The Zcash Foundation successfully patched a critical bug in its Orchashielded pool through an emergency Zebra upgrade. According to reports, the fix arrived through an emergency soft fork at block height 3,363,426 using Zebra 4.5.3, which disabled Orchard transactions to mitigate exploit risks without revealing the full scope of the issue. A follow-up hard fork (NU6.2) was activated on June 3 with Zebra 5.0.0, addressing the underlying vulnerability and re-enabling Orchard transactions. As per ZODL founder Josh Swihart, this represents the second security-driven protocol upgrade in Zcash history since launch in 2016, demonstrating the network's ability to respond quickly to critical vulnerabilities. The Foundation caught the flaw before any known exploitation occurred, and both releases were shipped within days of discovery.
The flaw was discovered in the Orchard Action circuit, the zero-knowledge system behind Zcash's newest privacy pool. According to ZODL, the vulnerability was a soundness bug in the Orchard shielded pool implementation of the halo2_gadgets crate, where successful exploitation could have allowed invalid state transitions inside Orchard, potentially affecting accounting guarantees for the pool. The bug was found by independent security researcher Taylor Hornby during ongoing Orchard security audit work supported by Shielded Labs on May 29. The vulnerability, undetected since 2022, could have let an attacker create unlimited fake ZEC without anyone noticing and withdraw tokens from the protocol's shielded pool. The bug was fixed by independent support group Shielded Labs, and it is unlikely that an actual exploit took place according to their disclosure. The Orchard circuit is a zero-knowledge proof system that verifies only valid transactions are included.
On June 6, the same groups that patched the bug - including Shielded Labs, the Zcash Foundation, and the Zcash Open Development Lab - proposed Ironwood, a comprehensive plan to restore user confidence in Zcash's supply integrity. Ironwood would create a new privacy pool using the repaired code and block the creation of new coins in the old Orchard pool. Once it activates, anyone running Zcash software could add up the balances across pools and confirm that no more than the correct amount of ZEC exists, eliminating the need to trust developers' word or wait for funds to migrate. The proposal has drawn attention beyond the Zcash community, with investor Chamath Palihapitiya describing Ironwood as a way for anyone running a node to tally the balances across pools and "verify the supply is clean." The plan could also reveal whether the bug was ever abused, as users move coins out of the old pool, any counterfeit ZEC would either be exposed when it tried to leave or be stranded and destroyed. However, developers have not given a firm timeline for the upgrade, saying the work to build, test and coordinate it across the network could take longer than expected.
Reports claimed Zcash had stopped producing blocks for hours during the upgrade process. According to market data, several explorers showed the chain stuck near height 3,364,601 during the upgrade window, with social posts amplifying the confusion. However, the halt was only apparent - mining pools continued producing blocks under the new rules while lagging explorers resynced. The Orchard transactions were suspended for about 24 hours during the rollout, as reported by ZODL. By midday on June 3, most explorers had caught up to the upgraded consensus. The emergency network upgrades were coordinated with mining pools ViaBTC and Foundry, ensuring broad community participation in the fix implementation. The Foundation urged every node operator to upgrade to 5.0.0 to complete the transition, with private coordination beginning on May 31 and updated software distributed on June 1.
Despite the network disruption, Zcash (ZEC) climbed about 45% from last week's low near $300 to trade around $437 on Monday, according to CoinDesk data, representing a 41.5% recovery from the June 5 low of $303. The token remains down roughly 22% over the week following the initial sell-off triggered by the vulnerability disclosure. ZEC's market value sits near $9.9 billion, placing it around 13th by capitalization in the crypto market. The strength aligns with a wider rotation into privacy assets that has lifted the token in recent months. During the upgrade, ZEC held on exchanges remained tradable, ensuring liquidity remained available throughout the network disruption. However, the vulnerability disclosure had initially triggered a more than 50% plunge from around $630 to a low of roughly $303, with many traders questioning the protocol's long-term security.
