A critical security vulnerability in the Zcash network that could have allowed malicious actors to drain approximately 25,424 ZEC (worth about $6.5 million) from its legacy Sprout shielded pool has been successfully patched. The flaw, discovered by security researcher Alex "Scalar" Sol on March 23, 2026, involved a bypass of proof verification for transactions in the deprecated Sprout pool within the zcashd node software.
The vulnerability affected releases from July 2020 onward and was not exploited. Zcash developers released an emergency patch, version v6.12.0, on Tuesday, March 31, 2026. Major mining pools, including Luxor, F2Pool, ViaBTC, and AntPool, deployed the fix within three days, with Luxor confirming deployment on March 25 and the others by March 26.
The researcher, who used AI assistance to discover the flaw, reported it to Shielded Labs. The organization coordinated with the Zcash Open Development Lab (ZODL), where engineer Jack "str4d" Grigg authored the corrective patch. For his responsible disclosure, Sol will receive a 200 ZEC bounty (valued above $51,000), contributed by Shielded Labs, ZODL, the Zcash Foundation, and Bootstrap.
The Sprout pool, Zcash's original shielded transaction system, was closed to new deposits in November 2020 but still held funds that users had not yet migrated to newer pool versions like Sapling. The Zcash Open Development Team emphasized that the network's "turnstile" mechanism—which requires verifiable proof that coins leaving the Sprout pool originally entered it—would have prevented broader supply inflation even if the pool had been compromised.
The Zebra full node implementation was not affected by this bug and would have triggered a chain fork if an exploitation attempt had been made, providing an additional layer of network protection. This incident follows a previous major vulnerability patched in 2019, described as an "infinite counterfeit" crypto generator.
Following the news, ZEC was the top gainer among the top 100 cryptocurrencies by market cap over a 24-hour period, rising more than 14% to a price above $255.
