← Zcash Orchard Pool Counterfeiting Bugreviewed 2026-09-06 · 49 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Zcash Orchard Pool Counterfeiting Bug against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
4 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #5[disputed][awaiting moderator]in the summary
“ZEC fell approximately 38% on public disclosure on June 5, 2026.”
reviewerZEC fell approximately 38% on public disclosure on June 5, 2026.The primary disclosure (Zcash Community Forum post) is dated June 4, 2026, and the cited Decrypt article's own body text places the price crash on 'Thursday' following a 'Wednesday' high, consistent with June 3/June 4, not June 5. News articles carrying a June 5 dateline appear to report on the prior day's (June 4) event.Proposed correction (not yet applied)ZEC fell approximately 38% on public disclosure on June 4, 2026. - #29[disputed][awaiting moderator]in section: Market impact
“ZEC traded near a local high of approximately $635 on June 4, 2026.”
reviewerZEC traded near a local high of approximately $635 on June 4, 2026.The $635 figure is correct but the cited source attributes it to Wednesday, June 3, not June 4.Proposed correction (not yet applied)ZEC traded near a local high of approximately $635 on June 3, 2026. - #30[disputed][awaiting moderator]in section: Market impact
“Following Shielded Labs' public disclosure on the evening of June 5, the price fell sharply to an intraday low of approximately $309, a decline of roughly 38%.”
reviewerFollowing Shielded Labs' public disclosure on the evening of June 5, the price fell to an intraday low of approximately $309, a decline of roughly 38%.Same underlying date error as the summary and timeline; the $309 figure and 38% decline are correct, only the date is off by one day.Proposed correction (not yet applied)Following Shielded Labs' public disclosure on the evening of June 4, the price fell sharply to an intraday low of approximately $309, a decline of roughly 38%. - #48[disputed][awaiting moderator]in the timeline
“Shielded Labs publishes full public disclosure of the vulnerability. ZEC price falls approximately 38%, from roughly $635 to an intraday low of $309. Arthur Hayes liquidates his entire ZEC position. Trading volume drops approximately 57%.”
reviewerShielded Labs publishes full public disclosure on 2026-06-05; ZEC falls ~38% from $635 to $309; Hayes liquidates; volume drops 57%.The stored date field '2026-06-05' should be '2026-06-04'; the event content (price/percentages/Hayes/volume) is otherwise accurate, only the date field is off by one day. This is the timeline occurrence of the same defect flagged in the summary and Market Impact section.Proposed correction (not yet applied)2026-06-04
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #39[unverifiable][awaiting moderator]in section: Investor and commentator reactions
“ZODL confirmed it would expand ongoing security partnerships.”
reviewerZODL confirmed it would expand ongoing security partnerships.Plausible given the broader post-incident hiring push, but no source was found attributing this specific commitment to ZODL.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #28[stale][awaiting moderator]in section: Exploitation status and supply integrity
“Shielded Labs has proposed a future network upgrade to deploy a new shielded pool with enhanced turnstile accounting for Orchard coins, requiring all coins to unshield before entering the new pool, which would allow supply integrity to be independently verified going forward.”
reviewerShielded Labs has proposed a future network upgrade to deploy a new shielded pool with enhanced turnstile accounting, requiring coins to unshield before entering.This was accurate at the time of the original proposal but is now superseded: Ironwood has already launched on mainnet.Proposed correction (not yet applied)Shielded Labs proposed a new shielded pool with enhanced turnstile accounting for Orchard coins, requiring all coins to unshield before entering the new pool; this upgrade, named Ironwood, activated on Zcash mainnet on July 28, 2026, allowing supply integrity to be independently verified going forward. - #38[stale][awaiting moderator]in section: Investor and commentator reactions
“In the wake of the disclosure, Shielded Labs announced several forward-looking measures: deployment of a new shielded pool (referred to in some reports as Ironwood) with turnstile accounting enforced at migration, enabling independent supply verification; formal verification projects for mathematical proof systems to reduce reliance on manual auditing; and plans to hire a Head of Security and a dedicated Cryptographer.”
