01 LEDGER — the exploit record - zero motion - every row sourced

Beware: what the proof could not prove

The exploit record, in the order the corpus numbers them: what was broken, when, who found it, and whether anyone outside could have seen it. Most of the 14 entries are ordinary defects - the side-channels, the spam, the 5.7 years in which Sprout proofs went unverified, the turnstile that could be silently switched off, and the two ceremonies the oldest pools still rest on. B1 and B2 are not.
“there's no way of knowing if anyone exploited the vulnerability to steal money.”
Bruce Schneier - on CVE-2026-54496 - recorded in B2
“it's impossible to know if it's been exploited... until Sprout addresses are deprecated”
Zcash Foundation - 5 Feb 2019 - on CVE-2019-7167 - recorded in B1
B2
B2confidence: highverified 2026-08-22cite - 4 sources
claim
B2
last verified
2026-08-22
confidence
high
  1. GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22
  2. ZODL — Orchard Vulnerability Successfully Remediated (2 Jun 2026) ZODL · 2026-05-29 · accessed 2026-08-22
  3. Zcash Community Forum — The Orchard Counterfeiting Vulnerability—And Next Steps (4 Jun 2026) Zcash Community Forum · 2026-06-04 · accessed 2026-08-22
  4. Schneier on Security — Critical Zcash Vulnerability Found and Fixed (Jun 2026) Schneier on Security · accessed 2026-08-22
B1
B1confidence: highverified 2026-08-22cite - 3 sources
claim
B1
last verified
2026-08-22
confidence
high
  1. ECC — Zcash Counterfeiting Vulnerability Successfully Remediated (5 Feb 2019) Electric Coin Company · 2018-03-01 · accessed 2026-08-22
  2. ZF — Concerning the Sprout Vulnerability CVE-2019-7167 Zcash Foundation · accessed 2026-08-22
  3. ZIP 209, Prohibit Out-of-Range Chain Value Pool Balances Zcash Improvement Proposals · accessed 2026-08-22
Claim

For roughly six of the chain's ~9.8 years a shielded circuit was unsound and counterfeiting was possible without limit - and the windows in which that was true, B1 and B2 below, cannot be cleared after the fact.

A zero-knowledge pool hides a forged note exactly as well as it hides a legitimate one, so no analysis run afterwards can settle whether either window was used: the question closes when the pools those circuits ran under are empty, and not before. The corpus states the combined span as an approximation rather than as a count of days, and nothing computed since narrows it. What follows is the register the claim rests on, then the working.

confidence: highverified 2026-08-223 sources

C2
C2confidence: highverified 2026-08-22cite - 3 sources
claim
C2
last verified
2026-08-22
confidence
high
  1. ZODL — Zcashd Sprout Verification Vulnerability (31 Mar 2026) ZODL · 2026-05-29 · accessed 2026-08-22
  2. ZODL — Several Zcash Vulnerabilities Remediated (Apr 2026) ZODL · accessed 2026-08-22
  3. GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22

The figures below are counted from the 14 rows in the ledger, not asserted separately. Strike a row you do not accept and the counts move with it.

Ledger entries
14
B1 to B14 - each with its own sources
Critical
2
B1 · B2 - the two counterfeiting windows
Never detectable
3 of 14
B1 · B2 · B3 - no trace in public data
Confidence high
13 of 14
the rest: B12 med
01

The ledger

id order, B1 to B14 - hover a row, the rest recede
high primary source or two independent secondaries · med one reputable secondary
  • B1

    Sprout counterfeiting — BCTV14 soundness (CVE-2019-7167)critical · CVE-2019-7167

    window: 28 Oct 2016 → 28 Oct 2018
    found 1 Mar 2018 · fixed 28 Oct 2018 (Sapling, block 419,200, silently) · disclosed 5 Feb 2019 (341 days later)
    root cause: BCTV14 key generation emitted extra unused "bypass" polynomial elements in the proving key, letting a cheating prover skip a consistency check and convert a proof of one statement into a valid-looking proof of another, false statement -> unlimited counterfeit shielded value with no corresponding input
    found by: Ariel Gabizon (ECC); confirmed same day by Sean Bowe
    detectable from public data: NO
    B1
    B1confidence: highverified 2026-08-22cite - 3 sources
    claim
    B1
    last verified
    2026-08-22
    confidence
    high
    1. ECC — Zcash Counterfeiting Vulnerability Successfully Remediated (5 Feb 2019) Electric Coin Company · 2018-03-01 · accessed 2026-08-22
    2. ZF — Concerning the Sprout Vulnerability CVE-2019-7167 Zcash Foundation · accessed 2026-08-22
    3. ZIP 209, Prohibit Out-of-Range Chain Value Pool Balances Zcash Improvement Proposals · accessed 2026-08-22
  • B2

