Critical Forgery Vulnerability Found in Zcash's Orchard Pool

A critical forgery vulnerability in Zcash's Orchard pool was discovered by Taylor Hornby on May 29, 2026. According to ChainCatcher, Hornby reported the issue to the Zcash Open Development Lab, and a fix was implemented by June 2. The vulnerability could have allowed the creation of an unlimited number of counterfeit ZEC within the Orchard pool. Due to Orchard's privacy features, it is impossible to cryptographically verify whether the vulnerability was exploited before the fix. The flaw had been present since Orchard's activation in May 2022 until the emergency patch was deployed on June 1, 2026. Hornby, with the assistance of AI tools, developed a complete exploit program and successfully generated undetectable counterfeit ZEC in a local test environment. Currently, Shielded Labs is collaborating with other Zcash developers to explore network upgrade proposals that would enable verification of Zcash's supply integrity.