Zcash<\/b> (the token is known as ZEC) is facing a massive wave of skepticism after the development community published details about a critical vulnerability in <\/span>Orchard<\/b>, the network\u2019s latest shielded pool. ZEC <\/span>plunged over 50%<\/b> at one point following this information, before recovering to $367.35 on June 6.<\/span><\/p>\n The vulnerability was discovered on May 29 by security researcher <\/span>Taylor Hornby<\/b> and was fixed through an emergency upgrade a few days later. Zcash Open Development Lab (ZODL) stated that there is no evidence that the bug was ever exploited or that unauthorized ZEC was created. However, this bug could allow counterfeit ZEC to be created within Orchard, while the private design of this pool makes it difficult to definitively prove that it was never exploited.<\/span><\/p>\n The vulnerability was discovered on May 29 in Orchard, where transactions are verified using zero-knowledge proofs to maintain user privacy. According to the <\/span>Zcash Open Development Lab<\/span><\/a>, security researcher Taylor Hornby discovered the bug during an audit commissioned by Shielded Labs and reported it to the ZODL engineering team shortly thereafter.<\/span>\u00a0<\/span><\/a><\/p>\n The issue lies within Orchard\u2019s transaction verification mechanism. If exploited, this vulnerability could cause the system to accept invalid transactions within Orchard. ZODL confirmed the report within hours and began preparing a mitigation plan with network operators.\u00a0<\/span><\/p>\n Due to the bug involving consensus rules, Zcash had to handle it via a network upgrade rather than a standard wallet or node update. ZODL first paused Orchard-related activities through a soft fork to limit risks, then deployed a hard fork to update the fixed circuit and restore Orchard.<\/span><\/p>\n Main Timeline:\u00a0<\/span><\/p>\n The critical point of the Orchard bug lies in <\/span>soundness<\/b>\u2014the ability to guarantee that the system only accepts valid proofs and states. When this guarantee is broken, a proof can be accepted even if the state behind it does not comply with the protocol\u2019s rules.\u00a0<\/span><\/p>\n According to an article by Zooko Wilcox, Jason McGee, and Taylor Hornby, Hornby successfully created a full exploit in a local test environment. In that environment, the exploit could create counterfeit ZEC within Orchard without being detected.\u00a0<\/span><\/p>\nWhat Happened<\/b>\u00a0<\/span><\/h2>\n
\n
Why the Bug Mattered<\/b>\u00a0<\/span><\/h2>\n
\n
![\"ZEC](\"https:\/\/nftplazas.com\/wp-content\/uploads\/2026\/06\/Screenshot-2026-06-06-at-13.29.41.jpg\")