preferred on
Points of Focus
- Zcash coinholders approved two $750,000 grants tied to Taylor Hornby’s discovery of a critical Orchard counterfeiting bug.
- The flaw existed from May 2022 until June 2026, with no evidence found that it was exploited.
- Hornby found the bug three days after Zcash closed its formal bounty program over a flood of low-quality AI-assisted reports.
Zcash (ZEC) holders have approved one of crypto’s largest community-funded security rewards after researcher Taylor Hornby uncovered a vulnerability capable of undermining the cryptocurrency’s supply integrity.
The Q3 Coinholder-Directed Retroactive Grants vote approved two $750,000 awards connected to Hornby’s discovery: the Orchard Counterfeiting Vulnerability Bug Bounty and an additional community-nominated bonus. Together, they give Hornby a $1.5-million reward, subject to the program’s remaining compliance and payout procedures.
Zcash just gave away more than $8m in retroactive grants, including millions of dollars of retroactive grants to a lot of people who selflessly worked to protect all users during the AI bug crisis this year.
But that’s not even the best thing about what just happened… ⤵️ pic.twitter.com/yRtVUvkt5y
— zooko🛡🦓🦓🦓 ⓩ (@zooko) October 1, 2026
One bug could have created counterfeit ZEC
Hornby discovered the vulnerability on May 29 while conducting an AI-assisted security audit of Zcash’s Orchard shielded protocol.
The flaw affected Orchard’s zk-SNARK circuit and could have allowed an attacker to violate balance rules and create counterfeit notes inside the shielded pool without the inflation being immediately visible.
Zcash’s own technical documentation notes that the vulnerability created the potential for “balance violation and theft of funds.” Developers responded by temporarily disabling Orchard transactions before deploying a corrected circuit through the NU6.2 network upgrade.
The vulnerability had potentially been exploitable for years.
Project Tachyon said there are several reasons to believe nobody discovered or exploited it before Hornby, although Orchard’s privacy means historical counterfeiting couldn’t simply be ruled out by inspecting every shielded transaction.
That uncertainty prompted further work to audit Orchard’s supply and strengthen the protocol.
$1.5-million reward came after the work was done
The reward itself is almost as unusual as the vulnerability.
Rather than receiving a predetermined bounty, Hornby submitted his work to Zcash’s retroactive grants system, where coinholders vote on whether completed contributions deserve funding.
Coinholders approved his original $750,000 bounty request and a separate $750,000 bonus proposal, bringing the combined award to $1.5 million.
The timing adds another twist.
Zcash’s formal bug bounty had reportedly been closed shortly before Hornby’s discovery following problems with low-quality AI-generated vulnerability submissions. Hornby then used AI as part of the auditing process that found one of the network’s most consequential bugs.
The episode exposes both sides of AI-assisted security: Cheap automated reports can overwhelm maintainers, while skilled researchers can use the same technology to find flaws traditional audits missed.
Zcash is paying for security after the crisis
Hornby’s $1.5 million was only part of the community’s response.
Coinholders also approved $738,942 for Project Tachyon’s Ironwood formal-verification work, $599,000 for external Ironwood audits, $1.203 million for Valar Group’s Ironwood work, and $1.95 million for Zcash Open Development Lab’s protocol development.
Ironwood was designed partly to address the lingering supply-integrity problem created by the Orchard vulnerability. Project Tachyon said formal verification now provides substantially stronger assurance against another undetectable counterfeiting flaw in the new system.
The $1.5-million payment does more than reward one researcher.
It puts a price on responsible disclosure. Hornby found a vulnerability that could have been vastly more valuable if exploited than reported. Zcash holders have now effectively voted that protecting the network should be financially valuable, too.
Share
Most read articles
