Zcash Fixes Orchard Zero-Knowledge Proof Flaw in Emergency Hard Fork to Avert Double-Spend Crisis

Orchard is the privacy transaction pool introduced by Zcash through its NU5 upgrade on May 31, 2022. It uses zero-knowledge proofs to conceal transaction details. A soundness flaw in its proof circuit could have allowed attackers to counterfeit ZEC or double-spend it. The system's privacy design would make a complete retrospective audit difficult, threatening confidence in the 21 million-coin supply cap and the market.

Researcher Taylor Hornby discovered the flaw on May 29, 2026, prompting ZODL and the Zcash Foundation to coordinate an immediate fix. Zebra 4.5.3 first disabled Orchard at block 3,363,426 on June 2. Zebra 5.0.0 then activated the NU6.2 hard fork at block 3,364,600 on June 3, restoring transactions. Officials said they found no unauthorized issuance, loss of funds or privacy breach.