Zcash Drops Past 50% on Counterfeiting Bug as Liquidations Top $116M

Zcash extended its recent selloff beyond 50% on Friday to roughly $310 as a critical counterfeiting vulnerability disclosed earlier this week continued to weigh on sentiment. ZEC fell as much as 60% at one point, from around $630 on Thursday to as low as roughly $250 on Friday, before recovering some losses, while liquidations surpassed $116 million — the third-largest among cryptocurrencies over the past 24 hours behind bitcoin and ether — according to CoinGlass. A reminder that "recovering some losses" is doing a lot of work in this market.

Notably, the CoinGlass figure reflects a partial picture. Liquidation data is staggered and known to underreport, meaning actual forced-close volumes are likely higher.

Zcash's liquidation data shows almost $72 million in long liquidations and over $45 million in shorts over the 24-hour period, with peak volume between 8 a.m. and 9 a.m. UTC on June 5. CoinGlass rated the session's liquidation intensity 3.72x against the seven-day average. Zcash liquidations exceed $116 million amid Orchard bug saga | Image: Coinglass.

The disclosure came from Zooko Wilcox, Zcash co-founder and Shielded Labs head, alongside researchers Jason McGee and Taylor Hornby, who confirmed the flaw had existed in Zcash's Orchard zero-knowledge proof circuit since its activation in May 2022. The Block previously reported on the initial discovery and price drop.

The vulnerability, rooted in an under-constrained element of the Orchard circuit's variable-base scalar multiplication gadget, would have allowed a malicious actor to spend the same shielded note multiple times by revealing a unique nullifier with each spend — effectively minting unlimited, undetectable counterfeit ZEC within the Orchard pool. Truly the kind of feature only a cryptographer could love.

Hornby discovered the bug on May 29, hours after Anthropic released its Claude Opus 4.8 model. Using a custom AI-assisted auditing framework he called zcash-full-stack-auditor, Hornby ran a targeted review of the Orchard circuit. An audit agent flagged the critical flaw at around 6 p.m. MDT. By 11:53 p.m., Hornby had delivered a proof-of-concept and a full report to the Zcash Open Development Lab over Signal. By the following Monday night, a soft fork mitigation was live on mainnet.

A full network upgrade, NU6.2, re-enabled Orchard at block 3,364,600 on June 2 with the corrected circuit.

The window of exposure ran from Orchard's activation on May 31, 2022, through the soft fork on June 1