-driven protocol upgrade in Zcash history since the network launched in 2016.^[3]

Then came the reassuring half of the report. The Foundation states that the vulnerability was caught before any known exploitation, that no evidence of unauthorized value creation has been found, and that Zcash's turnstile mechanism confirmed the total ZEC supply remained intact throughout the incident. User privacy was not affected, and the older Sapling and transparent pools kept operating normally the whole time.^[3]

Counting the doors, not the rooms

The episode turned on a question every private currency must face: how can users verify a supply when they cannot inspect individual balances? Zcash tracks the amounts entering and leaving its shielded pools. Think of a windowless vault with a counter at the door: the counter records net deposits and limits total withdrawals. It does not inspect every note being passed between people inside. The Foundation credited this boundary accounting, called a turnstile, with preventing withdrawals from exceeding the value recorded for a pool.^[3][5]

But the June 2026 incident exposed the limit of that design. The turnstile limits what can leave the room; it cannot by itself rule out counterfeit balances circulating inside it. Counterfeit ZEC created inside a shielded pool could circulate inside that pool invisibly, and Shielded Labs was unusually direct about the consequence: because of Orchard's privacy properties, there is no definitive way, using cryptography alone, to determine whether the vulnerability was ever exploited before it was fixed. Asked the question point-blank two weeks later — was the vulnerability ever exploited? — the organization's answer was one word: unknown.^[1][2]

Shielded Labs does offer a risk assessment, and it deserves to be quoted as an assessment rather than a finding: the organization believes prior exploitation seems unlikely, because the flaw survived years of expert scrutiny, its discovery was the product of a deliberate white-hat effort with custom AI tooling rather than an accident, the attack window was sharply narrowed by the fast remediation, and real-world crypto attackers tend to cash out quickly — which would push funds through the turnstile where they would show. But Shielded Labs adds the caveat that matters most: users should not have to rely on its assessment, or anyone else's.^[1][2]

Sealing the vault

The fix for unverifiability was architectural. Shielded Labs proposed, and the ecosystem built, Ironwood: a new shielded pool using the corrected Orchard circuit, while the original Orchard pool is permanently sealed. With Ironwood activated, no new value can enter the old pool and funds can no longer circulate within it; the only way out is through the existing turnstile, which never lets more ZEC exit than legitimately entered.^[6][2]

Sealing Orchard addresses the supply question without solving the historical mystery. Any value remaining inside can no longer circulate there; withdrawals remain capped by the pool’s publicly recorded balance. This is an aggregate limit, not a machine that identifies which individual coins are genuine. Shielded Labs explains that users can consequently verify the circulating-supply bound with their own nodes without first deciding whether the old vulnerability was exploited. Its separate assessment that legitimate Orchard funds are recoverable still depends on its view that prior exploitation was unlikely.^[2][6]

The engineering was formalized in ZIP 258, created on June 19, 2026, which fixed NU6.3's mainnet activation height at 3,428,143 and wrote the seal into consensus rules: from activation, the Orchard pool can only be spent from, cross-address transfers within it are disabled, no new value may enter, and the ZIP 209 pool-balance accounting gains an Ironwood balance alongside the existing pools. Zcash's official upgrade record confirms Ironwood activated on mainnet on July 28, 2026, at exactly that block height.^[5][4]

Verification without surveillance

Ironwood’s official activation record describes a new shielded pool intended to make the integrity of the circulating supply independently verifiable. The response preserved the purpose of private transactions while restricting the old pool’s ability to circulate value. In the vault analogy, the repair changed the rules at the door rather than asking every holder to display their balance.^[4][6]

As of September 9, 2026, the sources reviewed here do not establish that the Orchard vulnerability was exploited. Shielded Labs says the old shielded record cannot, by cryptography alone, settle that question. Ironwood changes what users need to know: enforcing a bound on circulating supply does not require a verdict on every transaction that may have occurred before the repair.^[2][4][6]

That distinction leaves a more useful ending than either panic or reassurance. The developer’s assessment of the past and the protocol’s verifiable restrictions are different kinds of evidence. Zcash’s response was to build a supply constraint users could check, while leaving the uncertainty about past exploitation visible.^[2][6]