Zcash’s ZEC token has fallen more than 36% from recent highs after developers disclosed a critical vulnerability in the network’s Orchard shielded pool, pushing the cryptocurrency toward a key long-term support area around $367.
According to information released by Shielded Labs and the Zcash Open Development Lab, security engineer Taylor Hornby discovered the flaw on May 29 and reported it to developers, who responded with an emergency hard fork activated on June 3 to eliminate the risk.
The disclosure has nevertheless triggered a sharp market reaction.
ZEC traded near $390 on Thursday after briefly changing hands above $611 earlier this week, wiping more than $3 billion from its market capitalisation.
Data shared by Shielded Labs showed the vulnerability affected the cryptographic circuit underlying the Orchard privacy pool.
Hornby, assisted by Anthropic’s Claude Opus 4.8 model, identified a flaw in an elliptic curve multiplication check and successfully built a proof-of-concept exploit capable of generating counterfeit ZEC.
Researchers at Shielded Labs said that if the same exploit had been executed on the live network before the patch, it could have produced “unlimited, undetectable counterfeit ZEC” inside an Orchard wallet.
Traders focus on support levels after selloff
Although developers have fixed the vulnerability, uncertainty remains because Orchard’s privacy design makes it impossible to cryptographically prove whether the flaw was exploited before disclosure.
Shielded Labs stated that it is “not overly concerned” about prior abuse because the bug survived years of expert review and required a highly targeted investigation using advanced tools and artificial intelligence to uncover.
Even so, traders appear focused on downside risks.
Market data shows ZEC has broken below its 20-day, 50-day and 100-day exponential moving averages following the disclosure.
ZEC/USDT 1-day price chart. Source: TradingView.
The next major technical level sits near the 200-day exponential moving average around $367, a region that also aligns with a historically high-volume trading zone on the volume profile.
Momentum indicators have also weakened. Daily RSI has dropped to roughly 37, its lowest level in several weeks.
ZEC/USDT 1-day price chart. Source: TradingView.
Although the reading has not yet entered oversold territory below 30, it shows that selling pressure remains elevated after the Orchard disclosure.
The Bollinger Bands also show how stretched the move has become, with ZEC pressing near the lower band after losing the middle band during the selloff.
The lower band sits near the high $300s, close to spot price, while the upper band remains far above current levels after the recent spike above $600. Combined with an RSI near 37, the setup shows heavy downside momentum.
CoinGlass liquidation data indicates that much of the leveraged long positioning has already been cleared out during the decline.
ZEC 24-hour liquidation heatmap. Source: Coinglass.
Remaining liquidation clusters are concentrated above the current market price, particularly between $430 and $500, with larger pockets extending toward the $550 region.
Those levels could attract price if buyers return, though current market attention remains fixed on whether the $367 area can hold.
Beneath the current trading range, volume profile data indicates another historically active trading zone between approximately $220 and $260, where ZEC spent several months consolidating earlier this year.
If the $367 region fails to hold, traders could begin monitoring that lower volume cluster as the next major area of historical support.
However, not everyone believes the worst-case scenario occurred.
Arthur Hayes, co-founder of BitMEX, said on Friday that illegal minting of ZEC through the Orchard flaw was unlikely, although he acknowledged there is no formal cryptographic proof that it never happened.
“Sadly, due to the Orchard Pool exploit, I had to dump our entire ZEC bag,” Hayes wrote on X.
“The Holy Trinity is dead,” he added, referring to Zcash, Hyperliquid and Near Protocol, which he said he had sold this week.
Industry participants noted that similar risks have appeared before across privacy-focused systems.
Mert Mumtaz, co-founder and chief executive officer of Solana infrastructure company Helius, said variants of the same issue exist across many privacy protocols because complex zero-knowledge circuits can contain bugs that are difficult to detect.
“This same FUD comes back every five months as new people learn how privacy pools work,” Mumtaz wrote.
The current incident is not the first counterfeiting-related concern for Zcash.
In 2018, the Electric Coin Company discovered a vulnerability in the cryptography underpinning zk-proofs and later remediated the issue without any known losses.
As questions linger over whether the Orchard flaw was ever exploited, Shielded Labs said it is working with Zcash developers on a network upgrade that would allow users to verify the integrity of the circulating ZEC supply and prove the absence of counterfeit coins in the Orchard pool.
The post Zcash crashes 36% on Orchard vulnerability, traders eye $367 support appeared first on Invezz