    Orchard Action circuit soundness — missing copy constraint (CVE-2026-54496)critical · CVE-2026-54496 · GHSA-ww9q-8r59-xv46

    window: 31 May 2022 → 1 Jun 2026 (4 years, 1 day)
    found 29 May 2026, 23:53 · fixed soft fork 2 Jun 2026 (block 3,363,426); NU6.2 hard fork 3 Jun 2026 (block 3,364,600) · disclosed 4 Jun 2026 (forum); GHSA/CVE 15 Jun 2026
    root cause: halo2_gadgets/src/ecc/chip/mul/incomplete.rs lines 309-310 used assign_advice() instead of copy_advice() for the base-point coordinates in the incomplete double-and-add loop, so the loop's base was never bound to the real diversified base g_d and pk_d = [ivk]·g_d went unenforced -> forged nullifier keys, repeat spends, forged spend authorisations
    found by: Taylor Hornby (Defuse Security, Shielded Labs engagement) with Anthropic's Claude Opus 4.8
    detectable from public data: NO
    B2
    B2confidence: highverified 2026-08-22cite - 4 sources
    claim
    B2
    last verified
    2026-08-22
    confidence
    high
    1. GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22
    2. ZODL — Orchard Vulnerability Successfully Remediated (2 Jun 2026) ZODL · 2026-05-29 · accessed 2026-08-22
    3. Zcash Community Forum — The Orchard Counterfeiting Vulnerability—And Next Steps (4 Jun 2026) Zcash Community Forum · 2026-06-04 · accessed 2026-08-22
    4. Schneier on Security — Critical Zcash Vulnerability Found and Fixed (Jun 2026) Schneier on Security · accessed 2026-08-22
  • B3

    PING and REJECT remote side-channels (CVE-2019-16930, CVE-2019-17048)high · CVE-2019-16930 · CVE-2019-17048

    window: Launch → Sep 2019 (Sprout + Sapling)
    found 2019 · fixed zcashd 2.0.7-3 · disclosed 24 Sep 2019
    root cause: REJECT: an unhandled exception in wallet transaction-processing code drops the P2P connection when a node controls the targeted shielded address, leaking address-to-node and address-to-IP mappings. PING: wallet trial-decryption runs inline with the network thread, so response latency to a ping is a timing oracle for whether the peer holds the relevant viewing key
    found by: Florian Tramèr, Dan Boneh, Kenneth G. Paterson (Stanford/ETH, USENIX Security 2020)
    detectable from public data: NO
    B3
    B3confidence: highverified 2026-08-22cite - 2 sources
    claim
    B3
    last verified
    2026-08-22
    confidence
    high
    1. ECC — New Release: 2.0.7-3 (24 Sep 2019) Electric Coin Company · 2019-09-24 · accessed 2026-08-22
    2. Tramèr, Boneh, Paterson — Remote Side-Channel Attacks on Anonymous Transactions, USENIX Security 2020 USENIX · accessed 2026-08-22
  • B4

    Sandblasting spam attack (Sapling Woodchipper)mid

    window: Jun 2022 → Nov 2023
    found ~mid-Jun 2022 · fixed ZIP 317 (default in zcashd v5.5.0, Apr 2023); spam stopped entering the mempool ~Nov 2023 · disclosed public by Oct 2022
    root cause: A flat 1,000-zatoshi fee regardless of transaction size let an attacker build ~1,100-output transactions paying the same fee as a 2-output transaction, saturating blocks for about $10/day -- a previously theorised, documented design weakness ("Sapling Woodchipper") left unfixed until exploited
    found by: unknown attacker; publicised by the community (Jameson Lopp among others)
    detectable from public data: YES
    B4
    B4confidence: highverified 2026-08-22cite - 3 sources
    claim
    B4
    last verified
    2026-08-22
    confidence
    high
    1. Protos — Zcash chain triples in size thanks to $10-a-day spam attack Protos · accessed 2026-08-22
    2. Sandblasting Retrospective (ZCG arboretum notes) GitHub · 2022-05-31 · accessed 2026-08-22
    3. ZIP 317 (proportional transfer fee) Zcash Improvement Proposals · accessed 2026-08-22
  • B5

