TL;DR

• Orchard was found to have a vulnerability that could generate limitless and undetectable counterfeit ZEC. Although it has been fixed, the community still cannot prove that it has never been exploited in the past nearly four years.
• The essence of ZEC's drop of over 30% is that the market has begun to doubt the credibility of Zcash's supply.
• Related assets: ZEC (Zcash), Anthropic (unlisted)

On June 5, Zcash founder Zooko Wilcox published a rare, comprehensive security review.

The article revealed that security researcher Taylor Hornby discovered a serious forgery vulnerability in Zcash's latest privacy pool, Orchard, on May 29. Attackers could construct a transaction that should not have passed verification and generate limitless and undetectable counterfeit ZEC within Orchard.

This is not just a theoretical risk. Taylor has already written a complete exploit in a local testing environment, successfully generating counterfeit ZEC. If the same program were deployed on the mainnet, theoretically, attackers could generate unlimited amounts of counterfeit assets in their own mainnet wallets.

After the news broke, ZEC dropped more than 30%. CoinMarketCap data showed that ZEC fell to a low of $408.39 within 24 hours, down about one third from a high of $610.47 during the same period. Unfortunately, this was one of the few assets in the recent cryptocurrency market that had an excellent wealth effect, backed by favorable narratives from numerous insiders, now completely shattered by this vulnerability.

Looking solely at the outcome, this seems to be another familiar cryptocurrency security incident: a vulnerability is discovered, developers rush to fix it, and the market falls into panic.

However, the truly tricky aspect of the Orchard incident is that while the vulnerability has been fixed, the Zcash community cannot directly answer another, more sensitive question:

In the past four years, has anyone exploited this vulnerability?

Four days of emergency fixes, Orchard temporarily suspended operation

Orchard is a next-generation privacy payment protocol launched by Zcash in 2022 and is currently one of the main privacy pools used by Zcash. Users can hide their balances, transaction amounts, and fund flows, while proving through zero-knowledge proofs that their transactions comply with the rules.

According to the timeline disclosed by Zooko, Shielded Labs, and the Zcash community, Taylor found an anomaly during a targeted security review of the Orchard circuit on May 29 and immediately disclosed the vulnerability privately to the Zcash Open Development Lab (ZODL). Shielded Labs is an independent Zcash ecosystem support organization based in Switzerland, operating on donations, and has long been involved in protocol development, security, and network sustainability for Zcash. It is not affiliated with the Zcash Foundation or ZODL.

ZODL engineers confirmed the existence of the issue within hours of receiving the report and began searching for a fix. Since publicly releasing the code patch could expose the principles of the vulnerability, the team first chose to temporarily shut down Orchard: prohibiting the creation of new Orchard outputs and also preventing the spending of funds already in Orchard.

After coordinating with developers, miners, node operators, exchanges, and infrastructure service providers to upgrade, an emergency soft fork went into effect on June 2. Subsequently, Zcash updated the verification keys of the Orchard circuit through a hard fork upgrade and restored Orchard’s functionality on June 3. Transparent addresses and the Sapling privacy pool could still operate during this period.

The entire process from vulnerability disclosure to resolution took only a few days. In terms of emergency response speed, this was already a quite successful handling.

But the market did not calm down after the vulnerability was fixed because the fix addressed the future, not the past.

What the market is worried about is not whether attacks will still occur, but that attacks may have already occurred

Ordinary security incidents usually have a relatively clear loss scale. If a smart contract is hacked, on-chain it can be tracked how many assets were transferred by the attacker; if a cross-chain bridge has a vulnerability, the flow of funds and impacted addresses can also be counted.

The Orchard incident is different.

According to Shielded Labs, this vulnerability could be used to generate limitless and undetectable counterfeit ZEC within Orchard. Due to the inherent privacy properties of Orchard, the outside world cannot definitively prove, solely through cryptographic methods, whether this attack vector was exploited before the vulnerability was fixed.

