TL;DR:
- An unknown wallet withdrew nearly 40,000 ZEC, approximately 1% of Zcash’s private Orchard pool, six days after a critical vulnerability was discovered.
- The flaw was detected with help from Anthropic’s Opus 4.8 AI model. It could have allowed the creation of fake ZEC without leaving a trace; developers believe it was never exploited.
- ZEC’s price fell to lows of $280 following the bug disclosure, but has since recovered nearly 70% and is trading around $422.
An anonymous wallet withdrew approximately 40,000 ZEC from Zcash‘s Orchard shielded pool, an operation equivalent to roughly 1% of the total stored in that privacy layer.
The wallet moved six days after the network began recovering from a 38% drop triggered by the public disclosure of a long-standing vulnerability in that same pool. Data from Arkham indicates the remaining balance in Orchard stands at 3.88 million ZEC, valued at approximately $1.65 billion at current prices.
Someone just withdrew ~1% of all the ZEC in Zcash’s shielded Orchard pool.
Theoretically, Orchard now holds 3.88M ZEC, worth $1.65 Billion.
ZEC is up 70% since the bottom caused by the discovery of the Orchard Pool Exploit. pic.twitter.com/BWK2W2mCd9
— Arkham (@arkham) June 11, 2026
The Bug That Shook the Zcash Ecosystem
On June 5, Zcash disclosed details of a flaw in Orchard’s cryptographic circuit, the mechanism underpinning its most recent privacy pool. Security researcher Taylor Hornby identified the bug on May 29 with support from the artificial intelligence model Opus 4.8, developed by Anthropic. In a controlled test environment, Hornby successfully replicated an exploit capable of generating counterfeit ZEC without leaving any trace on-chain. Had it been executed against the production network, the attack would have allowed unlimited tokens to be minted directly into the attacker’s wallet, according to Shielded Labs.
The vulnerability had existed since Orchard’s launch in May 2022 and remained hidden for nearly four years, even after reviews conducted by specialized cryptographers. Shielded Labs acknowledged that the nature of the protocol makes it impossible to prove with certainty whether the exploit was ever used, though the organization considers it highly unlikely, citing the technical complexity of the discovery and the speed with which the patch was applied.
Why Inflation Bugs Matter
Quinten van Welzen of Zano noted that inflation vulnerabilities are among the most serious problems in privacy-oriented networks, as they directly erode confidence in the asset. He added that systems designed to protect user privacy are considerably more complex than those of transparent networks, which increases the likelihood that this type of flaw may occur.
The Wallet Had No Impact on ZEC’s Price
Regarding the detected withdrawal, the identity of the wallet’s holder has not yet been established. The hypotheses include a transfer to an exchange for selling purposes, an internal redistribution of funds, or a portfolio management adjustment prompted by the vulnerability disclosure. No immediate impact on ZEC’s price was recorded following the transaction.
Shielded Labs proposed implementing a new shielded pool through a chain upgrade, along with a turnstile accounting mechanism for all funds moved out of Orchard. The measure would allow the authenticity of ZEC’s supply to be independently verified. The organization also announced the hiring of a security chief and a cryptographer, in addition to expanding its formal verification program for the Orchard circuit.
