Someone just pulled approximately 202,000 ZEC out of Zcash’s Orchard shielded pool in a single transaction. That’s about 1% of the pool’s total holdings, which currently sit at roughly 3.88 million ZEC after the withdrawal.

The bug that nobody caught for four years

On May 29, 2026, security researcher Taylor Hornby disclosed a critical counterfeiting vulnerability in the Orchard protocol. The flaw could theoretically have allowed someone to create fake ZEC within the shielded pool, essentially minting coins out of thin air without anyone being able to detect it.

The bug had been sitting there, undetected, since the NU5 network upgrade in 2022. Zcash developers responded with emergency measures. They halted transactions in the Orchard pool, deployed a patch, and announced there was no evidence the vulnerability had actually been exploited.

Market reaction was brutal

ZEC’s price dropped more than 50% in the wake of the bug disclosure before staging a partial rebound.

Before the withdrawal, Orchard managed more than 4 million ZEC out of a total shielded supply of approximately 4.6 million ZEC. The pool remains by far the largest repository of shielded Zcash, making up about 30% of total ZEC supply.

Ironwood upgrade aims to rebuild trust

Zcash developers proposed a new network upgrade called Ironwood in response to the vulnerability. The upgrade would create an entirely new shielded pool with improved supply verification mechanisms and stricter enforcement rules, designed to prevent similar bugs from going unnoticed in the future.

What this means for investors

The fact that developers found no evidence of exploitation is reassuring but not conclusive, given the opacity of shielded transactions. The Ironwood upgrade timeline becomes the single most important variable for ZEC’s medium-term trajectory.

Tracking on-chain flows from this unshielding event will provide clues about whether large holders are reducing exposure or simply reorganizing their positions.