The withdrawal came days after Zcash disclosed a long-standing Orchard vulnerability that could have enabled undetectable counterfeit ZEC, intensifying scrutiny of shielded balances and supply integrity.
An unknown address withdrew roughly 1% of all ZEC held in Zcash’s shielded Orchard Pool on Wednesday, according to Arkham, which said the pool still theoretically holds about 3.88 million ZEC worth roughly $1.65 billion. The move came six days after Zcash disclosed an Orchard circuit vulnerability that had triggered a 38% drop in ZEC before the token rebounded nearly 70% from its low, with prices cited around $422 after falling to the $280 level. Zcash disclosed the flaw on June 5 after security researcher Taylor Hornby identified it on May 29 with help from Anthropic’s Opus 4.8 AI model. Shielded Labs said the exploit, demonstrated in a controlled environment, could have allowed unlimited counterfeit ZEC to be created in an attacker’s wallet without leaving traces if used on the live network. The issue had existed since Orchard launched in May 2022. The withdrawal has fueled speculation about who controls large shielded balances and whether the move reflects selling, internal fund transfers, or precautionary asset management after the bug disclosure. Shielded Labs said it believes the exploit was not used, though Orchard’s privacy design makes it impossible to prove definitively. The group has proposed a new shielded pool and turnstile accounting for tokens exiting Orchard so the market can verify ZEC supply integrity more independently.