Summary:
Security researcher Taylor Hornby used Anthropic’s Claude Opus 4.8 to uncover a critical flaw in Zcash’s Orchard privacy pool that had existed since Orchard launched in May 2022. The bug could have allowed an attacker to create counterfeit ZEC that would appear valid, and because Orchard is designed for private transactions, Shielded Labs says there is no definitive cryptographic way to know whether it was exploited before the emergency fix on June 1, 2026. Shielded Labs is proposing a network upgrade using “turnstile accounting” to move Orchard coins through a verifiable checkpoint and prove whether counterfeit supply exists.
Why it matters:
The case highlights both the power of AI-assisted vulnerability research and the risk of undetectable flaws in privacy-focused cryptographic systems.
Entities:
Zcash, Orchard, Shielded Labs, ZODL, Taylor Hornby, Anthropic, Claude Opus 4.8, ZEC, zero-knowledge proofs, turnstile accounting
Article URL:
https://securityaffairs.com/193224/hacking/claude-opus-found-a-four-year-old-hole-in-zcashs-privacy-layer-nobody-knows-if-someone-already-used-it.html
Security researcher Taylor Hornby used Anthropic’s Claude Opus 4.8 to uncover a critical flaw in Zcash’s Orchard privacy pool that had existed since Orchard launched in May 2022. The bug could have allowed an attacker to create counterfeit ZEC that would appear valid, and because Orchard is designed for private transactions, Shielded Labs says there is no definitive cryptographic way to know whether it was exploited before the emergency fix on June 1, 2026. Shielded Labs is proposing a network upgrade using “turnstile accounting” to move Orchard coins through a verifiable checkpoint and prove whether counterfeit supply exists.
Why it matters:
The case highlights both the power of AI-assisted vulnerability research and the risk of undetectable flaws in privacy-focused cryptographic systems.
Entities:
Zcash, Orchard, Shielded Labs, ZODL, Taylor Hornby, Anthropic, Claude Opus 4.8, ZEC, zero-knowledge proofs, turnstile accounting
Article URL:
https://securityaffairs.com/193224/hacking/claude-opus-found-a-four-year-old-hole-in-zcashs-privacy-layer-nobody-knows-if-someone-already-used-it.html
- Category
- Cybersecurity

Comments