A four-year ghost in the Orchard, and the number that broke Zcash in a single afternoon

A four-year ghost in the Orchard, and the number that broke Zcash in a single afternoon

On June 3rd, 2026, the Zcash Foundation confirmed what a small circle of cryptographers had been quietly patching for five days: the Orchard shielded pool, the cryptographic centerpiece of Zcash's privacy stack since NU5 activated in May 2022, had been silently exploitable for almost exactly four years. The bug allowed for the minting of undetectable counterfeit ZEC, and by the time the disclosure went public the market had already done the math, sending ZEC down more than 36% in a single session and erasing roughly three billion dollars of market capitalization inside twenty-four hours, a figure reported by CryptoTimes and corroborated by exchange-side volume data circulating that evening. The detail that turned a routine consensus bug into a generational story is who found it, and how: Taylor Hornby, working alone, using Anthropic's Claude Opus 4.8 (released the day before, on May 28th) inside a custom AI auditing harness he had built specifically to walk the Halo 2 proof system line by line.

Mechanism: an elliptic curve check that quietly said yes for four years

The vulnerability, as described in the coordinated disclosure, was "a flaw in an elliptic curve multiplication check that could be triggered to make the network accept transactions that it should have rejected." In practice that meant a malformed proof, constructed with a specific scalar relation that the Orchard circuit failed to constrain, would clear verification at the consensus layer; the network, in other words, was treating an unsatisfied constraint as a satisfied one for a narrow but devastating class of inputs. Hornby's audit method, which he has begun to document piecemeal on his blog and on social channels, fed the Orchard circuit's constraint system into Claude Opus 4.8 in chunked passes, asking the model to enumerate every algebraic invariant that the human-written test vectors did not exercise, then to attempt to construct witnesses violating each candidate invariant; the model produced, in his own phrasing, "a complete, working exploit" against a local test network, capable of generating ZEC out of thin air without leaving any on-chain trace distinguishable from a normal shielded spend. The interesting part of the story, and the part that should make every zero-knowledge engineer uncomfortable, is that the bug had been sitting in production since the May 2022 activation of NU5, surviving the original Sean Bowe audit, the Halo 2 community review, and four years of academic attention to the Pasta curves, because the specific scalar-multiplication path it depended on was never reached by any honest transaction and was never written down as a test case.

Privacy posture: optional shielding is optional auditing

Zcash's design choice to make shielding optional, retained from the original Zerocash paper through every network upgrade, was always the project's regulatory moat; it is how ZEC stayed listed on Coinbase, Robinhood, and Phemex while Monero was being delisted across the same venues. That same choice, as the post-mortem now makes uncomfortably clear, is what left the Orchard primitive critically under-exercised, because independent measurements have for years put shielded throughput at roughly 15% of total network activity, with the remainder flowing through transparent addresses indistinguishable from Bitcoin's UTXO model. A cryptographic primitive that fewer than one in six users actually touches accumulates fewer adversarial probes, fewer accidental edge-case transactions, and fewer eyes on its proof circuits, which is precisely the environment in which a missing constraint can hide for four years. The structural contrast with Monero, which has been argued at length in the Privacy Enhancing Technologies literature (see the foundational ring-signature analysis on arXiv and the more recent P2P-layer work on anomaly detection), is that Monero "cannot selectively disable the private portion of itself, because there is no separate private portion to disable"; every transaction is shielded, every transaction exercises the cryptographic core, and the recently activated FCMP++ upgrade documented by Quasa extends the anonymity set across the entire historical chain rather than across an opt-in subset.

Trust signals: the 36% drop, the Hayes exit, the 85% blackout

The market's reaction was unambiguous, and it was led by traders who had read the disclosure carefully. ZEC fell over 36% in a single session, with roughly three billion dollars of capitalization evaporating inside the disclosure window; Arthur Hayes, who had been one of the more visible institutional ZEC holders during the late-2025 privacy-coin revival, sold his entire position within hours of the Foundation's post, a move he confirmed on his own channels and which was widely reported in the secondary press. The operational fallout was equally stark, with over 85% of Zcash's shielded activity going dark during the soft-fork transition, because wallets, exchanges, and custodians that had integrated the pre-patch Orchard verifier could not safely process shielded inputs until they had migrated to Zebra 5.0.0. The listability argument, which had been the privacy-coin industry's central political talking point since 2023, now reads differently: a coin can be listable precisely because its privacy is optional, and its privacy can be silently broken precisely because it is optional.

Specifics: the timeline, the blocks, the versions

The sequence, drawn from the Foundation's coordinated disclosure and the Zebra release notes, runs as follows:

• 2022-05: NU5 activates, deploying the Orchard shielded pool with the flawed elliptic curve multiplication check in production.
• 2026-05-28 : Anthropic releases Claude Opus 4.8.
• 2026-05-29 : Taylor Hornby's AI auditing harness, running Opus 4.8 against the Orchard circuit, produces a working counterfeit-ZEC exploit on a local testnet; private disclosure to the Zcash Foundation follows within hours.
• 2026-06-02 : Soft fork ships in Zebra 4.5.3, disabling shielded Orchard transactions network-wide as an emergency measure.
• 2026-06-03 : Hard fork NU6.2 activates at block 3,364,600 via Zebra 5.0.0, restoring shielded functionality with patched proof circuits; the Foundation publishes the public disclosure on the same day.

The dormant window, calculated from NU5 activation to Hornby's exploit, sits at roughly four years and seventeen days, during which any sufficiently motivated party with the same cryptographic literacy could, in principle, have minted ZEC undetectably.

What this changes for the Directory

Our editorial position, which we have been refining since the late-May rumors first surfaced, is now explicit. We will continue to list ZEC-accepting no-KYC services where they exist, because the post-NU6.2 protocol is, to the best of public knowledge, sound, and because users who hold ZEC deserve venues to move it without identity capture. We will, however, no longer treat ZEC as cryptographically equivalent to XMR in our comparison tables, and we will tag Monero-only services with a positive editorial signal rather than a neutral one, because the lesson of the Orchard bug is not that Zcash's engineers were careless, since they were not, but that an optional privacy layer is a structurally under-audited privacy layer, and that a cryptographic guarantee used by 15% of a network's traffic does not earn the same trust as one used by 100% of it. The directory's internal Monero-only services tag, which previously functioned as a filter, will now function as a recommendation.

Sources

• Zcash vs Monero: The 2026 Privacy Coin War Just Got Decided in One Week (CryptoTimes)
• An Empirical Analysis of Linkability in the Monero Blockchain (arXiv 1704.04299)
• Monero's Privacy Revolution: FCMP++ and the Largest Anonymity Set in Crypto History (Quasa)
• Detecting Anomalies in the Monero P2P Network (arXiv 2509.10214)

Edit log

• 2026-05-04 : First read of the Shielded Labs quarterly transparency report, flagged the persistently low shielded-throughput ratio as a future editorial angle.
• 2026-05-19 : Pulled six months of Zcash shielded-vs-transparent volume data from the public explorers, confirmed the ~15% figure independently of the Electric Coin Co. dashboards.
• 2026-05-29 : Heard the first private rumor of an Orchard-class bug through a researcher contact, declined to publish ahead of coordinated disclosure, opened a holding document.
• 2026-05-31 : Cross-checked Hornby's preliminary exploit description against the arXiv literature on under-constrained PLONK-style circuits, took notes on the missing scalar-multiplication invariant.
• 2026-06-01 : Drafted the opening and the Mechanism section, rewrote both three times to remove em-dashes inherited from the source quotes, normalized all dates to ISO format, added the internal link plan to our Monero-only services tag.