The ZEC Unlimited Supply Vulnerability was discovered by Anthropic Opus 4.8, and ZEC plunged over 31% in the 24 hours following the discovery.

**Zcash Orchard Pool Vulnerability Triggers Emergency Fix, Sparks 31% ZEC Price Drop** Zcash founder Zooko Wilcox revealed in a June 5 post a severe counterfeiting vulnerability in the protocol’s Orchard privacy pool, a flaw that could be abused to create an unlimited, undetectable amount of fake ZEC tokens. Security researcher Taylor Hornby discovered the bug on May 29 using Anthropic’s Opus 4.8 model, then disclosed it to the Zcash Open Development Lab (ZODL). ZODL coordinated an emergency response across the Zcash ecosystem, with a fix rolled out on June 2. Hornby developed full working exploit code in a local regtest environment, which successfully generated unlimited untraceable counterfeit ZEC during testing. If run on Zcash’s mainnet, this tool would let attackers produce fake tokens that go undetected in user wallets. The vulnerability stems from an under-constrained component in the Orchard circuit: malicious actors can feed false inputs to elliptic curve multiplication, and the system still passes required validation checks. The bug has existed since the Orchard Pool launched in May 2022, and remained unresolved until the emergency fix was deployed on June 1, 2026. Due to Orchard’s privacy features and the flaw’s nature, there is no cryptographic way to confirm if the vulnerability was exploited before the fix. However, Shielded Labs assesses the risk of prior exploitation as low, and is exploring plans to launch a new privacy pool via a network upgrade. This new pool would implement turnstile accounting for all Orchard Pool tokens, allowing anyone to verify Zcash’s supply integrity and prove no counterfeit ZEC exists in the Orchard system. Market data from HTX shows ZEC’s price has plummeted over 31% in the last 24 hours, currently trading at $410.5.