Zcash’s Orchard pool sees major withdrawal after 70% rebound

An unknown address on Wednesday withdrew around 1% of all the ZEC in Zcash’s shielded Orchard pool. This comes six days after ZEC started rallying following a 38% decline that was caused by the discovery of a long-time vulnerability in the privacy pool itself. It led to speculation over who controls the large balances in the most secretive part of Zcash and what motivated them to make their withdrawal.

Arkham data shows that the remaining balance in the Orchard pool stands at around 3.88 million ZEC, estimated to be worth $1.65 billion at today’s prices. The price of ZEC has gained close to 70% since its recent drop following the discovery, as noted by Arkham.

The Bug that shook Zcash

On June 5, Zcash disclosed details on a vulnerability found in its Orchard circuit, which is the cryptographic tool that powers its most recent privacy pool. According to reports, security researcher Taylor Hornby identified the bug on May 29 with the help of the Opus 4.8 AI model by Anthropic.

The exploit was developed by Hornby in a controlled testing environment to create counterfeit ZEC without leaving any traces. Running this exploit against the live network of Zcash would have created unlimited amounts of counterfeit tokens in the attacker’s wallet, according to Shielded Labs.

This vulnerability has been around for almost four years since the launch of Orchard in May 2022. Over the four years, it had gone unnoticed, even after careful reviews by skilled cryptographers. According to Shielded Labs, the nature of Orchard makes it impossible for any cryptographer to prove whether this exploit has been used by any user previously. However, the organization strongly believes that exploitation did not happen because of the difficulties associated with finding the exploit and the short time frame between the discovery and the patch.

ZEC price fell to $280 levels due to this incident. Zcash is trading at an average price of $422 at press time.

Why do inflation Bugs matter?

A massive movement out of a shielded pool will always be traceable on Zcash’s public ledger, despite the pool itself protecting information related to senders, receivers, and transaction amounts. It’s this very tension that forms the essence of the story – a privacy coin’s most valuable feature, namely, confidentiality of transactions, coexisting with the possibility of tracking on the blockchain which allows Arkham to pinpoint a particular withdrawal within hours.

The identity of the wallet’s owner hasn’t been established yet. The movement may signal the transfer of a significant amount of ZEC to an exchange with the purpose of selling it, a redistribution of balances between wallets, or a change in money management in light of the vulnerability. No instant spike in the cryptocurrency’s price occurred after the transaction, although, as per BitcoinWorld, investors are following up on further activity on the address.

Quinten van Welzen from Zano stated that Inflation vulnerabilities are among the most important issues in privacy-focused networks because they directly affect trust in the asset within some of the industry’s most sophisticated cryptographic systems. He added that one of the challenges is that the systems used to protect user privacy are often significantly more complex than those found in transparent networks.

Shielded Labs suggested rolling out a blockchain update to implement a new shielded pool, along with turnstile accounting for all tokens moved from Orchard. This way, everyone will be able to verify the authenticity of the supply of ZEC without relying solely on Shielded Labs’ assurance that the exploit wasn’t abused.

The company will also continue to grow its security bench. These include further cooperation with Hornby, a verification program that would involve generating a mathematical proof that there are no more flaws in the Orchard circuit, and two new staff members, namely a Head of Security and a Cryptographer, as announced by Shielded Labs.

The smartest crypto minds already read our newsletter. Want in? Join them.