reviewerShielded Labs announced forward-looking measures including a new pool (Ironwood), formal verification projects, and plans to hire a Head of Security and Cryptographer.Same underlying staleness as the Ironwood mention in the Exploitation Status section; Ironwood is no longer just a rumored name for a proposed pool, it is a launched upgrade.Proposed correction (not yet applied)In the wake of the disclosure, Shielded Labs announced several forward-looking measures: deployment of a new shielded pool, named Ironwood, with turnstile accounting enforced at migration, enabling independent supply verification — Ironwood activated on Zcash mainnet on July 28, 2026; formal verification projects for mathematical proof systems to reduce reliance on manual auditing; and plans to hire a Head of Security and a dedicated Cryptographer.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in section: Vulnerability description
“The bug was present in all halo2_gadgets versions prior to v0.5.0, all orchard crate versions prior to v0.14.0, zcashd v5.0.0 through v6.12.3, and all zebrad versions below v4.5.1.”
reviewerAffected versions were halo2_gadgets <v0.5.0, orchard <v0.14.0, zcashd v5.0.0-v6.12.3, zebrad <v4.5.1.All listed version ranges are correct, but the page omits zcash_primitives (<v0.28.0), which the primary source also names as affected. - #35[partially supported][awaiting moderator]in section: Investor and commentator reactions
“Zcash development at the time of the incident was organized under the Zcash Open Development Lab (ZODL), with Shielded Labs leading the engagement of external security researchers.”
reviewerZcash development at the time of the incident was organized under ZODL, with Shielded Labs leading engagement of external security researchers.Overstates ZODL's centrality; contemporaneous sources describe several independent organizations collaborating rather than a single body ('ZODL') under which development was organized.
confirmed
40 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“In May 2026, independent security researcher Taylor Hornby discovered a critical soundness vulnerability in the Zcash Orchard shielded pool's zero-knowledge proof circuit that had existed since the pool's launch in May 2022.”
reviewerTaylor Hornby discovered a soundness vulnerability in the Orchard shielded pool's ZK circuit in May 2026, present since the pool's May 2022 launch.Corroborated by the official ZFND post, the community forum disclosure, and multiple independent news outlets. - #2[confirmed][no action needed]in the summary
“The flaw — an under-constrained elliptic-curve multiplication gadget in the halo2_gadgets crate — could theoretically have allowed unlimited undetectable counterfeit ZEC creation within the Orchard pool, though it could not inflate total ZEC supply due to the turnstile mechanism.”
reviewerThe flaw was an under-constrained elliptic-curve multiplication gadget in halo2_gadgets that could allow unlimited undetectable counterfeit ZEC within Orchard but not inflate total supply, due to the turnstile.Matches the official description almost verbatim. - #3[confirmed][no action needed]in the summary
“The Zcash Open Development Lab coordinated an emergency two-phase response within 50 hours: a soft fork on June 2 disabling Orchard transactions, followed by the NU6.2 hard fork on June 3 deploying the corrected circuit.”
reviewerZODL coordinated an emergency two-phase response within 50 hours: a soft fork June 2 and NU6.2 hard fork June 3.Dates and 50-hour window confirmed by both the official ZFND post and the CryptoTimes reconstruction. - #4[confirmed][no action needed]in the summary
“No exploitation has been confirmed, though the privacy properties of the Orchard pool make definitive confirmation impossible.”
reviewerNo exploitation has been confirmed, and Orchard's privacy properties make definitive confirmation impossible.Directly corroborated by primary source language. - #6[confirmed][no action needed]in section: Vulnerability description
“The vulnerability was a soundness bug in the implementation of the Orchard zero-knowledge proof circuit, specifically residing in two lines of code within the halo2_gadgets crate.”
reviewerThe bug was a two-line soundness bug in halo2_gadgets.Confirmed by both official and press accounts. - #7[confirmed][no action needed]in section: Vulnerability description
“Technically, the flaw involved an under-constrained variable-base scalar multiplication gadget: because the elliptic-curve multiplication check was insufficiently constrained, an attacker could supply arbitrary false inputs to the check and still have it pass validation.”
reviewerThe flaw was an under-constrained variable-base scalar multiplication gadget allowing arbitrary false inputs to pass validation.Technical description matches independent security-firm analysis. - #9[confirmed][no action needed]in section: Discovery and AI-assisted audit
“The vulnerability was discovered on May 29, 2026 by Taylor Hornby, an independent security engineer engaged by Shielded Labs in April 2026 to conduct a targeted protocol audit.”
reviewerVulnerability discovered May 29, 2026 by Taylor Hornby, independent security engineer engaged by Shielded Labs in April 2026 for a targeted protocol audit.Confirmed by the engagement announcement and subsequent reporting. - #10[confirmed][no action needed]in section: Discovery and AI-assisted audit
“Hornby used Anthropic's Opus 4.8 AI model as part of an AI-assisted review of the Orchard circuit to identify potential cryptographic weaknesses.”
