The Zcash Foundation disclosed that its team has completed an emergency network upgrade to fix a critical vulnerability in the Orchard privacy pool. This issue could have allowed attackers to spend non-existent funds, but the foundation stated that there is no evidence the vulnerability was exploited, and the total ZEC supply was unaffected.
The vulnerability was discovered on May 29.
The issue was discovered on May 29 by independent security researcher Taylor Hornby and is located in the Orchard Action circuit. Orchard is a newer privacy pool in Zcash, launched in 2022, and is one of the core components of its privacy architecture.
The researchers submitted the issue to engineers at the Zcash Open Development Lab (ZODL) that evening. The development team subsequently confirmed the vulnerability and initiated a remediation process under confidentiality to prevent preemptive exploitation once the details were made public.
Disable transactions first, then complete the hard fork.
The fix process lasted approximately five days. The developers first implemented an emergency soft fork to temporarily disable Orchard trading, buying time for the final patch. On the evening of May 31st, the team began privately coordinating with miners and exchanges.
The initial activation attempt encountered deployment issues, but the second attempt completed early Monday morning, halting all Orchard activity at block height 3,363,426. Zcash subsequently released a full network upgrade on Wednesday called NU6.2, restoring Orchard functionality with corrected circuitry.
The official explanation is that a full network upgrade, rather than a regular software patch, was necessary because fixing the zero-knowledge proof system requires updating the encryption verification key, a change that cannot be accomplished with a regular patch.
The official statement says no new tokens have been issued.
Zcash stated that its built-in "turnstile" mechanism has confirmed that no new coins have been generated without authorization, therefore the total supply of ZEC is not at risk. ZODL founder Josh Swihart described this as one of the "most challenging" network upgrades in Zcash's history on social media.
The foundation also urged node operators to upgrade to Zebra 5.0.0 as soon as possible to enable the revised network rules. After the upgrade, some block explorers showed that the network had not produced any blocks for several hours, sparking speculation that there was a shutdown.
However, the block explorer operator and related personnel stated that the chain itself has been producing blocks normally, and the problem mainly occurred during the browser node upgrade and resynchronization phase, causing a temporary lag in front-end data.
ZEC continues its recent upward trend
Market performance has not yet been affected by this disclosure. According to reports, ZEC has risen more than 10% in the past 24 hours, with the price approaching $629, and has increased by more than 53% in the past 30 days.
Looking at a longer timeframe, ZEC has risen by more than 1084% over the past year. The token once rose to nearly $700 last fall and has recently approached that level again, but it is still below the all-time high of $3191 set in 2016.
