Zcash Falls Over 50% After Orchard Bug, $116M Liquidated

Zcash fell more than 50% after researchers disclosed a flaw in the Orchard zero-knowledge circuit, with the token sliding from roughly $630 to as low as $250 before recovering. Derivatives liquidations exceeded $116 million, driving heavy forced-close activity.

A market-data provider recorded about $72 million in long liquidations and more than $45 million in short liquidations in a 24-hour period, with peak forced closes between 8 a.m. and 9 a.m. UTC on June 5. The provider noted reported figures can understate actual forced-close volumes because data are staggered across platforms.

Zooko Wilcox, Zcash co-founder, and researchers Jason McGee and Taylor Hornby published the technical disclosure and said the flaw has existed since Orchard activated on May 31, 2022. The vulnerability originated in an under-constrained element of the circuit’s variable-base scalar multiplication gadget. In practice, it would have allowed a malicious actor to spend the same shielded note multiple times while revealing a different nullifier each time, effectively creating undetected counterfeit ZEC inside the Orchard pool.

Hornby found the bug on May 29 using an AI-assisted audit framework he built, called zcash-full-stack-auditor, combined with a recently released AI model. He produced a proof-of-concept and a full report to the Zcash Open Development Lab by 11:53 p.m. MDT the same day. A soft fork mitigation went live on June 1 and a full network upgrade, NU6.2, re-enabled Orchard with the corrected circuit at block 3,364,600 on June 2.

The exposure window ran from Orchard’s activation on May 31, 2022, through the soft fork on June 1, 2026 — four years, one day and ten hours. From the public release of the AI model to patch activation, the window was about four days and ten hours.

The researchers wrote, “There is no way to cryptographically prove whether the vulnerability was exploited before it was remediated.” That limitation follows from the design of shielded pools, which hide transaction details by intent.

Reactions in the market differed. Arthur Hayes, BitMEX co-founder and Maelstrom CIO, posted that he sold his personal and firm ZEC holdings and said he viewed actual minting as unlikely but not provably impossible. Other industry figures pointed to the speed of discovery and patching; one argued that exploiting the flaw would have required a level of codebase scrutiny beyond multiple expert teams and a decision not to drain the pool during a period of price appreciation. Cameron Winklevoss described the rapid response as a vote of confidence. A security researcher said newer AI tools can surface long-standing vulnerabilities.

Shielded Labs proposed a network upgrade to create a new shielded pool and enforce turnstile accounting for coins migrated from Orchard, enabling public verification of migrated balances. The proposal requires community governance approval. The firm also launched a formal verification project for the Orchard circuit and opened searches for a head of security and a cryptographer.

Developers and community members discussed formal verification as a longer-term defense and the possibility of a second Orchard pool in a future upgrade cycle. Because shielded pools are intended to conceal transaction details, the protocol cannot reveal whether a stealth minting event occurred; the technical patch corrects the circuit but does not remove that cryptographic limitation.