The 2026 Zcash Orchard vulnerability explained
In late May 2026 a flaw was found in Zcash's Orchard shielded pool that, in theory, could have allowed undetected counterfeiting since May 2022. Orchard was frozen by a soft fork on 2 June and fixed by the NU6.2 hard fork on 3 June 2026; no exploitation was reported. Orchard became withdraw-only and the new Ironwood pool replaced it on 28 July 2026.
The Orchard bug was the most serious security event in Zcash's history. It did not, as far as anyone has shown, cost users money. But it froze the main shielded pool, crashed the price and forced the network to launch a new pool. This page sets out what happened, in order, and what it means for you.
Timeline
| Date (2026) | Event |
|---|---|
| 29 May | Security researcher Taylor Hornby finds an under-constrained check in the Orchard circuit (Decrypt). |
| 2 June | An emergency soft fork at block 3,363,426, at about 02:00 UTC, halts Orchard activity. Some US-dated reports give 1 June. |
| 3 June | The NU6.2 hard fork activates at block 3,364,600 and restores Orchard with a corrected circuit. |
| Early June | Public disclosure. ZEC falls from about $635 to $309 intraday; Decrypt reported a 38% drop and The Block a fall of more than 50%. |
| 9 June | The Ironwood plan is finalised: a new pool, Orchard restricted, a turnstile to bound supply (The Block). |
| 30 June | Sovright, a new non-profit, releases the Argos wallet recovery tool. |
| 28 July | NU6.3 activates Ironwood at block 3,428,143. Orchard becomes withdraw-only. |
| 10 September | About 88.2% of the Orchard balance has migrated (KuCoin). |
Dates of disclosure vary between sources from 1 to 5 June. We give the range rather than pick one.
What was wrong, in plain English
Every shielded spend comes with a zero-knowledge proof that the transaction balances: no value created, none destroyed. The proof is checked against a "circuit", a precise mathematical description of the rules. In Orchard, one step involving an elliptic-curve multiplication was under-constrained: the circuit did not pin down the result tightly enough. A sufficiently skilled attacker could, in theory, have produced a valid-looking proof for a transaction that created ZEC out of nothing.
Because Orchard balances are encrypted, such counterfeiting would not have shown up in normal block explorers. That is what made the bug serious. The flaw had been present since Orchard launched with NU5 on 31 May 2022 (Blockworks).
Was it exploited?
No evidence of exploitation was reported. But "no evidence" in an encrypted pool is weaker than in a public one, which is why developers did not stop at a patch. They designed Ironwood so that the question could be answered with arithmetic: every coin leaving Orchard passes through a public turnstile, and no more can leave than went in. If counterfeit coins existed, the pool would run out before all holders could withdraw.
At the time of the Ironwood article about 3.6 million ZEC was in Orchard (The Block, 28 Jul 2026). By 10 September 2026 about 88.2% of the Orchard balance had migrated with no shortfall reported.
What it means for you
- If you had ZEC in Orchard, it is still yours. Move it to Ironwood with an Ironwood-ready wallet: Orchard to Ironwood guide.
- If you hold Sapling or transparent ZEC, the bug did not affect those pools.
- If your ZEC is on an exchange, the exchange handles the migration. Check its notices.
- If your wallet is not Ironwood-ready, such as YWallet, restore your seed in a wallet that is. See YWallet to Zkool.
The migration reveals amounts leaving Orchard. Use your wallet's gradual migration and Tor if network privacy matters. Read Ironwood explained for the details.
Beware "migration help" scams
Every big network event brings scammers. Fake support accounts, "recovery" sites and fake web wallets ask for your seed phrase to "migrate" or "rescue" Orchard funds. No legitimate wallet or team needs your seed. A fake site titled "Zcash Web Wallet | Zodl" asking users to import their seed was flagged on 8 August 2026 (PhishDestroy). The real Zodl is a mobile app with no web version. See Zcash scams.
Lessons and open questions
- Turnstiles work as designed. Zcash's ability to count each pool's total value let the network bound the damage even without seeing balances.
- Formal verification matters. Ironwood is described as formally verified, a direct response to a bug that years of review missed.
- Privacy has a cost during emergencies. Migration made some amounts public for a period.
- Coordination held. Two forks in two days and a new pool within two months happened during a year in which the main development team also changed organisation.
Some details remain disputed between sources, including the exact soft-fork and disclosure dates and the size of the price fall. We will update this page if official post-mortems clarify them.
Frequently asked questions
Was any ZEC stolen in the Orchard bug?
No theft or counterfeiting was reported. The turnstile on the way out of Orchard is designed to reveal any counterfeit coins, and no shortfall had been reported by October 2026.
Is Orchard still usable?
Only for withdrawals. Since NU6.3 on 28 July 2026, Orchard accepts no new value and funds can leave only through the turnstile into Ironwood or other pools.
Who found the Orchard bug?
Decrypt reported that security researcher Taylor Hornby found the under-constrained check on 29 May 2026.
Why did the price fall so much?
A possible counterfeiting bug in a pool holding millions of ZEC raised the risk of hidden inflation. ZEC fell from about $635 to $309 intraday after disclosure, then recovered and passed $1,000 by September 2026.