The price of Zcash (ZEC) fell sharply after the disclosure of a critical vulnerability that could have allowed unlimited counterfeiting of the cryptocurrency. Security engineer Taylor Hornby, assisted by AI, discovered the bug in the privacy-focused Zcash’s Orchard shielded pool, which had existed since May 2022. The Zcash Open Development Lab executed an emergency hard fork to patch the issue, but uncertainty over prior exploitation contributed to ZEC’s 30% price drop.
The price of ZEC dropped substantially on Thursday following public disclosure of a critical counterfeiting vulnerability in Zcash’s Orchard pool. Security engineer Taylor Hornby, engaged by Shielded Labs, discovered the bug on May 29 and disclosed it to the Zcash Open Development Lab (ZODL), which deployed an emergency hard fork fix activated on June 3.
The vulnerability allowed false inputs into an elliptic curve multiplication check, which could have enabled a bad actor to mint unlimited ZEC. “If he had run the same tool on Zcash mainnet it would have generated unlimited, undetectable counterfeit ZEC in his mainnet Zcash wallet,” researchers stated.
Concerns about potential past exploitation, which cannot be cryptographically disproven due to Orchard’s privacy properties, led to a selloff. Zcash fell more than 30% over 24 hours to around $410, shrinking its market capitalization by more than $3 billion.
BitMEX co-founder Arthur Hayes commented on the situation, stating it was unlikely ZEC had been illegally minted but acknowledging “it cannot be formally cryptographically proved impossible.” He also revealed he sold his ZEC holdings due to the exploit.
Hornby used the newly released Claude Opus AI to assist in a targeted review of the Orchard circuit, building and testing a working exploit. Shielded Labs noted the bug was subtle enough to evade years of expert review and that discovery required highly skilled effort with cutting-edge tools.
The firm is now working with Zcash developers on a proposed network upgrade to allow verification of the ZEC supply’s integrity. This is not Zcash’s first counterfeiting vulnerability; a similar issue was discovered and remediated by the Electric Coin Company in 2018-2019 with no losses.
