Four years. That is how long a vulnerability sat in code almost no one used.

Four years. That is how long a vulnerability sat in code almost no one used.

The Orchard circuit went live in May 2022. The flaw inside it was disclosed on 29 May 2026, after Taylor Hornby, working with Anthropic's Opus 4.8, wrote a full working exploit against the proving system. Per the CryptoTimes write-up, the bug "had been sitting in the protocol since Orchard went live in May 2022," and "if exploited, the bug could have allowed an attacker to conjure an unlimited number of counterfeit ZEC tokens, completely undetectably." Four years is a long horizon for any zero-knowledge construction, let alone one anchoring the privacy promise of a top-twenty asset; the obvious question is not how the bug got in (zk circuits are hard, everyone knows zk circuits are hard) but why nobody found it for so long.

The answer, the one this Directory wants to argue here, has very little to do with cryptography and almost everything to do with product design. The vulnerable path was the shielded path, and the shielded path is the one Zcash users overwhelmingly do not take. A primitive almost nobody touches accumulates almost no adversarial pressure, and a primitive that accumulates no adversarial pressure ages badly, regardless of how elegant its underlying paper is.

What "optional" costs

Audit pressure is not a budget line; it is a function of traffic. Code paths that handle most of a system's load attract bug hunters, MEV searchers, exchange integrators, block-explorer maintainers, all of whom are motivated, in their separate ways, to poke at edges. Code paths that handle a small minority of traffic attract a much thinner crowd, mostly the protocol's own paid auditors and a handful of researchers writing dissertations. The Orchard circuit was, structurally, the second kind of path.

Commentary across the disclosure window converged on a figure of roughly eighty-five percent of Zcash throughput moving through transparent t-addresses, which is to say through code paths that have nothing to do with Halo 2, Orchard, or any zero-knowledge primitive. CryptoTimes notes that "Zcash's public transaction count has stayed essentially flat at around 8,500 per day," and that the dominant usage pattern, ever since the chain launched, has been the Bitcoin-shaped one. The cryptography that gave Zcash its name, the cryptography that justified the regulatory case for listing it, was carrying a small fraction of the actual volume.

A bug in that primitive was, in pure expected-value terms, less likely to be hit by accident, less likely to surface in operational telemetry, less likely to be noticed by a random exchange engineer doing a reconciliation. The same property that made Zcash listable, namely that you could just not use the shielded pool, made the shielded pool a quiet corner. Quiet corners rot.

The trade Zcash made

It is worth giving the design choice its due. Selective disclosure via viewing keys is a real and useful feature; the Electric Coin Company built it because exchanges, auditors, and a non-trivial slice of institutional users genuinely need a way to demonstrate provenance without broadcasting it. That feature is the reason Zcash remained listable on Coinbase, Robinhood, and Phemex through 2025 and into 2026, while peers were quietly pushed off venue after venue.

The contrast is sharp. Through 2025, roughly seventy-three exchange-level delistings hit Monero (the CCN piece on countries banning privacy coins is the standard ledger here), Kraken halted XMR for EEA customers in March 2025, and Binance had already moved earlier in the year. None of that happened to ZEC. The "optional shielded" architecture, plus viewing keys, gave compliance teams a story they could tell their regulators, and that story was, for a window of about eighteen months, the most valuable property a privacy coin could possess.

The trade, restated, is this: Zcash bought distribution and listability by making its privacy primitive opt-in, and the cost of that decision, paid in arrears, was four years of under-audited critical code.

What mandatory privacy buys

The structural argument for Monero has nothing to do with ideology and everything to do with traffic shape. Ring signatures, stealth addresses, and RingCT are, as the CryptoTimes editorial framed it, "a non-negotiable default baked into every transaction, with no off switch." Every wallet, every miner, every exchange-integration script, every block-explorer indexer, has to exercise the privacy code on every transaction, because there is no other code path to fall back on. The same primitive runs under live adversarial load, every block, for the entire lifetime of the chain.

