An anonymous wallet withdrew approximately 40,000 ZEC from Zcash's Orchard shielded pool, a move representing roughly 1% of the total funds held in that privacy layer. The withdrawal occurred just six days after the network disclosed a long-standing vulnerability that had existed in the Orchard circuit since its launch in May 2022. Arkham data shows the pool now holds 3.88 million ZEC, worth about $1.65 billion, as ZEC's price recovered nearly 70% from a low of $280 following the bug disclosure, now trading around $422.
The bug, a cryptographic flaw capable of allowing the creation of counterfeit ZEC without on-chain traces, was discovered by security researcher Taylor Hornby on May 29, aided by Anthropic's AI model Opus 4.8. Shielded Labs confirmed the vulnerability had been present for nearly four years, evading multiple expert reviews. While developers believe the exploit was never used on the production network, the nature of the shielded protocol makes it impossible to prove definitively.
In parallel, Zcash protocol teams are accelerating work on Ironwood, the network's upcoming major upgrade. Recent meetings have resolved key controversies, including the disabling of Orchard pool bundles in Coinbase transactions, improvements to hardware wallet migration, and a finalized order for ZIP specification approvals. Drafts for Ironwood circuits and ZIP-2005 integration are under review, with test environments already evaluating wallet functionality and network behavior.
Security remains paramount: multiple independent auditing firms are reviewing Orchard-related code, and AI-powered tools are scanning for vulnerabilities. Shielded Labs has proposed a new shielded pool via a chain upgrade, along with a turnstile accounting mechanism to verify ZEC supply authenticity. The organization is also expanding its formal verification program and hiring a security chief and cryptographer. Formal verification of the Ironwood SNARK system is a top community priority, with researchers coordinating a unified plan to mathematically validate the upgrade before deployment.