reviewerHornby used Anthropic's Opus 4.8 model as part of an AI-assisted review of the Orchard circuit.Multiple independent outlets confirm the Opus 4.8 model was used, released the day before Hornby's discovery. - #11[confirmed][no action needed]in section: Discovery and AI-assisted audit
“Hornby successfully wrote a complete proof-of-concept exploit which, when tested in a local environment, generated unlimited, undetectable counterfeit ZEC.”
reviewerHornby wrote a complete proof-of-concept exploit that generated unlimited undetectable counterfeit ZEC in local testing.Language matches independent reporting closely. - #12[confirmed][no action needed]in section: Discovery and AI-assisted audit
“Hornby responsibly disclosed the vulnerability to a select group of cryptographically skilled engineers at ZODL (Zcash Open Development Lab) on May 29.”
reviewerHornby responsibly disclosed the vulnerability to a select group of ZODL engineers on May 29.Confirmed nearly verbatim by the cited source. - #13[confirmed][no action needed]in section: Discovery and AI-assisted audit
“ZODL engineers Daira-Emma Hopwood, Kris Nuttycombe, and Jack Grigg (Str4d) confirmed the issue and began coordinating remediation within hours.”
reviewerZODL engineers Hopwood, Nuttycombe, and Grigg (Str4d) confirmed the issue and began coordinating remediation within hours.Personnel and org affiliation confirmed by independent search of ZODL's own published incident writeups. - #14[confirmed][no action needed]in section: Discovery and AI-assisted audit
“Josh Swihart, ZODL executive, was alerted via Signal on May 30 and joined a secure video conference to coordinate the emergency response.”
reviewerJosh Swihart, ZODL executive, was alerted via Signal on May 30 and joined a secure video conference.Matches cited source; article specifies a Signal call from Hopwood rather than a general Signal alert, a minor immaterial detail. - #15[confirmed][no action needed]in section: Discovery and AI-assisted audit
“The vulnerability had survived multiple rounds of expert human security auditing over four years since Orchard's May 2022 launch before being identified through this AI-assisted methodology.”
reviewerThe vulnerability survived multiple rounds of expert human security auditing over four years before being found via AI-assisted methodology.Corroborated by an independent security-firm analysis and evidence of prior third-party cryptography review. - #16[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“Phase one was a soft fork that activated on June 2, 2026 at approximately 02:00 UTC at mainnet block height 3,363,426, disabling all Orchard-containing transactions to prevent any potential exploitation while the circuit fix was finalized.”
reviewerSoft fork activated June 2, 2026 ~02:00 UTC at block height 3,363,426, disabling all Orchard-containing transactions.Confirmed by the primary official source. - #17[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“The team deliberately chose not to issue a direct circuit patch in the first phase because doing so would have revealed the vulnerability's specifics before miners and node operators had time to upgrade.”
reviewerThe team chose a soft fork first rather than a direct patch to avoid revealing the vulnerability before miners/node operators upgraded.Matches the cited source's explanation of the mitigation strategy. - #18[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“The initial two-hour activation window proved insufficient and was extended after coordination with major mining pools ViaBTC and Foundry.”
reviewerThe initial two-hour activation window proved insufficient and was extended after coordination with ViaBTC and Foundry.Consistent with the cited source, though the source does not use the specific figure 'two-hour window' verbatim; the delay and mining-pool names are confirmed. - #19[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“A significant 25-block chain reorganization occurred during the soft fork period but resolved in favor of the patched chain.”
reviewerA 25-block chain reorganization occurred during the soft fork period but resolved in favor of the patched chain.The official source's 'no chain split' language and the secondary source's '25-block reorg' are compatible: a reorg that resolves is not the same as a persistent chain split. - #20[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“Phase two was the NU6.2 hard fork, which activated on June 3, 2026 at 00:05 EDT at mainnet block height 3,364,600.”
reviewerNU6.2 hard fork activated June 3, 2026 at 00:05 EDT at block height 3,364,600, re-enabling Orchard with corrected circuit and a new consensus rule against non-canonical proof sizes.Confirmed by the primary official source. - #21[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“Patched software versions included Zebra 5.0.0, halo2_gadgets v0.5.0, orchard v0.14.0, and zcashd v6.12.5.”
