Zcash Plunges 30% After Critical Orchard Bug Raises Counterfeiting Risk

Zcash (ZEC) plunged roughly 30% in 24 hours to around $400 after its core development steward, Electric Coin Co.’s nonprofit arm Shielded Labs, disclosed a critical bug that could have enabled 'unlimited counterfeiting' inside its Orchard privacy pool. The shock rippled across broader risk markets, with South Korean equities tumbling more than 6% on semiconductor weakness and foreign selling, while Solana (SOL) slid toward a 52-week low amid a wave of crypto liquidations.

The vulnerability centered on Orchard, the privacy circuit powering Zcash’s shielded transactions. According to Shielded Labs, the flaw was severe enough that an attacker could mint an unlimited number of counterfeit tokens—and, more alarmingly, the resulting inflation would have been effectively 'undetectable' to outside observers. For a cryptocurrency whose credibility rests on enforced scarcity, markets treated the disclosure as an existential threat to the asset’s monetary integrity, even as no confirmed exploitation was presented.

Shielded Labs said security engineer Taylor Hornby identified the issue on May 29 while auditing Orchard circuits with the help of Anthropic’s AI model 'Opus 4.8.' Hornby reportedly went beyond theoretical analysis, writing exploit code and successfully demonstrating unlimited minting in a local test environment. The organization emphasized that Hornby likely discovered the problem before malicious actors could weaponize it, but added that Zcash’s privacy design makes it impossible to cryptographically prove whether the flaw had been abused in the past.

The timeline intensified investor anxiety. Shielded Labs indicated the defect had existed since Orchard’s rollout in May 2022—meaning it may have persisted for years without detection. An emergency patch was deployed on June 1. The group also signaled further hardening measures, including 'turnstile accounting' and the introduction of more rigorous formal verification to reduce the chance that similar failures could hide inside complex zero-knowledge circuits.

Across traditional markets, South Korea’s benchmark KOSPI suffered a sharp early-session selloff on Thursday, with the index down 6.26% at 8,098.45 as of 12:22 a.m. ET (9:22 a.m. in Seoul), triggering a 'sidecar' mechanism that temporarily halts program trading orders. The KOSDAQ fell 3.84%, underscoring risk-off sentiment spilling into higher-beta segments of the local market.

The immediate catalyst was a bruising prior session in the U.S., where Broadcom ($AVGO) dropped more than 12% after disappointing earnings and a weaker-than-expected outlook for AI semiconductor revenue. The Philadelphia Semiconductor Index reversed lower after several sessions of gains, and the hit landed quickly in Korea given the market’s heavy dependence on chip exporters. Samsung Electronics ($005930.KS) slid 5.83% and SK hynix ($000660.KS) fell 7.70%.

Flow dynamics compounded the move. Foreign investors net sold about 885.1 billion won in KOSPI shares, extending a streak of net selling to 20 consecutive sessions—one of the longest runs on record. The Korean won weakened as well, with USD/KRW opening around 1,529 and reportedly pushing above 1,540 in overnight trading, fueling concern about capital outflows and tightening domestic financial conditions.

Crypto markets, already fragile, registered another leg down. Solana (SOL) traded around $67.80, briefly dipping to $66.6—near a 52-week low—leaving the token down roughly 74% from its yearly peak. The decline was accompanied by broad deleveraging across derivatives markets, after roughly $1.66 billion in crypto positions were liquidated, according to widely cited industry data. SOL fell about 17% on the day as key technical levels gave way, including the $70 psychological threshold and the $76.6 support zone.

Some analysts warned the next major inflection sits near $66, with a failure to hold potentially opening the door to a move into the high-$50 range. Adding pressure, U.S. spot Solana ETF products recorded a net outflow of roughly $12.7 million on June 3, marking the first notable withdrawal since May. Still, Solana Labs has continued to highlight ecosystem development efforts, including its incubator initiatives and the ongoing 'Firedancer' upgrade aimed at improving network performance and resilience.

Geopolitics offered only partial relief. President Trump said talks with Iran were progressing and suggested a possible agreement as soon as this weekend, while Israel and Lebanon reached a ceasefire agreement under U.S. mediation. Brent crude fell 2.84% to about $95.03 per barrel, easing inflation concerns and supporting a modest rebound in some risk assets. The S&P 500 rose 0.41% to 7,584.3, and Europe’s Stoxx 600 gained 0.52% to 624.45, while the U.S. dollar index slipped to 99.42 and the 10-year Treasury yield edged down to 4.47%.

However, the détente narrative remained fragile. Reports indicated Hezbollah rejected the proposed ceasefire framework and that clashes continued even after the announcement, leaving core flashpoints—such as the Strait of Hormuz and Iran’s nuclear program—unresolved. With liquidity conditions tightening and leverage still elevated across crypto derivatives, Thursday’s session underscored how quickly idiosyncratic protocol risks—like Zcash’s Orchard bug—can collide with macro volatility to amplify drawdowns across digital assets.