Zcash has two publicly documented flaws that could have allowed fake ZEC. The first sat in the proving system of the original Sprout pool, was found in 2018, disclosed in February 2019 and removed by the Sapling upgrade. The second was a bug in the Orchard circuit, reported on May 29, 2026 and fixed by NU6.2. The 2019 post states no counterfeiting was found; the 2026 text we read is silent on it.
How to read this guide
Everything below comes from two primary sources: Electric Coin Company's 2019 disclosure and ZIP 257, which documents the 2026 mitigation and the NU6.2 upgrade (ZIP 257 has the status Final). We quote them; we have not audited either flaw ourselves, and we make no judgement about how safe Zcash is today.
The two incidents at a glance
| 2018 / 2019 (Sprout) | 2026 (Orchard) | |
|---|---|---|
| What was wrong | A cryptographic flaw in the BCTV14 zk-SNARK paper used by the original Sprout system | A soundness bug in the Orchard Action circuit implementation (variable-base scalar multiplication gadget) |
| What it could have allowed | Counterfeit shielded funds | Balance violation and theft of funds |
| Found | March 1, 2018, by Ariel Gabizon | Reported May 29, 2026 by Taylor Hornby during an AI-assisted audit of Orchard |
| Public | February 5, 2019 (CVE-2019-7167) | Documented retrospectively in ZIP 257 |
| Fix | Sapling, activated October 28, 2018 at block 419,200 | Emergency Orchard disable from block 3,363,426, then NU6.2 at block 3,364,600 |
| Evidence of use | The post states it found none | Not stated in the text we read |
2019: the Sprout flaw
Electric Coin Company's post "Zcash counterfeiting vulnerability successfully remediated" describes "a subtle cryptographic flaw" in the BCTV14 paper behind Sprout: extra elements in the proving system's setup could let a cheating prover make a valid-looking proof of a different statement, and anyone holding the setup ceremony transcript could in principle have used them to counterfeit shielded funds. The company says it found no evidence that anyone else discovered the flaw or that counterfeiting occurred, and that it studied the blockchain for evidence of exploitation. Its summary of the safeguard: "As long as the value in the shielded pools are greater than zero, no counterfeiting has been detected." The flaw was not announced until after the fix: the Sapling upgrade, which replaced Sprout's proving system, activated on October 28, 2018, and the disclosure followed on February 5, 2019. See also our history of Zcash for Sapling in context.
2026: the Orchard soundness bug
ZIP 257, "Deployment of the Orchard Temporary Vulnerability Mitigation and NU6.2 Network Upgrade", records that on May 29, 2026, security researcher Taylor Hornby, tasked with an AI-assisted audit of the Orchard protocol, reported a soundness vulnerability in the Orchard Action circuit implementation. It says the bug "could have allowed balance violation and theft of funds", and points to a GitHub security advisory and Hornby's work log for the technical detail. The fix in the circuit added missing copy constraints and changed the Orchard verifying key; the corrected code was released in halo2_gadgets v0.5.0 and orchard v0.14.0.
The response had two steps:
- Temporary mitigation. From block 3,363,426 on Mainnet, a consensus rule forbade any Orchard Action in transactions, deployed as an emergency hotfix in zcashd v6.12.5 and Zebra v4.5.3. The ZIP notes that an earlier activation height 60 blocks sooner was re-attempted because some mining pools had not upgraded in time.
- NU6.2. At block 3,364,600, about 1,174 blocks later (roughly a day at the 75-second target, our arithmetic), the corrected circuit was activated and Orchard transactions were accepted again, under the new verifying key and a canonical proof-length rule.
ZIP 257 gives the reason for not swapping the circuit in one step: disabling the vulnerable circuit and enabling the new one at the same time "was ruled out due to the risk of revealing the vulnerability before it had been mitigated".
The safety net: pool balances and the turnstile
Each shielded pool has a public running total, its chain value pool balance. ZIP 209 (Final) prohibits blocks that would make a shielded pool balance negative or push total supply above MAX_MONEY, 21 million ZEC; its motivation is that nodes can monitor the value shielded into and out of each pool, and a pool that pays out more than it took in signals a balance violation. In our reading, a flaw inside one pool is therefore bounded by that pool's size. That is also why we track the pools openly on Shielded Supply. For how the total supply is made up, see how many Zcash there are.
ZIP 318, the Orchard to Ironwood migration, states the follow-up motive: the Ironwood pool introduced by NU6.3 "enables verification of the Zcash shielded supply after NU6.2 mitigated a soundness flaw in the Orchard circuit", and wallets must offer to migrate Orchard funds. We cover what is verified about that upgrade in the Ironwood status article, and the app steps in how to use Zodl.
What these documents do not say
- Whether the 2026 flaw was used. ZIP 257 neither says it was nor that it was not. We did not look for on-chain evidence.
- Whether other flaws exist. Nothing here is an audit result for Zcash as a whole. Zcash has also changed its proving systems over time, see Project Tachyon for the next proposal.
- Investment or safety conclusions. We draw none.
How to follow future disclosures
- Network upgrades and their rationale are written up as ZIPs in the zcash/zips repository; our network upgrade tracker and timeline summarize what is live.
- Node and library fixes appear as releases of Zebra, zcashd and the orchard crate, with GitHub security advisories.
- For what a block explorer can and cannot show when you check a transaction, see how to check a shielded transaction or balance.
- For what private transactions hide and reveal, see can Zcash be traced? and the privacy hub.
Sources and method
- Electric Coin Company, "Zcash counterfeiting vulnerability successfully remediated", February 5, 2019 (now hosted at zodl.com); read October 14, 2026.
- ZIP 257, "Deployment of the Orchard Temporary Vulnerability Mitigation and NU6.2 Network Upgrade" (Final), zcash/zips repository; read October 14, 2026.
- ZIP 209, "Prohibit Out-of-Range Chain Value Pool Balances" (Final); ZIP 318, "Orchard to Ironwood Migration" (Draft), motivation text; read October 14, 2026.
- The 1,174-block interval is our arithmetic from the two heights in ZIP 257.
New guides first appear in the ZecZcash Telegram channel.