    zcashd skipped Sprout proof verification for 5.7 yearshigh

    window: Jul 2020 → Mar 2026
    found 23 Mar 2026 (reported) · fixed zcashd 6.12.0 · disclosed 31 Mar 2026
    root cause: CBlock::fChecked was set on the first validation pass, so CheckBlock returned early on later passes and Sprout proofs were never verified at all, from zcashd v3.1.0 (28 Jul 2020) through v6.11.x
    found by: Alex "Scalar" Sol (AI-assisted)
    detectable from public data: PARTIAL
    B5
    B5confidence: highverified 2026-08-22cite - 2 sources
    claim
    B5
    last verified
    2026-08-22
    confidence
    high
    1. ZODL — Zcashd Sprout Verification Vulnerability (31 Mar 2026) ZODL · 2026-05-29 · accessed 2026-08-22
    2. Decrypt — Zcash devs patch vulnerability, millions at risk (Mar 2026) Decrypt · accessed 2026-08-22
  • B6

    Turnstile accounting bypass via duplicate block headerhigh

    window: zcashd v5.0.0 → v6.12.0
    found 4 Apr 2026 · fixed zcashd 6.12.1 · disclosed ~17 Apr 2026
    root cause: SetChainPoolValues was called in AcceptBlock before the already-seen-header check, so a duplicate block header silently reset tracked pool balances to an unset state, disabling ZIP 209 turnstile enforcement on subsequent blocks (dossier states affected range zcashd v5.0.0 -> v6.12.0; research/03's detailed entry states v5.10.0 -> v6.12.0 -- the two corpus documents disagree and are reported here as found)
    found by: Alex "Scalar" Sol
    detectable from public data: PARTIAL
    B6
    B6confidence: highverified 2026-08-22cite - 1 source
    claim
    B6
    last verified
    2026-08-22
    confidence
    high
    1. ZODL — Several Zcash Vulnerabilities Remediated (Apr 2026) ZODL · accessed 2026-08-22
  • B7

    Orchard identity-rk crash, identity-epk consensus gap and signed-overflow pool accounting (Apr 2026)high · GHSA-452v-w3gx-72wg

    window: zcashd v5.0.0 / Zebra v1.0.0 → zcashd v6.12.0 / Zebra v4.3.0
    found 4 Apr 2026 · fixed zcashd 6.12.1 / Zebra 4.3.1+ · disclosed ~17 Apr 2026
    root cause: An Orchard action whose randomized key rk encodes the Pallas identity point crashes both implementations (GHSA-452v-w3gx-72wg); zcashd did not enforce that the ephemeral key epk is not the identity point, a rule Zebra enforced, creating chain-split risk; a signed integer overflow (C++ undefined behaviour) in pool-balance accounting was triggerable on crafted blocks
    found by: Alex "Scalar" Sol
    detectable from public data: YES
    B7
    B7confidence: highverified 2026-08-22cite - 1 source
    claim
    B7
    last verified
    2026-08-22
    confidence
    high
    1. ZODL — Several Zcash Vulnerabilities Remediated (Apr 2026) ZODL · accessed 2026-08-22
  • B8

    Viewing-key leak via memo Reply-Tomid

    window: ECC iOS ref wallet 0.3.7-105 (6 May 2021) → Nighthawk 1.9+
    found Jul 2021 · fixed wallet updates (post-0.3.7-105 ECC iOS reference wallet; post-1.9 Nighthawk) · disclosed 13 Jul 2021
    root cause: Wallets inserted the sender's full viewing key into the memo field instead of a return address, giving any recipient permanent, irrevocable read access to the sender's entire wallet history once broadcast to the immutable chain
    found by: Nighthawk Wallet team
    detectable from public data: PARTIAL
    B8
    B8confidence: highverified 2026-08-22cite - 1 source
    claim
    B8
    last verified
    2026-08-22
    confidence
    high
    1. ECC — Privacy-leak bug in Nighthawk and ECC wallets (13 Jul 2021) Electric Coin Company · 2021-07-13 · accessed 2026-08-22
  • B9

