Zcash loses $3B after AI bug discovery

Zcash’s market value fell by more than $3 billion after the disclosure of a critical vulnerability that could theoretically have allowed attackers to create unlimited counterfeit ZEC tokens.

Security engineer Taylor Hornby discovered the flaw on May 29 while working with Shielded Labs and reported it to the Zcash Open Development Lab, which deployed an emergency hard fork on June 3 to patch the issue.

“If he had run the same tool on Zcash mainnet it would have generated unlimited, undetectable counterfeit ZEC in his mainnet Zcash wallet,”

The security researchers said.

The vulnerability affected Zcash’s Orchard shielded pool and allowed false inputs to bypass a cryptographic verification process designed to validate transactions.

Researchers said the primary concern is that Orchard’s privacy features make it impossible to cryptographically prove whether the exploit had been used before the patch was deployed.

The flaw was discovered during a targeted audit assisted by Anthropic’s Claude Opus 4.8 AI model, which helped analyse the cryptographic circuit underpinning the Orchard privacy pool.

Shielded Labs said it is working with Zcash developers on a future upgrade that would allow users to verify the integrity of the ZEC supply and demonstrate the absence of counterfeit tokens within the Orchard pool.

At the time of reporting, Zcash price was $390.65.