This means that the market is not facing a determined loss number but rather a hard-to-quantify uncertainty:

If someone really discovered and exploited the vulnerability in the past, then does counterfeit ZEC already exist internally in Orchard? If it exists, what is the scale? Do these assets still remain in the privacy pool? Have they ever gradually flowed out through normal transactions?

More importantly, this risk window did not just start from May 29. Shielded Labs stated that the vulnerability has existed since Orchard was launched in May 2022, until the emergency fix was completed in June 2026. In other words, the issue had been lurking for nearly four years.

What the market is truly concerned about is not what happened between May 29 and June 2, but whether unobservable anomalies have occurred over the past four years.

This is also the core reason for ZEC's drop of more than 30%.

The market is not just selling a vulnerability but is repricing the credibility of the supply.

A missing mathematical constraint evolved into the risk of "infinite issuance"

Seeing the term "infinite issuance vulnerability," our first reaction might be that hackers have gained admin privileges or some sort of backdoor in the protocol.

The reality is more fundamental.

The security of Orchard relies on a set of zero-knowledge proof circuits (Orchard circuit). Users can hide specific transaction details but must prove to the network that their transactions comply with protocol rules. The most important rule is asset conservation: a transaction cannot create new value out of thin air.

In simple terms, users can hide how much ZEC they own and also not disclose how much ZEC they transferred to whom, but the network must be able to confirm:

The spent assets indeed come from legitimate inputs.

The issue Taylor identified concerns an elliptic curve multiplication check in the Orchard circuit.

Shielded Labs described it as an "under-constrained element," meaning an incompletely constrained circuit element. Since the relevant mathematical relationships were not fully constrained, attackers could input any erroneous data into the elliptic curve multiplication process, and the verification process might still return a pass.

In other words, attackers do not need to crack cryptographic algorithms or control network nodes.

They only need to construct a set of data that should not be valid, tricking the system into wrongly believing the transaction still satisfies asset conservation.

Once this erroneous proof is accepted by the network, the nonexistent ZEC can be viewed as legitimate assets and continue to exist within Orchard.

This is why Shielded Labs used extremely strong language:

unlimited, undetectable counterfeit ZEC

The real danger lies not just in "infinite," but also in "undetectable."

There is an important distinction between the two statements

The Zcash Foundation stated in its announcement after the upgrade that no evidence has been found that the vulnerability was ever exploited, and no unauthorized value creation has been detected, nor has user capital and privacy been affected. The announcement also emphasized that the original Zcash Turnstile Accounting mechanism can track value flows between different pools of funds and protect the total supply cap of 21 million ZEC.

Meanwhile, Shielded Labs clearly stated that it cannot solely rely on cryptography to prove that counterfeit ZEC has never appeared historically in Orchard.

These two statements seem contradictory, but they actually focus on two different levels of issues.

The original Turnstile Accounting mechanism in Zcash can be understood as a "gate" between different pools of funds. The system can tally up how many legitimate assets have entered Orchard, and restrict the scale of assets that can flow out of Orchard.

Assuming there were originally only 1 million legitimate ZEC in Orchard, even if an attacker fabricated more assets internally, the system would not allow assets to flow out exceeding the legitimate scale. This could prevent the total supply cap of the entire Zcash network from being easily breached.

However, this mechanism does not directly prove that counterfeit coins have never existed internally in Orchard.

If forged assets remain in Orchard, or gradually replace real assets within the legitimate outflow limits, the original statistical mechanism may not provide a definitive historical conclusion.

Regarding this almost historically oldest cryptocurrency privacy project, what we can know is that currently no evidence of abnormal issuance has been found, but the community still cannot directly prove that counterfeit assets have never existed in Orchard.

This is precisely the type of risk that the market finds most difficult to handle.

The problem is not how many counterfeit coins have already been discovered, but that no one can thoroughly confirm that counterfeit coins have never appeared.

How can Zcash reaffirm that there are no counterfeit coins in Orchard?

Fixing the vulnerability is only the first step.

