Zcash Orchard pool exposed a serious counterfeit vulnerability: it can infinitely mint ZEC and cannot be detected, with an emergency fix completed on June 1.

Deep Tide TechFlow News, June 5th, according to Zcash co-founder Zooko's announcement, on May 29, 2026, security researcher Taylor Hornby used Anthropic's latest AI model Opus 4.8 to discover a serious counterfeit vulnerability in Zcash's Orchard pool circuit. This vulnerability stems from insufficient elliptic curve multiplication constraints and can be exploited to infinitely and undetectably mint ZEC out of thin air, lurking for over 4 years since Orchard's activation in May 2022. ZODL (Zcash Open Development Laboratory) quickly coordinated with various ecosystem parties upon learning of the issue, completing an emergency fix on June 1st.

Due to Orchard's privacy features, it is currently impossible to cryptographically prove whether the vulnerability was exploited before the fix, but Shielded Labs assesses that the likelihood of prior malicious exploitation is low. Subsequently, Shielded Labs plans to introduce a network upgrade scheme that will enforce transfer gate audits of all Orchard pool tokens to publicly verify the integrity of ZEC supply.