Opus 4.8 audit reveals Zcash Orchard counterfeiting bug

An audit using the Opus 4.8 model found a counterfeiting vulnerability in Zcash’s Orchard shielded pool, triggering an emergency software upgrade and a sharp market sell-off. ZEC fell more than 30% to an intraday low of $385.8 during early Asian trading, its weakest level since early May.

Researcher Taylor Hornby identified the flaw on May 29, 2026, after running a custom auditing agent framework with the Opus 4.8 model. Zcash developers deployed an emergency patch to close the vulnerability on June 2. The patch briefly lifted sentiment before selling pressure resumed.

Shielded Labs, the team that built Orchard, said the bug had existed since the pool launched in May 2022. In a public post, the group noted that “due to the privacy properties of Orchard and the nature of the bug, there is no definitive way to determine using only cryptography whether such exploitation occurred before the vulnerability was discovered and fixed.” The team added that exploitation before the patch appears unlikely but that it cannot cryptographically prove no exploitation happened.

To enable public verification of supply, Shielded Labs is developing a proposed network upgrade. The measures under consideration include adding a new shielded pool and enforcing turnstile accounting on coins leaving Orchard. The group plans to publish a detailed upgrade proposal next week. Any change would need approval through Zcash’s on-chain governance process before implementation.

The disclosure prompted immediate reactions from holders. Investor Arthur Hayes wrote on X that he sold his entire ZEC position, adding, “The Holy Trinity is dead. Sadly due to the Orchard Pool exploit, I had to dump our entire $ZEC bag.” Other commentators pointed to a prior undisclosed bug that damaged confidence in the project for an extended period.

The episode highlights a technical tension in Zcash’s design: the privacy features that hide transaction details also make it difficult to produce a public, cryptographic audit of total coin supply. Market participants are watching the forthcoming technical proposal and governance debate to see whether the team can introduce verifiable supply checks while retaining privacy features.