Breaking

AI Uncovers Counterfeit Flaw in Zcash That Went Unseen for Four Years

June 14, 2026 at 09:33 EDT

Security
AI Agents

A critical "counterfeiting" vulnerability that went unnoticed for roughly four years in the privacy-focused cryptocurrency Zcash was discovered and fixed through an audit using Anthropic's AI model Claude Opus 4.8. On May 29, 2026, security researcher Taylor Hornby found a soundness bug in the latest shielded pool, "Orchard," that could enable the unlimited, undetectable generation of fake ZEC. He disclosed it privately to the development organization, and it was fixed through an emergency soft fork and a hard fork before any exploitation was confirmed.

June 4, 2026 · Zcash Orchard Disclosure

An AI Caught the Counterfeit Bug Four Years of Audits Missed

A critical soundness flaw in Zcash's Orchard shielded pool could have let an attacker mint unlimited, untraceable counterfeit ZEC. It slipped past repeated audits for ~4 years — until an AI-assisted review surfaced it.

~4 yrs

Flaw existed undetected since Orchard activation

∞ ZEC

Counterfeit coins mintable — valid on network, untraceable

~6 days

From discovery to deployed fix

ZEC price reaction after disclosure

Trust in supply integrity eroded — drop varied by exchange and report.

100%

Before

−36%

After (low est.)

−50%

After (high est.)

Response timeline

May 29

AI-assisted review with Claude Opus 4.8 finds the flaw

→

Responsible disclosure

Reported privately; ecosystem-wide emergency response

→

Jun 1–2

Fix deployed across the network

→

Jun 4

Public disclosure; no mainnet exploit confirmed

The root cause

A missing constraint in Orchard's zero-knowledge proof circuit let mathematically invalid inputs pass verification.

Located in the elliptic-curve validation of the Halo2 halo2_gadgets code
A working proof-of-concept minted counterfeit ZEC in local test environments
Survived multiple audits, formal reviews and community scrutiny

Encouraging signal

Frontier AI now finds subtle soundness bugs humans missed for years — accelerating bug-hunting and broadening interest in AI-assisted auditing, with audits planned to extend to other projects.

The caution

AI is double-edged — it speeds up attacks as well as discovery. The price crash reflected eroded trust, underscoring the case for proactive formal verification.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.