Zcash Orchard Flaw Patched by Emergency Fork; Shielded Labs Seeks Supply Proof Upgrade

The case fits a broader pattern. In February 2026, security firm Octane disclosed that its AI found a high-severity bug in Nethermind, an Ethereum execution client, that could have halted local block production for roughly 38% of Ethereum validators. That bug was patched before exploitation. A January 2026 arXiv paper reported a 63% success rate for AI-agent exploit generation on a smart contract benchmark, work focused on the application layer rather than base-layer code.

Supply Assurance and Where the Two Positions Diverge

Zcash's official position is that there is no evidence of mainnet exploitation, no unauthorized value creation has been detected, and the 21 million ZEC cap remains intact, protected by the turnstile mechanism that tracks value moving between pools. Shielded Labs takes a harder line. It argues that Orchard's privacy properties make it cryptographically difficult to prove the supply was never tampered with, and it has proposed a further upgrade that would route coins through turnstile accounting so anyone can verify integrity directly.

The disagreement is over what can be shown, not whether the bug was fixed. Both sides accept the emergency patch closed the known flaw. They differ on whether past issuance can be independently proven sound.

Market Reaction

ZEC traded as high as $611 intraday before the disclosure and then fell sharply, settling near $421. Market commentary framed the move as a repricing between "patched" and "proven clean" rather than a verdict on the network's technology. The source reporting does not provide a single price-impact figure beyond these levels.

What to Watch

The open questions are whether the proposed turnstile-based upgrade gains the coordinated sign-off from miners, exchanges, wallet providers, and infrastructure operators that a consensus change requires, and whether an independent audit of historical Orchard issuance is published. The compressed timeline, under five days from discovery to hard-fork activation, is itself a test of the network's coordination process that observers will likely cite in future assessments.

Why It Matters

For Traders

ZEC has already repriced sharply after the disclosure, and any vote or audit on the proposed supply-proof upgrade could move the price again within days.

For Investors

The gap between a patched bug and a provably sound supply is a structural question for privacy coins, and the outcome of the turnstile proposal will shape how investors weigh that risk.

For Builders

Any protocol relying on zero-knowledge proof circuits should review its verifying key management and expect that AI-assisted review can surface soundness bugs quickly.