    Linkability research: round-trips, anonymity-set shrinkage and mining fingerprintsmid

    window: ongoing → ongoing
    found 2017-2019 · fixed not applicable -- usage-pattern research findings, not a software defect with a patch · disclosed 2017-2019
    root cause: Usage, not cryptography: round-trip shield/deshield transactions of identical amounts, the Founders' Reward's fixed 250.0001 ZEC withdrawal amount matched to timing, and heavy correlation of shielded volume with mining-pool activity
    found by: Jeffrey Quesnelle (academia, 2017); George Kappos, Haaroon Yousaf, Mary Maller, Sarah Meiklejohn (UCL, USENIX Security 2018); Alex Biryukov, Daniel Feher (Univ. of Luxembourg, IEEE CNS 2019)
    detectable from public data: N/A
    B9
    B9confidence: highverified 2026-08-22cite - 3 sources
    claim
    B9
    last verified
    2026-08-22
    confidence
    high
    1. Quesnelle — On the linkability of Zcash transactions, arXiv:1712.01210 (4 Dec 2017) arXiv · 2017-12-04 · accessed 2026-08-22
    2. Kappos, Yousaf, Maller, Meiklejohn — An Empirical Analysis of Anonymity in Zcash, USENIX Security 2018 USENIX · accessed 2026-08-22
    3. Biryukov, Feher — Privacy and Linkability of Mining in Zcash, IEEE CNS 2019 orbilu.uni.lu · accessed 2026-08-22
  • B10

    The 2026 advisory wave -- 41 Zebra advisories in five monthshigh · CVE-2026-34377 · CVE-2026-41583 · CVE-2026-44497 · CVE-2026-52735

    window: Mar 2026 → Aug 2026
    found Mar-Aug 2026 · fixed various point releases across zcashd and Zebra, Mar-Aug 2026; several required a second or third re-fix · disclosed Mar-Aug 2026
    root cause: Consensus divergence, denial-of-service and chain-stall classes across 41 Zebra advisories (12 Critical, 6 High) and 9 zcashd advisories (2 Critical); several fixes, including the sigop undercount and V5 SIGHASH_SINGLE handling, had to be re-fixed after the first patch proved incomplete; zcashd's own advisories were published in a burst on 8 May and 13/19 Jul 2026, after zcash/zcash was archived 19 Jul 2026
    found by: various
    detectable from public data: YES
    B10
    B10confidence: highverified 2026-08-22cite - 3 sources
    claim
    B10
    last verified
    2026-08-22
    confidence
    high
    1. zcash/zcash security disclosures GitHub · accessed 2026-08-22
    2. ZcashFoundation/zebra advisories (pages 1–5) GitHub · 2026-08-22 · accessed 2026-08-22
    3. z.cash — zcashd deprecation / EOL Zcash · accessed 2026-08-22
  • B11

    ViaBTC 53% hashrate concentrationhigh

    window: Sep 2023 → Sep 2023
    found not separately dated in the corpus · fixed Coinbase raised confirmations from 40 to 110 and moved to limit-only trading; no protocol-level fix · disclosed 15 Sep 2023
    root cause: A single mining pool, ViaBTC, held 53% of Zcash's hashrate, crossing the threshold associated with a 51%-class double-spend or chain-reorganisation attack
    found by: Coinbase
    detectable from public data: YES
    B11
    B11confidence: highverified 2026-08-22cite - 1 source
    claim
    B11
    last verified
    2026-08-22
    confidence
    high
    1. crypto.news — Coinbase limits Zcash trading (ViaBTC) crypto.news · accessed 2026-08-22
  • B12

    Ledger drops v1 (pre-Sapling) transaction supportmid

    window: Nov 2025 → 2026
    found not separately dated in the corpus · fixed partial: Ledger Live added shielded-input-to-transparent sending ~Jul 2026 · disclosed 15-16 Nov 2025
    root cause: Ledger's firmware removed support for v1 (pre-Sapling) transactions, leaving pre-October-2018 ZEC UTXOs unspendable; Ledger then sought a Zcash Foundation grant to restore functionality it had itself removed
    found by: users (Jameson Lopp among others)
    detectable from public data: YES
    B12
    B12confidence: medverified 2026-08-22cite - 1 source
    claim
    B12
    last verified
    2026-08-22
    confidence
    med
    1. The Defiant — Ledger draws heat as pre-2018 Zcash holders face dropped support The Defiant · accessed 2026-08-22
  • B13

