The Zcash (ZEC) cryptocurrency plunged ~40%, wiping out $3 billion in market value, after a researcher using Anthropic's Claude AI discovered a critical counterfeiting bug in its Orchard privacy pool. The flaw, present since 2022, could have allowed unlimited fake ZEC creation. Developers quickly patched the bug and have now proposed the "Ironwood" network upgrade to restore trust by allowing users to independently verify the coin's supply.
Zcash Orchard counterfeiting vulnerability
- ▪The Zcash Foundation and Shielded Labs stated there is no evidence of unauthorized value creation or that the total ZEC supply was affected
- ▪The vulnerability may have existed since the Orchard pool was launched in May 2022, going undetected for nearly four years
- ▪Due to Zcash's privacy design, it is impossible to cryptographically prove whether the bug was exploited before it was patched
- ▪A critical "soundness" vulnerability was discovered in Zcash's Orchard shielded pool, which could have allowed an attacker to create unlimited, undetectable counterfeit ZEC
Claude AI security audit
- ▪Security researcher Taylor Hornby discovered the flaw on May 29, 2026, during an audit commissioned by Shielded Labs
- ▪Hornby used Anthropic's Claude Opus 4.8 AI model to help find the bug, which had been missed by previous human expert reviews
ZEC price crash
- ▪Prominent investor Arthur Hayes sold his entire ZEC position after the disclosure, stating that privacy assets require "perfection."
- ▪After the crash, ZEC's price bounced about 45% from its low as developers proposed the Ironwood upgrade
- ▪Following the disclosure, the price of Zcash (ZEC) fell by approximately 40%, erasing more than $3 billion from its market capitalization
Emergency patch deployment
- ▪The NU6.2 upgrade re-enabled the Orchard pool with a corrected circuit and a new verifying key, while Sapling and transparent pools remained operational
- ▪Developers deployed an emergency soft fork on June 2, 2026, followed by a permanent hard fork (NU6.2) on June 3 to fix the vulnerability
Turnstile accounting proposal
- ▪Developers proposed a network upgrade called "Ironwood" to create a new, secure shielded pool and restore users' ability to independently verify the ZEC supply
- ▪The Ironwood plan uses a "turnstile" mechanism to audit funds moving from the old Orchard pool, which would block or destroy any counterfeit ZEC
- ▪Zcash co-founder Zooko Wilcox confirmed that without the Ironwood upgrade, users cannot independently verify the integrity of the ZEC supply
Privacy coin audit challenges
- ▪The incident highlights the difficulty of auditing complex zero-knowledge proof systems and suggests AI-assisted tools are becoming necessary for security
- ▪Due to Zcash's privacy design, it is impossible to cryptographically prove whether the bug was exploited before it was patched
Story comments
Loading comments…