Invest ideasNews
8 Jun 2026, 11:19
Ripple CTO Says Zcash Holders Are Safe, But the Bug That Could Have Created Fake ZEC for 4 Years Cannot Be Disproven
Ripple CTO Emeritus David Schwartz stepped into the Zcash crisis on June 7, offering a measured reassurance to ZEC holders rattled by the disclosure of a critical zero-knowledge proof vulnerability in the Orchard shielded pool. His position: passive holders who never move their coins will not lose their funds, provided the bug was never actually exploited. That condition is doing enormous structural work in a sentence that sounds like comfort. The core paradox is this. The Orchard vulnerability, patched via an emergency NU6.2 hard fork on June 2, theoretically allowed undetected counterfeit ZEC generation for nearly four years. Zcash’s own developers cannot prove the exploit was never triggered, because the privacy architecture that makes ZEC valuable also makes supply auditing cryptographically impossible. Schwartz’s reassurance is accurate on its own terms. It cannot be a guarantee. This one paragraph has massive implications for Zcash. Hardly surprising the price has plummeted. "The vulnerability could have been exploited to undetectably create an unlimited amount of counterfeit zcash:native within Orchard. Because of the privacy properties of Orchard,… https://t.co/72v9Zafneu — Gareth Jenkinson (@gazza_jenks) June 5, 2026 ZEC fell more than 30% in a single session following the May 29 disclosure, briefly touching its lowest level in over a month. The market was not pricing confirmed exploitation; it was pricing unverifiable risk, which is a different and arguably harder problem to resolve. What Schwartz’s statement actually means for holders, and whether it changes anything structurally, is what the rest of this article addresses. Source: Tradingview Discover: The Best Crypto to Diversify Your Portfolio The Orchard Pool Bug: What the Vulnerability Actually Means for ZEC Zcash’s Orchard pool was introduced with Network Upgrade 5 (NU5) in May 2022, the network’s most advanced privacy layer, built on Halo 2-based zk-SNARKs designed to eliminate the trusted setup requirement of earlier Sapling circuits. The vulnerability resided in an under-constrained element within the elliptic-curve multiplication gadget inside the halo2_gadgets crate. In plain terms, crafted inputs could bypass validity checks and produce counterfeit ZEC that still passed verification. Zcash engineer Taylor Hornby discovered the flaw on May 29, 2026, reportedly with the assistance of AI-assisted formal methods. He confirmed a fully working exploit in a local regtest environment, and that running the same exploit on mainnet would have generated unlimited, undetectable real ZEC. The exposure window ran from Orchard’s mainnet activation in May 2022 through June 1, 2026, for approximately 4 years. Affected software included all halo2_gadgets versions before v0.5.0, orchard before v0.14.0, and zcashd versions v5.0.0 through v6.12.3. Straight from Zooko "We want to emphasize that we believe prior exploitation of the Orchard vulnerability is unlikely. But users should not have to trust our assessment, or anyone else’s, when it comes to the integrity of the Zcash supply." MUCH MUCH LOWER https://t.co/tlTRSWY1cH — Roger (@degendeez) June 6, 2026 Shielded Labs and developers responded rapidly, pushing Zebra 4.5.3 as an emergency soft fork to temporarily disable Orchard transactions, then activating the NU6.2 hard fork via Zebra 5.0 at block 3,364,600 on June 2 at 12:05 PM UTC+8. The circuit is now corrected. Here is the part that matters for holders: the patch closes the vulnerability going forward, but cannot retroactively prove supply integrity was maintained during those four years. That window is permanently opaque. Ripple Schwartz’s Reassurance: What It Means and What It Cannot Prove The discussion surfaced after crypto commentator Nate, known on X as @satorinakamoto, challenged whether Zcash could prove the vulnerability had never been triggered, given the network’s opacity. Schwartz, co-creator of the XRP Ledger and one of the more technically credible voices in the industry, responded directly: ‘They’ll eventually be a bit lonely in the deprecated pool, but they’ll still be safe and accessible.’ His broader point: consensus rules protect every ZEC owner, and protocol designers can define backward compatibility so passive holders retain valid, spendable coins even as the Orchard pool becomes a legacy layer. If there was no exploit, everyone is safe whether they move their coins or not. They'll eventually be a bit lonely in the deprecated pool, but they'll still be safe and accessible. — David 'JoelKatz' Schwartz (@JoelKatz) June 7, 2026 The stated reassurance is that holders will not forfeit assets. That is true conditionally; if no exploit occurred, unmoved funds in older pools remain intact. The condition itself, however, is the entire problem. Shielded Labs stated explicitly in its disclosure: ‘There is no definitive way to determine, using only cryptography, whether such exploitation occurred.’ Schwartz’s credentials lend his statement genuine weight. What they cannot lend it is certainty about a four-year window inside a privacy coin’s most opaque layer. This is not a dismissal of Schwartz’s view. His framing, that passive holders are safe absent confirmed exploitation, is technically coherent. The actual framing is that ‘absent confirmed exploitation’ is not a condition anyone can verify, including Zcash’s own developers. Both statements can be simultaneously true. The market is pricing the gap between them. Discover: The Best Token Presales The post Ripple CTO Says Zcash Holders Are Safe, But the Bug That Could Have Created Fake ZEC for 4 Years Cannot Be Disproven appeared first on Cryptonews .
