Zcash Plummets 40% After AI‑Assisted Audit Reveals Long‑Standing Orchard Bug

ZEC fell 40% after a security vulnerability was disclosed in its Orchard shielded transaction pool, a core component of the privacy‑focused cryptocurrency. The flaw has since been patched, but the team that originally built and understood the code left five months earlier.

What Happened

The vulnerability was identified by security researcher Taylor Hornby during an audit commissioned by the Zcash development team. Hornby used AI‑assisted tools, including Anthropic’s Claude Opus, to analyze the Orchard circuit.

The issue lay in the validation logic of the Orchard circuit, which governs shielded transactions. Developers said the flaw could have allowed invalid inputs to pass verification under specific conditions, potentially enabling the creation of unbacked ZEC within the shielded pool.

The vulnerability had been present since Orchard’s activation in May 2022, representing nearly four years of exposure. Because of the privacy properties of the shielded pool, developers cannot definitively determine whether the bug was exploited before discovery.

A patch was deployed immediately after disclosure, according to project maintainers.

The Team That Wasn’t There

The fix was deployed by the Zcash Foundation and Shielded Labs. In January 2026, Josh Swihart, CEO of the Electric Coin Company—the organization that created Zcash and built the Orchard protocol—resigned along with the entire ECC staff.

The departures followed a governance dispute with the Bootstrap Project board, with staff citing constructive discharge. The former team has since formed an independent entity focused on privacy technology but has not launched a competing chain.

Second Emergency in a Month

The disclosure follows another security incident earlier this year. In May 2026, the Zcash Foundation urgently released Zebra 4.4.0, addressing multiple security vulnerabilities in its Rust‑based node implementation.

Several issues were classified as consensus‑critical and could have led to network divergence or chain splits if exploited. Operators were advised to upgrade immediately.

The vulnerabilities affected core validation and networking logic in the node software, including areas that could cause inconsistencies between implementations of Zcash’s protocol.

What Comes Next

Shielded Labs has proposed a new Zcash network upgrade that would deploy a fresh shielded pool and route all coins leaving Orchard through turnstile accounting, allowing anyone to verify that no counterfeit ZEC exists. Like any major upgrade, it requires community support and governance approval before activation.

People Also Ask:

What is Zcash?

Zcash is a privacy‑focused cryptocurrency that uses zero‑knowledge proofs to enable shielded transactions where sender, receiver, and amount can be hidden.

What is the Orchard shielded pool?

Orchard is a core privacy layer in Zcash that processes shielded transactions using cryptographic circuits designed to validate transfers without revealing transaction details.

Why are consensus‑critical bugs important?

Consensus‑critical bugs can cause nodes in a blockchain network to disagree on valid transactions, potentially leading to chain splits or incorrect balances.

Source link