Zcash Fixes Orchard Zero-Knowledge Proof Flaw in Emergency Hard Fork to Avert Double-Spend Crisis
Orchard is the privacy transaction pool introduced by Zcash through its NU5 upgrade on May 31, 2022. It uses zero-knowledge proofs to conceal transaction details. A soundness flaw in its proof circuit could have allowed attackers to counterfeit ZEC or double-spend it. The system's privacy design would make a complete retrospective audit difficult, threatening confidence in the 21 million-coin supply cap and the market.
Researcher Taylor Hornby discovered the flaw on May 29, 2026, prompting ZODL and the Zcash Foundation to coordinate an immediate fix. Zebra 4.5.3 first disabled Orchard at block 3,363,426 on June 2. Zebra 5.0.0 then activated the NU6.2 hard fork at block 3,364,600 on June 3, restoring transactions. Officials said they found no unauthorized issuance, loss of funds or privacy breach.
All Coverage
12 original reportsThe Backstory
The history behind this eventZcash Activates Ironwood Upgrade to Close Counterfeiting Flaw
Zcash, a cryptocurrency designed to shield transaction details, faced a crisis of confidence after researchers identified a vulnerability in its Orchard privacy pool that could have allowed unlimited counterfeit ZEC to be created without detection. The Ironwood upgrade, also known as NU6.3, was developed to restore trustless verification of the cryptocurrency’s supply while preserving privacy for shielded transactions.
Zcash activated Ironwood on July 28, sealing the Orchard pool, which held about $1.7 billion, and launching a new shielded pool backed by on-chain accounting checkpoints. Developers said formal verification covered 2,700 theorems and showed the new proof rules prevent undetectable counterfeiting. Most holders can move their funds through a one-click migration offered by compatible wallets.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.
If you search news on Google, you can set Mark Radar as a preferred source—our coverage will show up more often in your results. Set as preferred source on Google →