    Pre-launch trio: InternalH collision, Faerie Gold, proof errormid

    window: not applicable → not applicable
    found 2016 (pre-launch) · fixed pre-launch, before mainnet (28 Oct 2016) · disclosed 26 Apr 2016
    root cause: InternalH: birthday-bound collision (~2^64 work) in a 128-bit commitment hash enabling double-spend-to-self, fixed by moving to SHA256(0xB0 concatenated with a_pk, v, rho, r). Faerie Gold: a duplicate-nullifier trick could fake multiple spendable notes from one genuine note. Proof error: a non-exploitable gap meant notes to crafted addresses could be double-spendable only if the PRFs lacked collision resistance
    found by: Taylor Hornby (InternalH); Zooko Wilcox (Faerie Gold); Daira-Emma Hopwood (proof error); disclosed via ECC
    detectable from public data: N/A
    B13
    B13confidence: highverified 2026-08-22cite - 1 source
    claim
    B13
    last verified
    2026-08-22
    confidence
    high
    1. ECC — Fixing Vulnerabilities in the Zcash Protocol (26 Apr 2016) Electric Coin Company · 2016-04-26 · accessed 2026-08-22
  • B14

    Trusted setups still load-bearing: the 2016 Ceremony and 2018 Powers of Tauhigh

    window: 2016 → ongoing
    found 2016 / 2018 · fixed not applicable -- ongoing trust assumption; Sprout and Sapling still rest on the 2016/2018 ceremony parameters · disclosed 2016 / 2018 (Snowden's participation revealed Apr 2022)
    root cause: 1-of-N honesty assumption: at least one of six 2016 Sprout ceremony participants, or of roughly ninety 2018 Powers of Tau participants, must have genuinely destroyed their share of the toxic waste, or undetectable unlimited counterfeiting is possible within that pool. Halo 2/Orchard (NU5, 31 May 2022) removed the need for a trusted setup on new value, but Sprout (~22-25k ZEC) and Sapling (~529k ZEC) still rest on the 2016/2018 ceremony parameters
    found by: not applicable -- a structural trust assumption disclosed as part of the ceremony design, not a discovered bug
    detectable from public data: N/A
    B14
    B14confidence: highverified 2026-08-22cite - 4 sources
    claim
    B14
    last verified
    2026-08-22
    confidence
    high
    1. ECC — The Design of the Ceremony Electric Coin Company · accessed 2026-08-22
    2. CoinDesk — Zcash and the Art of Security Theater (14 Nov 2016) CoinDesk · 2016-11-14 · accessed 2026-08-22
    3. CoinDesk — Zcash Completes 'Powers of Tau' (13 Apr 2018) CoinDesk · 2018-04-13 · accessed 2026-08-22
    4. Wikipedia — Zcash Wikipedia · accessed 2026-08-22
How to read the Detectable column4 values, 14 rows
Detectable is whether exploitation would have left anything a reader of public data could find.
YES it would show on-chain - 5 of 14 rows
NO no trace a reader could find - 3 of 14 rows
PARTIAL a trace only in part, or only for some observers - 3 of 14 rows
N/A not a question this entry answers; the row says why - 3 of 14 rows
The column is the corpus's own 4-value field. The mockup carried a sentence for each row; the corpus does not, and this page does not invent one.
02

The Orchard soundness flaw, in full

CVE-2026-54496 · GHSA-ww9q-8r59-xv46 · CVSS 9.3
window 31 May 2022 → 1 Jun 2026 (4 years, 1 day)

root cause — halo2_gadgets/src/ecc/chip/mul/incomplete.rs · L309-310

The missing constraint, as a diff9 lines, 2 removed
// the incomplete double-and-add loop kept the base constant across rows via q_mul_2,
// but never tied it to the real base point g_d - the base was free.
- region.assign_advice(|| "x_p", self.double_and_add.x_p, row + offset, || x_p)?;
- region.assign_advice(|| "y_p", self.y_p,                 row + offset, || y_p)?;
+ if row == 0 {
+     region.copy_advice(|| "base", self.base, 0, self.double_and_add.x_p, row)?;
+ }
// consequence: pk_d = [ivk]·g_d was never enforced, so the same note stays
// spendable under fresh nullifiers. Consensus only rejects repeated ones.

The 2 removed lines are the assignment the root cause names, at the file and lines it names. The 3 added lines are the shape of the constraint that was missing, reconstructed from that description rather than copied from the upstream commit.