8 Jun 2026, 10:00
Zcash Developers Propose Ironwood Upgrade to Block Counterfeit ZEC After Orchard Vulnerability
BitcoinWorld Zcash Developers Propose Ironwood Upgrade to Block Counterfeit ZEC After Orchard Vulnerability Zcash (ZEC) developers have unveiled a proposed upgrade to the network’s privacy infrastructure, named Ironwood, aimed at preventing the creation of counterfeit ZEC tokens. The initiative follows the recent discovery and patching of a critical vulnerability in the Orchard shielded pool, which could have allowed bad actors to mint unverified coins. What the Ironwood Upgrade Proposes The Ironwood proposal, put forward by developer ZODL and the Zcash Foundation, introduces a new shielded pool designed with enhanced supply verification mechanisms. Key components include a formal verification process and an independent audit system to ensure that no counterfeit tokens enter circulation. Under the plan, the existing Orchard pool will cease accepting new deposits and internal transactions. Funds currently held in Orchard will be migrated to Ironwood through a verification checkpoint known as a ‘turnstile,’ which cryptographically ensures that only legitimate ZEC moves between pools. Background: The Orchard Vulnerability The Orchard shielded pool, launched in 2021 as part of the Canopy network upgrade, was designed to provide enhanced privacy through zero-knowledge proofs. In early 2025, developers discovered a flaw that could theoretically allow an attacker to create ZEC without corresponding proof of work, effectively counterfeiting tokens. The vulnerability was patched before any exploitation occurred, but the incident underscored the need for more rigorous security measures in privacy-focused protocols. Why This Matters for Zcash Users and the Market For Zcash holders, the Ironwood upgrade represents a critical step in preserving the network’s core value proposition: a verifiably finite supply of private digital cash. Without robust supply verification, the entire privacy model collapses, as users cannot trust that their ZEC is not being diluted. The proposal also signals a shift toward more formal, audit-friendly development practices, which could improve institutional confidence in Zcash. The market reaction has been cautious but attentive, with ZEC trading volumes increasing slightly as the community debates the upgrade timeline. Conclusion The Ironwood proposal is still under community discussion, with a final vote expected in the coming months. If approved, it would mark one of the most significant security-focused upgrades in Zcash’s history, directly addressing a fundamental threat to the network’s integrity. The outcome will likely influence how other privacy-focused cryptocurrencies approach supply verification and vulnerability disclosure. FAQs Q1: What is the Ironwood upgrade for Zcash? Ironwood is a proposed new shielded pool that replaces the Orchard pool, adding formal verification and independent audits to prevent counterfeit ZEC creation. Q2: Was the Orchard vulnerability exploited? No, the vulnerability was patched by developers before any known exploitation occurred. The Ironwood upgrade is a preventive measure to strengthen supply verification. Q3: How will funds be migrated from Orchard to Ironwood? Funds will move through a ‘turnstile’ verification process that cryptographically ensures only legitimate ZEC tokens transition to the new pool. This post Zcash Developers Propose Ironwood Upgrade to Block Counterfeit ZEC After Orchard Vulnerability first appeared on BitcoinWorld .
8 Jun 2026, 09:45
ZEC jumps after Orchard fix, but is the worst really over now?
