Zcash Fixes Critical Orchard Vulnerability As ZEC Holds $600 Support

Zcash has patched a dangerous vulnerability in its privacy-focused infrastructure that could have enabled double-spending, deploying an emergency network upgrade to prevent exploitation.

On Wednesday, the Zcash Foundation revealed that developers had fixed a serious vulnerability in its Orchard shielded pool, which could have allowed invalid state transitions, potentially enabling double-spending within the pool.

According to the report, Zcash researcher Taylor Hornby, who is conducting an ongoing protocol audit on behalf of Shielded Labs, discovered a critical soundness vulnerability in the Orchard zero-knowledge proof circuit on May 29 and disclosed the issue to Zcash Open Development Lab (ZODL) core engineers that same day.

“A soundness vulnerability is one that could allow the system to accept something it should reject. In this case, successful exploitation could have allowed the Orchard pool to accept invalid state transitions, potentially permitting double-spending of funds within Orchard, though with no ability to inflate the total ZEC supply, which is protected by Zcash’s turnstile mechanism,” the foundation explained.

After identifying the vulnerability, Zcash developers, miners, and infrastructure operators coordinated privately to prepare a fix, keeping details confidential to avoid potential exploits.

The first soft fork attempt faced technical challenges, but engineers quickly released a revised patch that successfully activated on June 2, temporarily disabling Orchard-related transactions. On June 3, the network completed a full hard fork upgrade, NU6.2, restoring Orchard functionality with the corrected code and permanently resolving the vulnerability.

The Foundation said there was no evidence that the bug was exploited, as no unauthorized value creation was detected. In addition, they affirmed that the total ZEC supply remains safe and the issue did not affect the privacy of funds held in any Zcash pool.

Following the upgrade, news that the network was offline circulated on social media, creating confusion among community members. Some reports claimed that Zcash had failed to produce blocks for over four hours.

However, Mert Mumtaz, CEO of Solana infrastructure firm Helius, dismissed these reports, affirming that the network was never down and that explorer apps were connected to a bad node.

In a series of X posts, Zcash blockchain explorer CipherScan confirmed the issue, explaining that its nodes were upgrading to support the recent NU6.2 network upgrade.

“What actually happened: Zcash pushed a coordinated network upgrade (NU6.2) that required all node operators to update. During that transition, some block explorers, including ours, showed stale or missing data while we upgraded,” the post stated.

“That’s the explorer being out of sync, not the blockchain being broken. Important distinction. (…) Block explorers are just readers. They pull data from a node, parse it, and display it. If the node is upgrading or resyncing, the explorer goes stale,” the explorer continued.

Despite the confusion, ZEC’s price continued to defy the broader market trend, rallying over 8% intraday to retest the $636 around on Wednesday morning. Notably, the cryptocurrency has soared roughly 20% over the past two days while most of the market bled.

After failing to reclaim the $630 local resistance, the cryptocurrency dropped toward the $600 support, briefly falling below it before bouncing again. As of this writing, Zcash trades at $612, a 9.5% increase in the weekly timeframe.