ZIP 209 rejects any block that would drive a pool's balance below zero, so what a pool can pay out is bounded by what provably entered it. That is the layer at which the 21 million cap held. It says nothing about which notes inside the pool were real: forged and legitimate notes are indistinguishable once they are in, so the value a counterfeiter could have realised would have come out of other holders, not out of new supply. Both readings - unlimited counterfeit, and the cap intact - are true, at different layers.

GitHub · ZODL · Zcash Community Forum · Schneier on Security

B2
B2confidence: highverified 2026-08-22cite - 4 sources
claim
B2
last verified
2026-08-22
confidence
high
  1. GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22
  2. ZODL — Orchard Vulnerability Successfully Remediated (2 Jun 2026) ZODL · 2026-05-29 · accessed 2026-08-22
  3. Zcash Community Forum — The Orchard Counterfeiting Vulnerability—And Next Steps (4 Jun 2026) Zcash Community Forum · 2026-06-04 · accessed 2026-08-22
  4. Schneier on Security — Critical Zcash Vulnerability Found and Fixed (Jun 2026) Schneier on Security · accessed 2026-08-22

timeline — patched before it was told

How it was found and patched9 steps, each cited
31 May 2022, 17:50:05 UTCNU5 activates Orchard and introduces CVE-2026-54496 NU5 — block 1,687,104. Orchard, Halo 2 (no trusted setup), unified addresses. Introduces CVE-2026-54496T2022-05-31
T2022-05-31confidence: highverified 2026-08-22cite - 1 source
claim
T2022-05-31
last verified
2026-08-22
confidence
high
  1. Zcash: Upgrade NU5 Zcash · accessed 2026-08-22
28 May 2026Anthropic releases Claude Opus 4.8T2026-05-28
T2026-05-28confidence: highverified 2026-08-22cite - 1 source
claim
T2026-05-28
last verified
2026-08-22
confidence
high
  1. Zcash Community Forum — The Orchard Counterfeiting Vulnerability—And Next Steps (4 Jun 2026) Zcash Community Forum · 2026-06-04 · accessed 2026-08-22
29 May 2026, 23:53Taylor Hornby finds the Orchard soundness bug Taylor Hornby finds the Orchard soundness bug — one day after the model's releaseT2026-05-29
T2026-05-29confidence: highverified 2026-08-22cite - 1 source
claim
T2026-05-29
last verified
2026-08-22
confidence
high
  1. ZODL — Orchard Vulnerability Successfully Remediated (2 Jun 2026) ZODL · 2026-05-29 · accessed 2026-08-22
1-2 Jun 2026Emergency soft fork at block 3,363,426 disables OrchardT2026-06-01
T2026-06-01confidence: highverified 2026-08-22cite - 1 source
claim
T2026-06-01
last verified
2026-08-22
confidence
high
  1. ZF — Zebra 4.5.3 and 5.0.0: Emergency Soft Fork and NU6.2 Activation Zcash Foundation · 2026-06-02 · accessed 2026-08-22
3 Jun 2026NU6.2 hard fork re-enables Orchard with fixed circuit NU6.2 hard fork at block 3,364,600 — fixed circuit, Orchard re-enabled. zcashd v6.20.0, zebrad v5.0.0T2026-06-03
T2026-06-03confidence: highverified 2026-08-22cite - 1 source
claim
T2026-06-03
last verified
2026-08-22
confidence
high
  1. Zcash: Upgrade NU6 2 Zcash · accessed 2026-08-22
4 Jun 2026Orchard bug disclosed publicly; ZEC falls 31% Public disclosure (Zooko Wilcox, Jason McGee, Taylor Hornby). ZEC −31% in 24 h to $409.64; peak $624 → $309 by 5 Jun (−50% in <48 h)T2026-06-04
T2026-06-04confidence: highverified 2026-08-22cite - 2 sources
claim
T2026-06-04
last verified
2026-08-22
confidence
high
  1. The Block — Zcash vulnerability, ZEC drops 31% (4 Jun 2026) The Block · 2026-06-04 · accessed 2026-08-22
  2. BitMEX Blog — Why Zcash Crashed Nearly 50% in 48 Hours bitmex.com · accessed 2026-08-22
4-5 Jun 2026Arthur Hayes liquidates his entire ZEC position Arthur Hayes liquidates his entire ZEC position: exploitation could not be "cryptographically proven impossible"T2026-06-04-2
T2026-06-04-2confidence: highverified 2026-08-22cite - 1 source
claim
T2026-06-04-2
last verified
2026-08-22
confidence
high
  1. CoinDesk, "Arthur Hayes dumps zcash holdings after Orchard Pool vulnerability revealed" (2026-06-05) CoinDesk · 2026-06-05 · accessed 2026-08-22
15 Jun 2026CVE-2026-54496 published; Anthropic's Mythos audit clears Zcash GHSA-ww9q-8r59-xv46 / CVE-2026-54496 published (CVSS 9.3). Same day: Zooko announces Anthropic's "Mythos" whole-protocol audit found no further serious bugs; ZEC +25–30%T2026-06-15
T2026-06-15confidence: highverified 2026-08-22cite - 2 sources
claim
T2026-06-15
last verified
2026-08-22
confidence
high
  1. GHSA-ww9q-8r59-xv46 / CVE-2026-54496 (Orchard soundness, CVSS 9.3) GitHub · accessed 2026-08-22
  2. Crypto Briefing — Zcash jumps 25% as Anthropic Mythos audit finds no critical flaws (15 Jun 2026) Crypto Briefing · 2026-06-15 · accessed 2026-08-22
28 Jul 2026, 13:00 UTCNU6.3 Ironwood launches a new shielded pool NU6.3 "Ironwood" — block 3,428,143. New formally verified (Lean) shielded pool; v6 tx format (ZIP 229); quantum recoverability (ZIP 2005); Orchard restricted to withdrawals only (ZIP 2006), creating the supply-verification turnstileT2026-07-28
T2026-07-28confidence: highverified 2026-08-22cite - 2 sources
claim
T2026-07-28
last verified
2026-08-22
confidence
high
  1. ZIP 258, Deployment of the NU6.3 Network Upgrade Zcash Improvement Proposals · 2026-07-28 · accessed 2026-08-22
  2. The Block — Zcash activates Ironwood (28 Jul 2026) The Block · 2026-07-28 · accessed 2026-08-22

