Zcash fixes critical Orchard bug via emergency fork to Zebra 5.0.0

Zcash Foundation fixed a critical soundness bug in the Orchard Action circuit on June 2, deploying an emergency soft fork that temporarily halted shielded transactions before a permanent fix at block height 3,364,600.

"We strongly urge all node operators to upgrade to Zebra 5.0.0 as soon as possible," the Zcash Foundation said, confirming no unauthorized value creation was detected.

The bug, discovered May 29 by independent researcher Taylor Hornby during a Shielded Labs audit, could have allowed invalid state changes and potential double spending within the Orchard pool. ZODL engineers Daira-Emma Hopwood, Kris Nuttycombe and Jack Grigg confirmed the issue within hours. Zebra 4.5.3 activated an emergency soft fork at block height 3,363,426 around 02:00 UTC on June 2, temporarily rejecting Orchard actions while engineers prepared a corrected circuit. The transition produced 37 orphaned blocks as miners upgraded at different speeds, according to community member Kenbak.

Orchard, Zcash's newest shielded pool launched with NU5 in 2022, holds about 4.2 million ZEC. Roughly 30% of total supply now sits in shielded pools, making the vulnerability particularly consequential. The incident marks the fourth major security event in three months for Zcash, which maintains two independent node implementations — zcashd (C++) and Zebra (Rust) — a design choice that has repeatedly introduced coordination overhead and consensus divergence risks.

The foundation said Sapling and transparent transactions continued operating normally while Orchard actions remained paused. Affected code included older halo2_gadgets, orchard and zcash_primitives releases, plus zcashd versions 5.0.0 through 6.12.3. Zcash's turnstile mechanism protected total ZEC supply throughout the incident.

Cake Wallet, which added shielded Zcash support in January 2026 with Orchard transactions enabled by default, confirmed its ZEC service was unavailable during the network-wide disruption. "This is not just a Cake Wallet issue, but is network-wide," the wallet provider said.

ZEC traded at $587.35 with a market capitalization of about $9.8 billion as of June 2, according to CoinMarketCap data. The token has rallied more than 1,200% from pre-halving lows this year, driven by the SEC closing its investigation into the Zcash Foundation in January and Grayscale filing to convert its Zcash Trust into a spot ETF.

Node operators now face upgrading to Zebra 5.0.0. Those that remained on an incorrect fork after NU6.2 may need to resync from scratch or restore from a backup made before activation.

This article is for informational purposes only and does not constitute investment advice.