reviewerPatched software versions included Zebra 5.0.0, halo2_gadgets v0.5.0, orchard v0.14.0, and zcashd v6.12.5.Version numbers confirmed via the official release information. - #22[confirmed][no action needed]in section: Emergency response: soft fork and NU6.2 hard fork
“Sapling and transparent transactions were unaffected throughout the incident.”
reviewerSapling and transparent transactions were unaffected throughout the incident.Consistent with the official description of the soft fork's narrow scope, though not stated as a standalone sentence in the source. - #23[confirmed][no action needed]in section: Exploitation status and supply integrity
“Zcash's turnstile mechanism, an accounting layer that tracks the total value flow across all transaction pools, confirmed that total ZEC supply remained intact and no unauthorized value creation occurred in the transparent accounting sense.”
reviewerThe turnstile mechanism confirmed total ZEC supply remained intact and no unauthorized value creation occurred.Confirmed. - #24[confirmed][no action needed]in section: Exploitation status and supply integrity
“The Zcash Foundation stated the vulnerability was 'caught before any known exploitation occurred' with 'no evidence of unauthorized value creation.'”
reviewerThe Zcash Foundation stated the vulnerability was 'caught before any known exploitation occurred' with 'no evidence of unauthorized value creation.'Exact quote confirmed. - #25[confirmed][no action needed]in section: Exploitation status and supply integrity
“However, both Shielded Labs and the Zcash Foundation acknowledged a fundamental epistemic limitation: due to the privacy properties of the Orchard pool and the nature of the soundness flaw, there is no definitive cryptographic method to determine whether exploitation occurred during the four-year window (May 2022 to June 2026) before the patch.”
reviewerThere is no definitive cryptographic method to determine whether exploitation occurred during the four-year window before the patch.Near-verbatim match to the primary source. - #26[confirmed][no action needed]in section: Exploitation status and supply integrity
“Zooko Wilcox stated the vulnerability 'could have been exploited to undetectably create an unlimited amount of counterfeit ZEC within Orchard' but noted there is 'no way to cryptographically prove whether the vulnerability was exploited before it was remediated.'”
reviewerZooko Wilcox stated the vulnerability could have created unlimited counterfeit ZEC undetectably and that exploitation cannot be cryptographically ruled out.Both quoted fragments were independently found reproduced verbatim in press coverage. - #27[confirmed][no action needed]in section: Exploitation status and supply integrity
“Grayscale CLO Craig Salm publicly argued exploitation was unlikely, citing the improbability that a threat actor would discover the obscure cryptographic flaw while choosing not to drain the pool during a bull market.”
reviewerGrayscale CLO Craig Salm publicly argued exploitation was unlikely.Both the substance and Salm's title as Grayscale's Chief Legal Officer are confirmed. - #31[confirmed][no action needed]in section: Market impact
“Trading volume dropped approximately 57% as liquidity evaporated around the disclosure.”
reviewerTrading volume dropped approximately 57% as liquidity evaporated around the disclosure.Confirmed nearly verbatim by the cited source. - #32[confirmed][no action needed]in section: Market impact
“Notable market participant Arthur Hayes, former CEO of BitMEX and a publicly known ZEC holder, liquidated his entire ZEC position in response to the disclosure.”
reviewerArthur Hayes, former CEO of BitMEX, liquidated his entire ZEC position in response to the disclosure.The directly cited coinlaw.io URL returned a 403 on fetch, but the claim is corroborated by multiple other independent outlets. - #33[confirmed][no action needed]in section: Market impact
“Some cryptocurrency exchanges temporarily suspended ZEC deposits and withdrawals during the soft fork window.”
reviewerSome cryptocurrency exchanges temporarily suspended ZEC deposits and withdrawals during the soft fork window.Generic confirmation of exchange behavior during the fork window; the page does not name specific exchanges. - #34[confirmed][no action needed]in section: Market impact
“Post-patch, ZEC showed partial recovery of over 10% as the network resumed normal Orchard operations and the absence of evidence of exploitation was emphasized by ZODL and the Zcash Foundation.”
reviewerPost-patch, ZEC showed partial recovery of over 10%.Confirmed by the cited source. - #36[confirmed][no action needed]in section: Investor and commentator reactions
“The incident represented the second security-driven emergency protocol upgrade in Zcash's history since its 2016 launch.”
