Zcash Orchard Pool vulnerability
June 5, Zcash founder Zooko Wilcox disclosed a critical forgery vulnerability in the Orchard Pool, allowing infinite undetectable ZEC generation. The flaw, discovered by Taylor Hornby on May 29 using Anthropic Opus 4.8, was patched on June 2. ZEC dropped 31% in 24 hours to $410.5.
Ripple CTO Emeritus Breaks Silence On Zcash Crisis Ripple CTO emeritus David Schwartz (@JoelKatz) says Zcash $ZEC user funds remain safe if the recently disclosed vulnerability was never exploited. According to Schwartz, coins left in older pools would remain accessible to their owners. "If there was no exploit, everyone is safe whether they move their coins or not," Schwartz said. "They'll eventually be a bit lonely in the deprecated pool, but they'll still be safe and accessible." His comments come as the crypto community debates the implications of a critical Orchard pool bug.
NEW: Ripple CTO @JoelKatz says Zcash users may remain safe if the recently disclosed vulnerability was never exploited. Commenting on the critical Orchard pool bug, Schwartz said ZEC funds left in older pools should still remain accessible to their owners. “If there was no exploit, everyone is safe whether they move their coins or not,” he said.
I tend to agree that probability that the Z-CASH pool was compromised is tiny BUT there is a small chance and we may only know this after the move from Orchard to the new Ironwood pool. There is one more hurdle.
ZEC dumps 38% in a day. This man out here doing free work while privacy coin holders pray he doesn’t find anything on XMR. 2026 security meta: assume everything is broken until proven otherwise 😂 Who still holding privacy coins?Security chad Taylor Hornby finds critical Zcash vuln (could’ve printed infinite ZEC), fixes it, then immediately adds Monero to his audit list.
One of the 6 people on the Zcash Foundation board got “assigned” to poke around with AI auditing stuff. Bro “discovered” a 4yo exploit using the most basic prompting you can imagine, then “quickly” dropped the news (without actually using it, supposedly) and now they suddenly need a whole brand new shielded pool. The only way this upcoming Ironwood pool can even pretend to “verify” the $ZEC supply is by forcing 100% of the coins currently in Orchard through a turnstile. Anything over 100% is straight-up proof the bug got exploited. And guess what that new pool is still months away from launching. If you’re a rational holder, you’d be moving your coins out right now to stay safe. But here’s the insane part: even with the obvious upside to migrating, ONLY about 5% of the Orchard pool has actually left. And despite the very real inflation risk staring everyone in the face, $ZEC has only dropped 25% in value. None of this adds up. At all. Yet the usual zcash nazis squad is already out here calling the whole thing “transparent.” Sure, faggots. Totally normal.
On June 3rd a bug was discovered in Zcash's Orchard shielded pool — raising fears it could allow unauthorized ZEC to be minted beyond the 21 million supply cap. The market panicked and $ZEC crashed. It has since recovered above $400 and a reclaim of $488 opens the door to $572. The response was fast and decisive. The bug was fully patched in under 48 hours via the NU6.2 hard fork. The turnstile mechanism confirmed 100% supply integrity — the cap was never exceeded and no unauthorized coins were minted. The Ironwood proposal launched June 6, introducing a new shielded pool and a public turnstile mechanism, meaning anyone can now independently verify the entire ZEC supply is clean and untampered. Security is accelerating beyond the patch. Formal verification of the Orchard circuit is underway. Shielded Labs just brought on a new Head of Security and cryptographer hires. NU7 roadmap — ZSA and 3x faster shielded transactions — remains fully on track for late 2026. Privacy just survived its toughest real-world test and the protocol responded faster and stronger than most layer 1s ever have. $488 reclaim is the trigger. $572 is the target. $ZEC