Zcash emergency upgrade patches Orchard bug; ZEC rises

Security researcher Taylor Hornby discovered a vulnerability in the Orchard Action circuit on May 29. Zcash Open Development Lab engineers confirmed the flaw that night and began confidential coordination with the Zcash Foundation, miners, exchanges and other network participants to reduce risk while a patch was prepared.

Developers carried out a two-stage repair over five days. First they deployed an emergency soft fork that stopped all Orchard transactions while a corrected cryptographic circuit was finalized. Private coordination with miners and exchanges began the evening of May 31; an initial activation attempt failed, and a second attempt halted Orchard activity at block 3,363,426. On Wednesday a full network upgrade, NU6.2, went live and restored Orchard using a corrected verifying key.

Teams involved explained a hard fork was required because fixing a zero-knowledge proof system requires replacing the cryptographic verifying key, a change not possible through ordinary software updates. Zcash’s turnstile mechanism, which tracks value across transaction pools, showed no unauthorized coins were created and there is no evidence the bug was exploited. The Foundation advised node operators to upgrade to Zebra 5.0.0 to activate the corrected rules.

Block explorers briefly showed stale data while nodes upgraded, creating the appearance that the network had paused. Network logs and miner activity indicate blocks continued to be produced and transactions continued confirming during the upgrade.

Josh Swihart, founder of Zcash Open Development Lab, wrote that the coordinated repair involved many parties and was the most ambitious network upgrade in Zcash’s history for the project.

Market response was limited. ZEC traded near $629, up more than 10% over 24 hours, about 53% over 30 days and roughly 1,084% over 12 months. The token remains below its 2016 peak of $3,191.

ZODL outlined plans to roll out quantum-recoverable wallets within a month and to implement full post-quantum protections within 12 to 18 months. The project is also targeting higher network throughput in the same timeframe.