reviewerThe incident represented the second security-driven emergency protocol upgrade in Zcash's history since its 2016 launch.This exact framing is echoed near-verbatim across multiple independent secondary sources. It is defensible but slightly imprecise: the 2019 fix rode on a pre-scheduled upgrade rather than triggering its own unscheduled emergency fork, unlike NU6.2. - #37[confirmed][no action needed]in section: Investor and commentator reactions
“Key remediation engineers included Daira-Emma Hopwood (ZODL protocol R&D head), Kris Nuttycombe, Jack Grigg (Str4d), and Arya Solhi (Zcash Foundation), with Josh Swihart (ZODL executive) coordinating the operational response.”
reviewerKey remediation engineers included Hopwood, Nuttycombe, Grigg, and Solhi, with Swihart coordinating the operational response.All names, titles, and org affiliations confirmed. - #40[confirmed][no action needed]in section: Investor and commentator reactions
“The incident drew significant attention to the use of AI-assisted auditing tools in cryptographic circuit review, as the vulnerability had evaded expert human review for four years before being surfaced through AI-assisted analysis.”
reviewerThe incident drew attention to AI-assisted auditing tools in cryptographic circuit review, as the bug evaded expert human review for four years.Widely covered angle across many independent outlets. - #41[confirmed][no action needed]in the timeline
“Zcash Orchard shielded pool launches, introducing the Halo 2 proving system. The soundness vulnerability in the halo2_gadgets crate is present from launch.”
reviewerZcash Orchard shielded pool launched in May 2022, introducing Halo 2; the soundness vulnerability was present from launch.Consistent with all other sources describing a four-year-old bug dating to Orchard's May 2022 activation. - #42[confirmed][no action needed]in the timeline
“Shielded Labs engages Taylor Hornby as an independent security engineer to conduct a targeted protocol audit of Zcash.”
reviewerShielded Labs engages Taylor Hornby in April 2026 for a targeted protocol audit.Confirmed by the engagement announcement thread. - #43[confirmed][no action needed]in the timeline
“Taylor Hornby, using AI-assisted analysis with Anthropic's Opus 4.8 model, discovers the critical soundness vulnerability in the Orchard circuit. He writes a complete proof-of-concept exploit generating unlimited counterfeit ZEC in local testing and responsibly discloses to ZODL engineers.”
reviewerHornby, using AI-assisted analysis with Opus 4.8, discovers the vulnerability on May 29, 2026, writes a PoC, and discloses to ZODL.Consistent with prior findings on this event. - #44[confirmed][no action needed]in the timeline
“ZODL engineers Daira-Emma Hopwood, Kris Nuttycombe, and Jack Grigg confirm the vulnerability. ZODL executive Josh Swihart is alerted and joins secure coordination call. Emergency response planning begins.”
reviewerZODL engineers confirm the vulnerability May 30; Swihart alerted and joins coordination call.Consistent with prior findings. - #45[confirmed][no action needed]in the timeline
“Emergency soft fork activation is planned but delayed due to insufficient miner deployment time. Coordination with mining pools ViaBTC and Foundry continues.”
reviewerEmergency soft fork activation planned but delayed due to insufficient miner deployment time; coordination with ViaBTC and Foundry continues.Confirmed. - #46[confirmed][no action needed]in the timeline
“Emergency soft fork activates at approximately 02:00 UTC at mainnet block height 3,363,426, disabling all Orchard-containing transactions. A 25-block chain reorganization occurs but resolves in favor of the patched chain.”
reviewerEmergency soft fork activates June 2 at ~02:00 UTC at block 3,363,426; 25-block reorg occurs but resolves in favor of the patched chain.Consistent with prior finding on the reorg claim. - #47[confirmed][no action needed]in the timeline
“NU6.2 hard fork activates at 00:05 EDT at mainnet block height 3,364,600. The corrected Orchard circuit is deployed via Zebra 5.0.0. Orchard transactions are re-enabled. Testnet NU6.2 activates at block height 4,052,000.”
reviewerNU6.2 hard fork activates June 3 at 00:05 EDT at block 3,364,600; corrected circuit via Zebra 5.0.0; testnet activates at block 4,052,000.All figures independently confirmed. - #49[confirmed][no action needed]in the timeline
“Detailed post-mortem published covering the 50-hour response timeline, personnel involved, technical decisions made during the emergency, and plans for Ironwood (a new shielded pool with enhanced supply verification).”
reviewerDetailed post-mortem published June 8, 2026 covering the 50-hour response, personnel, technical decisions, and Ironwood plans.Matches the cited article's publish date and content.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.