A critical flaw in Zcash’s Orchard shielded pool has shaken confidence in the cryptocurrency’s supply integrity, prompting BitMEX co-founder Arthur Hayes to liquidate his entire ZEC holdings. The bug, discovered by security researcher Taylor Hornby on May 29, could have allowed the creation of unlimited counterfeit Zcash tokens without detection, according to a post by Shielded Labs shared by Zcash founder Zooko Wilcox.
In a local test, Hornby demonstrated that the exploit worked, raising concerns that it might have been used on the mainnet before the fix. Shielded Labs noted that due to the privacy features of Orchard, it is impossible to cryptographically prove whether any unauthorized minting occurred prior to the patch. However, the team believes it is unlikely that the bug was exploited in the wild.
The Zcash Open Development Lab coordinated an emergency response with other ecosystem teams, applying a fix that closed the vulnerability by June 2. The upgrade temporarily paused Orchard activity and restored it with corrected code. The Zcash Foundation also released Zebra 5.0.0 as part of the NU6.2 hard fork, re-enabling the pool with a fixed circuit, and reported no evidence of value creation beyond the intended supply.
Arthur Hayes announced on X that he sold his full ZEC position, stating that the privacy narrative requires absolute certainty, not mere probability. He acknowledged that while unauthorized minting seemed extremely unlikely, it could not be formally ruled out, breaking his investment thesis. His decision came after ZEC’s price dropped approximately 30%, leading him to take profits. Hayes had previously included Zcash as part of his ‘Holy Trinity’ trade, alongside HYPE and NEAR, but now considers that strategy defunct.
In response to the incident, Shielded Labs is exploring a network upgrade that would introduce a new shielded pool with turnstile accounting to track coins exiting Orchard. This would allow anyone to verify that no counterfeit ZEC remains in the affected pool, providing a way to prove supply integrity. The proposal still requires further details and community support, with a follow-up post expected next week to explain the upgrade’s mechanics and tradeoffs.
Users are advised not to rely solely on the assessment that prior exploitation was unlikely. The planned upgrade aims to restore trust in Zcash’s supply by making the verification process transparent and independent of any party’s opinion.