An AI-Assisted Audit Found a Four-Year-Old Flaw in Zcash That Could Have Enabled Unlimited Double-Spending

A Hidden Flaw, Four Years in the Making

On May 29, 2026, researcher Taylor Hornby was conducting a targeted security audit for Shielded Labs on the cryptographic circuits underlying Zcash's Orchard shielded pool. What he found — with meaningful assistance from Anthropic's frontier AI model Claude Opus 4.8 — was a soundness flaw that had been quietly embedded in the protocol since the NU5 network upgrade in May 2022. The vulnerability had survived four years of review, formal analysis, and production use without detection.

Today, June 5, 2026, the Zcash ecosystem publicly disclosed the bug, the emergency response, and the fix. No exploits were detected. User privacy was never compromised. But the disclosure itself rattled markets: ZEC dropped between 30 and 50 percent in the hours following the announcement — a pattern that has become grimly familiar in cryptocurrency security events, regardless of whether the underlying issue has already been resolved.

What the Bug Actually Was

To understand the flaw, a brief primer on the relevant components is useful.

Halo2 is a zero-knowledge proving system developed by the Electric Coin Company (ECC). Zero-knowledge proofs allow one party to prove to another that a statement is true — for example, "I own enough ZEC to make this transaction" — without revealing any of the underlying private data. Halo2 is the engine powering Zcash's Orchard protocol, which is the current generation of shielded (private) transaction support in Zcash.

The Orchard shielded pool is where private Zcash transactions live. When a user sends shielded ZEC, the network verifies the transaction using a zero-knowledge proof rather than inspecting the actual balances directly. The critical security property of such a system is soundness: it must be impossible to construct a valid-looking proof for a false statement.

The bug Hornby found was a soundness flaw — specifically in the Halo2 circuit used by Orchard. In practical terms: an attacker who understood the flaw could craft a fraudulent zero-knowledge proof that appeared valid to the network but represented a transaction that should not be possible. That means spending the same shielded ZEC more than once — double-spending within the Orchard pool.

Critically, this was not a total supply inflation bug. Zcash has a mechanism called the "turnstile" that governs how ZEC moves between its transparent pool and its shielded pools. The turnstile enforces conservation of supply at the pool level, so even a successful double-spend attacker within Orchard could not have minted new ZEC out of thin air or silently inflated the total supply beyond what the turnstile would permit. The attack surface was real, but it was bounded.

How an AI Model Helped Find It

The discovery process is notable on its own terms. Taylor Hornby was using Claude Opus 4.8 as an AI-assisted audit tool during a targeted review of Zcash's Orchard circuit. This is not the same as an AI autonomously auditing code: Hornby directed the investigation, formulated hypotheses, and interpreted results. But the AI model played a substantive role in working through the complex algebraic constraints of the Halo2 circuit — the kind of dense, highly specialized reasoning that can cause even experienced cryptographers to miss subtle inconsistencies.

This is widely considered one of the first documented cases of a frontier AI model making a direct, material contribution to the discovery of a critical cryptographic soundness flaw. It will not be the last. As zero-knowledge proof systems move from research curiosity to critical infrastructure — underpinning privacy tools, layer-2 scaling solutions, and identity protocols — the need for rigorous, expert-level circuit auditing is growing faster than the supply of cryptographers qualified to do it. AI-assisted audit tooling may become part of how that gap is bridged.

The Emergency Response Timeline

The response after Hornby's disclosure was fast:

• May 29, 2026: Hornby discloses the vulnerability. The Zcash Open Development Lab (ZODL) confirms the flaw within hours and activates an emergency response.
• May 29 – June 3, 2026: An emergency soft fork temporarily disables all Orchard transactions network-wide. This prevents any exploitation of the vulnerability while a permanent fix is developed and deployed.
• June 3, 2026: The NU6.2 hard fork goes live, permanently correcting the Halo2 circuit and restoring Orchard transaction functionality.
• June 5, 2026: Full public disclosure. The Zcash Foundation confirms no exploits were detected and that user privacy was never compromised during the period the bug existed.

The five-day window between disclosure and hard fork is tight by any standard. Credit goes to the coordinated effort across ECC, ZODL, and the broader Zcash ecosystem for executing a clean emergency response under significant pressure.

Market Impact: Why Markets Panic Even When the Bug Is Fixed

ZEC's price fell between 30 and 50 percent in the hours following the public disclosure — even though the bug had already been patched three days earlier.

This is a well-documented pattern in cryptocurrency security events. Markets respond not to the current state of a system's security, but to the information shock of learning that a critical vulnerability existed. Several dynamics compound the reaction: retail holders who lack the technical context to distinguish "fixed vulnerability" from "active exploit" sell on fear; traders who anticipate the sell-off front-run it; and the mere existence of a four-year-old undetected bug raises broader questions about what else might have been missed — questions that do not have immediate answers.

For technically informed observers, the disclosure should read more as a signal that the ecosystem's security practices are functioning: the bug was found, disclosed responsibly, and patched before exploitation. But that framing takes time to propagate through markets.

The Bigger Picture: Auditing Zero-Knowledge Systems Is Hard

Zero-knowledge proof systems are increasingly foundational to how the next generation of cryptographic infrastructure works. They appear in Zcash's privacy layer, in Ethereum's layer-2 rollups (zkEVMs), in identity and credential systems, and in numerous emerging applications. The mathematics involved — elliptic curves, polynomial commitments, constraint systems — is specialized enough that the pool of people who can conduct rigorous circuit audits is genuinely small.

The Zcash Orchard bug illustrates how difficult it is to find soundness flaws in these systems even with sustained expert attention. The circuit had been reviewed, the protocol had been running in production for four years, and the flaw still required a targeted audit — assisted by a frontier AI model — to surface.

That is both a warning and a direction. Zero-knowledge circuits need more rigorous, more frequent auditing than they currently receive. AI-assisted tooling, applied by skilled researchers who understand what they are looking for, may be a meaningful part of the answer. The Hornby audit is an early data point suggesting the combination can find things that traditional review misses.

For now, Zcash users can transact normally. The Orchard pool is repaired. The privacy properties that make shielded ZEC valuable were never exposed. But the four years this bug spent undetected is a number worth sitting with.