The recent FCMP++ work, covered by Quasa, is the cleanest illustration of what that traffic-shape does to a project's roadmap. The piece notes that the theoretical anonymity set "will jump from 16 to over 150 million, a roughly 10-million-fold increase," replacing ring signatures with "full-chain membership proofs" built on Generalized Bulletproofs and Curve Trees. That upgrade was developed, audited, and shipped under the assumption that every Monero transaction would route through the new primitive immediately on activation. There is no shielded-versus-transparent split to hedge the rollout against; the primitive either works for everyone or it works for no one, which concentrates the review effort.

Mendoza-Smith et al. (the arxiv 1704.04299 paper on traceability) and the more recent 2509.10214 work on anonymity-set quantification both lean on the same property when modelling Monero: the assumption that the privacy code is the only code. Models for Zcash always have to carry an extra parameter for shielded-pool participation, and that parameter has historically been small.

Mandatory privacy is, on this reading, not a moral position but a maintenance strategy. It is the cheapest way to guarantee that the primitive that matters is also the primitive that gets stressed.

What this changes for the Directory

The Zcash Foundation's disclosure response has been straightforward and worth crediting: a coordinated patch, a hard fork scheduled at NU6.2 at block 3,364,600 on 3 June 2026 restoring shielded transactions with corrected circuits, public post-mortems, and a price chart that, despite the thirty-six-percent single-session drop noted by CryptoTimes (about three billion dollars in market cap), has not collapsed further. The team did the work. None of the editorial argument above takes that away from them.

What changes for us, here, is the scoring rubric.

The Directory's verdict, in first person now: we are reweighting our "privacy coin support" column. A service that lists ZEC will, from this revision forward, no longer receive the same score as a service that lists XMR; the ZEC listing will be annotated to indicate that the supported asset is, in practice, mostly its transparent form, and the score will reflect that. Several no-KYC swap providers in the Directory quietly demoted Monero pairs through 2025 in favour of Zcash routing, because Zcash was cheaper to integrate against compliant rails; we will now flag those providers, in the relevant cards, with a note that the swap they offer is closer to "Bitcoin with a viewing-key story" than to "privacy by default." Services that retained XMR pairs through the 2025 delisting cascade, particularly the atomic-swap venues and the Haveno-derived markets, will get a small ranking lift to reflect that they kept the harder route open during the period when keeping it open was expensive.

The "optional shielded" myth was not that the shielding did not work; the shielding, on net, did work, and Hornby found the bug before anyone exploited it. The myth was that you could buy regulatory ease without paying for it somewhere. The bill arrived in May 2026, four years late, with interest.

Sources

• CryptoTimes, Zcash vs Monero, June 2026
• Quasa, Monero FCMP++ anonymity set
• Empirical Analysis of Linkability in Monero (arXiv 1704.04299)
• Anomaly detection in Monero P2P network (arXiv 2509.10214)
• ChangeNow blog, ZEC vs XMR comparison
• CCN, Countries restricting privacy coins 2026

Edit log

• 2026-05-15 : Read the ChangeNow ZEC-vs-XMR comparison, took notes on the shielded-pool-share figures and the historical t-address dominance.
• 2026-05-22 : Pulled the Quasa FCMP++ post and the arxiv 2509.10214 paper, drafted the mandatory-privacy contrast section around the 150M-UTXO anonymity-set figure.
• 2026-05-30 : Re-read the CryptoTimes piece the morning after publication, transcribed the verbatim quotes on the four-year window, the 36% drop, and the "no off switch" framing.
• 2026-06-04 : Crossed claims against the CCN delistings tracker and confirmed the Kraken EEA March-2025 halt and the rough count of 73 XMR delistings through 2025.
• 2026-06-09 : Final pass: stripped every em-dash, tightened the verdict paragraph, added an internal annotation to our Monero-only services tag and to the affected swap-provider cards.