Zcash Patches Critical Orchard Flaw That Could Have Enabled Unlimited ZEC Forging

ChainCatcher reports that on May 29, 2026, Taylor Hornby identified a critical forgery vulnerability affecting Zcash's Orchard shielded pool. Hornby disclosed the issue to the Zcash Open Development Lab, and a fix was completed on June 2 through a coordinated response. The flaw could have allowed an attacker to mint an unlimited amount of forged ZEC inside Orchard without detection. Because Orchard transactions are privacy-preserving, there is no cryptographic way to prove whether the vulnerability was exploited before the fix was deployed. According to the report, the issue had been present since Orchard's activation in May 2022 until an emergency patch was released on June 1, 2026. With assistance from AI tools, Hornby built a full exploit in a local test environment and was able to generate unlimited forged ZEC that would be undetectable on-chain. Shielded Labs said it is working with other Zcash developers on potential network upgrade proposals aimed at enabling anyone to verify the integrity of Zcash's supply.