Zcash Reveals Orchard Bug That Could Have Minted Unlimited ZEC

Zcash disclosed an Orchard bug found May 29, 2026, that could have minted unlimited ZEC; a fix was completed by June 2.

Zcash revealed a critical Orchard pool bug found on May 29, 2026, that could have allowed unlimited, undetectable ZEC minting. 

Shielded Labs said the flaw existed since May 2022, was patched by June 2, and may lead to a network upgrade to verify the integrity of the Zcash supply after coordinated emergency response efforts worldwide.

Bug Found During Orchard Security Review

Shielded Labs said security researcher Taylor Hornby found the bug during a review of the Zcash Orchard circuit. 

The work began after Shielded Labs hired Hornby in April 2026 for ongoing protocol security research.

According to the group, Hornby used AI-assisted audit methods and traditional review work. The post said he used Anthropic’s Opus 4.8 model during a targeted Orchard review.

The bug involved an under-constrained part of the Orchard circuit. Shielded Labs said this allowed false inputs in an elliptic curve multiplication check.

“The vulnerability was real and exploitable,” Shielded Labs said. It added that Hornby built a working exploit in a local test setting.

Unlimited ZEC Could Have Been Minted

The reported bug could have allowed an attacker to create unlimited ZEC inside Orchard. 

Shielded Labs said the counterfeit coins would not be detected by normal cryptographic checks.

Orchard has strong privacy features, so the team cannot prove whether the bug was used before the fix. The group said it was being clear about that uncertainty.

The bug was active from Orchard’s launch in May 2022 until the emergency repair in June 2026. That placed the exposure period at more than four years.

Still, Shielded Labs said prior exploitation seemed unlikely. It said the issue had escaped years of review by skilled cryptographers and security experts.

Read Also:

Zcash Plans Supply Check Upgrade

Shielded Labs said it is working with Zcash developers on a network upgrade plan. The plan would aim to let users verify the Zcash supply.

The proposal includes creating a new shielded pool and using turnstile accounting for Orchard coins. 

This process would seek to prove that no counterfeit ZEC remains in the Orchard pool.

The group said more details will be shared in a later post. Any upgrade would need support from Zcash users and the normal governance process.

Shielded Labs also said it will expand security work. The group plans formal verification for the Orchard circuit and new hiring for security roles.

The post Zcash Reveals Orchard Bug That Could Have Minted Unlimited ZEC appeared first on Live Bitcoin News.