Zcash Patches Four-Year Minting Bug, But Can’t Prove No Coins Were Stolen

Published by James Harris on June 8, 2026June 8, 2026

Four years is a long time for a critical minting vulnerability to sit undetected in a privacy protocol’s shielded pool, and the honest answer to whether anyone exploited it is: nobody knows.

The bug, discovered by security researcher Taylor Hornby using AI-assisted testing, allowed counterfeit ZEC to be created inside the Orchard shielded pool without detection. That last part is the structural problem. Orchard’s entire value proposition is that transactions and counterparties are invisible, which means the same feature that makes ZEC attractive to privacy-focused holders also makes it impossible to audit whether fake supply was ever minted or withdrawn. The team patched the vulnerability on June 2 and is now proposing a verification system called Ironwood, which would allow node operators to confirm circulating supply matches the expected mining schedule. The comparison that matters here is not to a typical exchange hack with a known dollar figure attached, but to something more like the early Monero bulletproofs audit concerns, where the theoretical possibility of hidden inflation was enough to cause lasting reputational damage even without confirmed exploitation.

The Orchard pool doubled its ZEC holdings over the past year, driven partly by influencer-led narratives positioning it as a premier privacy hub. That growth now looks like a liability rather than a milestone.

ZEC’s price dropped 53% before recovering partially to around $435, but the market structure question outlasts the price move. ThorChain has already delayed its ZEC integration pending supply verification, which signals that the protocol-level trust problem is real and not just retail panic. If Ironwood passes its governance vote and the new Orchard pool with turnstile accounting goes live, it would effectively quarantine any potentially counterfeit coins from the old pool, but it cannot retroactively prove whether bad actors extracted value. The broader implication for privacy coins is that zero-knowledge architectures, which are increasingly being adopted across Ethereum Layer 2s and institutional settlement layers, will face harder scrutiny from integrators who now have a concrete example of how shielded supply can become unauditable supply.

The Ironwood proposal is still awaiting a governance vote, and until it activates, the ZCash Info supply data reflects only the transparent portion of circulating ZEC. The timeline for the new Orchard pool replacement has not been confirmed publicly, which means the uncertainty window stays open for any exchange or protocol currently evaluating ZEC integration.