ZEC, the native coin of the Zcash ecosystem, is the best performer among the top 20 cryptocurrencies by market cap. The coin has bounced back by over 40% since dropping below $250 on Friday, following the Orchard bug report. The momentum indicators suggest that the bearish trend is fading, with the bulls now targeting the $500 psychological level. ZODL details a two-step emergency response to the Zero-Knowledge bug ZEC is outperforming the broader cryptocurrency market after adding 9% to its value in the last 24 hours. The rally comes after Josh Swihart, founder of Zcash Open Development Lab (ZODL), revealed new details on how the Zcash development team responded to a critical vulnerability in its Orchard shielded pool. In a post on X, Swihart said ZODL executed a coordinated two-stage emergency upgrade to contain the issue and prevent potential exploitation. https://twitter.com/jswihart/status/2063763238928671118 The first step involved a soft fork that temporarily disabled Orchard transactions, aiming to reduce the risk of exploitation while limiting public disclosure of the full vulnerability details. Swihart said this approach was designed to balance network security with responsible disclosure, ensuring the issue could be contained without exposing sensitive technical weaknesses. Orchard is Zcash’s primary shielded transaction pool, enabling fully private transfers using zero-knowledge proofs that conceal transaction details while still validating their legitimacy. A second upgrade, referred to as NU6.2, was activated on June 3 to address the root cause of the vulnerability and restore Orchard functionality. The update re-enabled shielded transactions after the underlying issue was resolved, according to Swihart. He also noted that mining pools and infrastructure operators, including ViaBTC and Foundry, played a key role in coordinating the emergency response and reviewing the updated code. This latest development comes after a disclosure from independent support group Shielded Labs, which reported a severe flaw in the Orchard pool that could have allowed unlimited minting of counterfeit Zcash tokens. The report resulted in ZEC losing nearly 60% of its value, dropping from $644 on Wednesday to $248 by Friday. Although the vulnerability was fixed before any confirmed exploitation, the revelation triggered significant concern across the crypto community about the protocol’s security guarantees. ZEC eyes the $500 psychological level The ZEC/USD 4-hour remains bearish despite the recent recovery. At press time, ZEC is trading above $420, up by roughly 9% in the last 24-hours. ZEC is now trading above its 200-day EMA at $364, while hovering around its 100-day Exponential Moving Average (EMA) at $428. If the bullish recovery continues and ZEC closes above the $428 level, it could extend its recovery towards the 50-day EMA at $485, followed by the $500 psychological threshold. The Relative Strength Index (RSI) near 50 on the 4-hour chart indicates a declining bearish momentum, while the negative Moving Average Convergence Divergence (MACD) falls below its zero line as the bearish profile expands. However, if the bearish trend resumes, the sellers would encounter immediate support around the $364 region. The post ZEC jumps after Orchard fix, but is the worst really over now? appeared first on Invezz
8 Jun 2026, 08:06
Can ZCash survive supply scare that crashed ZEC 53%?
ZCash (ZEC) went through a turbulent week, losing up to 53% of its price at one point. As of June 7, ZEC recovered by up to 12%, trading at $435. After the exploit news, ZEC is still down a net 21% for the past week. ZEC is now closely watched for stability, as the ZCash protocol is still grappling with the recent discovery of an unauthorized minting bug. The loss of confidence caused not only short-term market panic, but also speculations on whether ZEC would go down to zero and become worthless. Questions were raised on the potential for other coins and tokens to have similar unauthorized supply, though so far, no similar exploits have been discovered. Who discovered the ZCash vulnerability? Security researcher Taylor Hornby discovered the Orchard shielded pool had a critical vulnerability that allowed for the creation of counterfeit ZEC. Hornby used AI to test Orchard Pool for vulnerabilities, alerting the ZCash Open Development Lab (ZODL). The team patched the vulnerability on June 2, but the announcement itself already caused panic on the market. The chief reason for this is that ZEC is a privacy asset, and the real supply and ownership cannot be audited. Reportedly, the vulnerability existed for around four years, and there is still no proof whether the vulnerability was exploited. Is the Orchard pool safe? ZEC remains a mined coin, and the exploit is linked strictly to the creation of new coins within the Orchard pool. Currently, the total supply of ZEC is not affected, with a total of 16,755,823 coins in circulation. Within the Orchard pool, ZEC can be moved with the highest level of confidentiality. The counterparties and the transactions are not transparent, so there is no way to tell if any of the users were