Zcash Orchard bug could fake coins, fix released June 2026

A vulnerability discovered by security researcher Taylor Hornby in Zcash's Orchard privacy pool allows for the potential creation of counterfeit ZEC (Zcash) coins. The flaw, identified using Claude Opus 4.8, was present from the launch of Orchard in May 2022 until an emergency fix was enacted on June 1, 2026. Due to the privacy nature of the system, it's undetermined if this vulnerability was exploited prior to its disclosure.

Although Zcash's team suggests previous exploitation is unlikely, the incident raises concerns about cryptographic systems potentially harboring undetected vulnerabilities. Shielded Labs is proposing a network upgrade to verify the integrity of Zcash's supply and eliminate any counterfeit coins.