On the evening of Monday, June 1, the Zcash ecosystem launched a coordinated network upgrade in response to a critical issue affecting Orchard, Zcash's latest shielded pool. The @ZcashFoundat
On the evening of Monday, June 1, the Zcash ecosystem launched a coordinated network upgrade in response to a critical issue affecting Orchard, Zcash's latest shielded pool. The @ZcashFoundation subsequently released Zebra 4.5.3 and 5.0.0 to resolve the underlying flaw.
The flaw was a soundness vulnerability in the Orchard shielded pool. In Zcash, soundness means the protocol should only accept valid transactions and valid state changes. A soundness bug can allow the system to accept something it should reject. In this case, successful exploitation could have allowed invalid state transitions inside Orchard, potentially affecting accounting guarantees for the pool. ZODL confirmed the bug involved the implementation of the Orchard zero-knowledge proof circuit in the halo2_gadgets crate.
Affected components included older versions of halo2_gadgets, orchard, zcash_primitives, zcashd and zebrad. No evidence of exploitation was found. Zcash's turnstile mechanism, which tracks balances across value pools including Sprout, Sapling, Orchard, transparent and lockbox, confirmed that the total $ZEC supply remained intact.
Developers, infrastructure operators, miners, exchanges, and other key network participants coordinated to temporarily suspend the mining of Orchard-related transactions while a protocol-level upgrade was deployed. The response came in two stages: a soft fork at mainnet block height 3,363,426 temporarily disabled shielded actions, before the NU6.2 hard fork activated at block height 3,364,600 re-enabled the corrected circuit.
The @ZcashFoundation then released Zebra 4.5.3 and 5.0.0 to incorporate the fix into both the current stable and the new major release branch, urging all node operators to upgrade immediately.
Orchard is built on the Halo 2 proving system, which eliminated the need for a trusted setup ceremony, a longstanding criticism of Zcash's older Sprout and Sapling pools. Over 30% of the total circulating $ZEC supply now sits in shielded pools, a level analysts have described as a structural shift in how the network is being used. That scale explains why the response was treated with such urgency.
The incident is the latest in a run of security activity on the network. Just one day before this emergency, the Foundation had released Zebra 4.5.1 as a hotfix for a consensus-critical signature operation counting bug that the previous day's 4.5.0 release had failed to fully fix. The broader 4.5.0 release itself addressed findings from over 80 security reports received during the ZCG Vulnerability Disclosure Initiative in April and May 2026. A fuller technical disclosure is expected once the upgrade is confirmed complete.
Sources:Zcash Community Forum: Orchard Vulnerability Successfully RemediatedCrypto Adventure: Zcash Restores Orchard After Critical Shielded Pool VulnerabilityThe Crypto Times: Zcash Executes Emergency Fork After Critical Orchard Vulnerability Discovery