Shielded Labs has already indicated that it is working with other Zcash developers on a new network upgrade proposal. The plan includes deploying a new privacy pool and enforcing Turnstile Accounting on all assets migrated from Orchard.

This is equivalent to setting up a new migration gate for Orchard.

Assets from the old Orchard that wish to enter the new privacy pool must complete their migration according to verifiable rules. The system can recalculate the scale of legitimate assets flowing out and determine if there are any additional ZEC that cannot be normally migrated.

If the upgrade is successfully completed, anyone will be able to verify the integrity of Zcash's supply and further prove that no counterfeit assets exist in Orchard.

The significance of this plan is not merely to fix the code but to rebuild market trust in Orchard.

Because in privacy systems, trust should not come from “we believe the attack did not happen,” but rather from “anyone can verify that the attack did not happen.”

Shielded Labs also acknowledges that the probability of malicious exploitation previously was low. The vulnerability was hidden for years, making it extremely difficult to discover; Taylor was actively searching for such problems in a dedicated security research project; and after the vulnerability was disclosed, the ecosystem quickly closed the attack window in a matter of days.

But Shielded Labs simultaneously emphasizes that users should not rely solely on the subjective judgment of the development team.

The market needs proof.

Why was a hidden vulnerability discovered at this time?

There is another easily overlooked detail about the Orchard incident.

On May 28, Anthropic released Claude Opus 4.8.

One day later, Taylor discovered the Orchard vulnerability.

According to Zooko and Shielded Labs' review, shortly after the release of Opus 4.8, Taylor used it for a highly targeted review of the Orchard circuit and discovered the issue on May 29. Subsequently, with the aid of Opus 4.8, he wrote a complete exploit program that generated limitless and undetectable counterfeit ZEC in a local environment.

This detail is worth noting not because AI can independently conduct cryptographic audits.

The public information does not support such exaggerated conclusions.

Taylor himself is an experienced security researcher. Shielded Labs also mentioned that he simultaneously used traditional security research methods, customized AI tool frameworks, and specially designed prompts. Opus 4.8 was an important tool in the review process, but not the only factor.

What is truly noteworthy is that Taylor did not use Anthropic's Claude Mythos Preview, which is specifically designed for cybersecurity scenarios and has restricted open access, but rather the recently publicly released general model Opus 4.8.

Anhtropic's positioning of Mythos Preview is as a cutting-edge model with significant vulnerability discovery and exploitation capabilities. Due to potential abuse risks, Anthropic did not open this model directly to the public but provided access to select partners through Project Glasswing.

In contrast, Opus 4.8 is a general model accessible to ordinary developers. Anthropic emphasized in the release notes that it has improved in code analysis, execution of complex tasks, and identification of code defects.

This signals a more important trend released by the Orchard incident:

The ability to discover high-value vulnerabilities is spreading from a few specialized security models to general models.

A general model that was made public just one day ago has already been able, under the guidance of professional researchers, to participate in the review of complex zero-knowledge proof circuits and help discover a crucial vulnerability hidden for nearly four years.

This does not mean that cryptography experts are no longer important.

On the contrary, Taylor’s experience, the selection of review targets, and the ability to validate model output remain central to the entire process.

However, the combination of experts and AI is significantly lowering the cost of discovering complex vulnerabilities.

The vulnerability has been closed, but the market is still waiting for answers

For Zcash, the most pressing attack window has closed.

The Orchard functionality has been restored, the verification circuit has been updated, and there is currently no evidence that the vulnerability has been maliciously exploited.

However, ZEC's drop of over 30% indicates that what the market cares about is not just whether the code has been fixed.

The market is still waiting for a more thorough answer:

Over the past nearly four years, has there ever been counterfeit ZEC inside Orchard?

If the new privacy pool and Turnstile Accounting upgrade can be smoothly implemented, the community will eventually have the opportunity to prove the integrity of the supply and rebuild market trust.

However, before this proof is completed, the Orchard incident still presents an unsolvable suspense:

Did those theoretically infinitely creatable counterfeit ZEC truly never exist, or have they once hidden in a place no one could directly see?

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。