The register holds the corpus's own timeline rows for this window and nothing else: the confirmation on 30 May and the private coordination with miners and exchanges on 31 May are not separate rows in it - they are recorded inside B2's own account, opposite. Block heights appear inside the 9 steps in the rows' own wording, because the timeline's height field is unset on all of them.

03

Why the residual cannot be cleared

the bound, not the allegation

the bound — what a turnstile can and cannot do

A turnstile bounds what a pool may pay out by what provably entered it. It cannot tell a forged note from a real one already inside the pool; it can only refuse to let the pool go negative. A pool that ran on an unsound circuit is therefore settled by being emptied, and by nothing else - which is why the question B1 opened in 2016 is still open.

Sprout has not emptied in about eight years: it still holds roughly 22,000 to 25,400 ZEC under the 2016 ceremony parameters. Orchard has been exit-only since 28 July 2026, and roughly 708,841 ZEC remain inside it, in a pool whose supply is not yet verifiable.

C3
C3confidence: highverified 2026-08-22cite - 4 sources
claim
C3
last verified
2026-08-22
confidence
high
  1. ZIP 209, Prohibit Out-of-Range Chain Value Pool Balances Zcash Improvement Proposals · accessed 2026-08-22
  2. ZIP 308 (Sprout→Sapling migration) Zcash Improvement Proposals · accessed 2026-08-22
  3. crypto.news — Why 30% of Zcash supply is in the shielded pool (29 May 2026) crypto.news · 2026-05-29 · accessed 2026-08-22
  4. CoinDesk — Zcash and the Art of Security Theater (14 Nov 2016) CoinDesk · 2016-11-14 · accessed 2026-08-22
C9
C9confidence: medverified 2026-08-22cite - 2 sources
claim
C9
last verified
2026-08-22
confidence
med
  1. ZIP 258, Deployment of the NU6.3 Network Upgrade Zcash Improvement Proposals · 2026-07-28 · accessed 2026-08-22
  2. CipherScan — Ironwood migration tracker CipherScan · 2026-08-22 · accessed 2026-08-22

what this is not — the claim is narrower than the accusation

Nothing on this page says that counterfeiting occurred. The claim is the narrower and harder one: for the length of two windows the property that would have ruled it out did not hold, and no analysis performed afterwards can restore it. The balances still sitting in those two pools are the measure of what remains unresolved, and this site publishes them as an open quantity rather than as an accusation.

unprovablepublic aggregateno identity claim

16 marketing claims are set against the same record on Contradictions, and the same events sit on one axis with the funding and governance strands on the timeline.