affected. As Cryptopolitan reported , in early 2026, a ZEC whale unshielded 202K ZEC in a single transaction, taking away 1% of the Orchard pool. There is still no way to prove if the ZEC within Orchard is all coming from externa deposits, or a bad actor still managed to withdraw some of the coins into the wider ZEC network. Over the past year, the Orchard pool was also mentioned by influencers as a true privacy hub in crypto, encouraging the deposits of nearly 5M ZEC. Based on the potential exploit, some of those coins are suspected to be counterfeit. The Orchard pool doubled its ZEC supply in the past year, with only a handful of withdrawals. There is still no way to prove if counterfeit ZEC was created, as the pool shields all transactions. | Source: ZCash Info Orchard was one of the key narratives around ZCash during its record 2026 rally, with encouragement to make deposits. The pool quickly turned into the biggest shielded hub for ZEC. In the past year, the Orchard pool doubled its supply of locked coins. In the week after the vulnerability was discovered, ZCash was still considered risky. ThorChain decided to delay its ZEC integration until the protocol ensured no significant supply of fake ZEC exists. ZCash team introduces the Ironwood supply verification Following the Orchard pool announcement, the ZCash team looked for ways to prove the circulating supply does not contain counterfeit coins. The Ironwood verification system will allow users to ensure the supply of ZEC is correct. For now, Ironwood is still in the proposal stage, expecting activation after a vote. All users that run a ZCash node would be able to verify the current supply and be assured it corresponds to the expected mining schedule. The old Orchard pool will be replaced by a new one, where all users will be subject to turnstile accounting . In this way, even if some ZEC was created on the old Orchard pool, it could not cross into the new one. If you're reading this, you’re already ahead. Stay there with our newsletter .
8 Jun 2026, 08:00
AI Audit Finds Zcash Orchard Bug; THORChain Integration Delayed
Zcash security researcher Taylor Hornby discovered a critical four-year-old vulnerability in the Orchard shielded pool on May 29 using an AI-assisted audit; an emergency hard fork (NU6.2) fixed it by June 3. THORChain, still offline following a separate $10.7M exploit, had planned ZEC as its next chain integration.
8 Jun 2026, 07:51
SYS Drops 20% After 5B Unauthorized Tokens Minted in Syscoin Bridge Exploit
An attacker exploited a validation flaw in Syscoin’s bridge system, minting about 5 billion SYS tokens without authorization and sending the token’s price into a nearly 20% freefall. This incident was revealed by the Syscoin team in an early postmortem published on X, and it comes during a tough stretch for SYS, which was already deeply in the red across the last few weeks and months. What Happened According to Syscoin’s postmortem, the attacker exploited a validation issue in the bridge relay path, which incorrectly accepted or interpreted a transaction proof. That error caused the system to treat a fraudulent transaction as valid and create an unauthorized output of approximately 5 billion SYS, then valued at just under $10 million. Per the Syscoin team, the stolen funds were sent to the address sys1qgaelv…9wvcw and then split across two other wallets, one holding about 4 billion SYS and the other the remaining 1 billion. Syscoin immediately paused the bridge and has since contacted exchanges and ecosystem partners asking them to blacklist or freeze any deposits connected to the tainted UTXO trail and its downstream transactions. The team also said that it had identified the affected validation path and had put in place a fix pending security review and implementation. According to blockchain analytics account Hupzy, operated by Spot On Chain, the incident was a recurring structural problem. It also noted that while blacklisting by exchanges may contain the secondary damage, the reputational hit to the bridge model will persist. A Token Already Under Pressure The exploit couldn’t have landed at a worse time for SYS holders, considering that when it happened, the token was already down more than 43% in seven days and over 82% in the last month. A lot of that longer-term decline was already in motion after Binance delisted SYS last month alongside four other tokens following a review of its listing standards. Shortly after the delisting news broke, the Syscoin community responded by pulling well over 300 million SYS from the exchange, with over 600 new nodes reportedly added to the network. The attack on the Syscoin bridge is the latest in a string of cross-chain security incidents that have kept DeFi on edge. They include an $11 million exploit on the Verus network in May and the draining of $7.3 million from more than 1,400 DxSale liquidity pools on the BNB Chain. Luckily for Verus, the hacker later returned about $8.5 million, keeping $2.8 million for themselves as a white-hat bounty. The post SYS Drops 20% After 5B Unauthorized Tokens Minted in Syscoin Bridge Exploit appeared first on CryptoPotato .
