Background
On 29 May 2026, security engineer Taylor Hornby, engaged by Shielded Labs, discovered a critical vulnerability in Zcash's Orchard shielded pool using AI-assisted cryptographic analysis. Full details were disclosed publicly on 5 June 2026, following an emergency remediation hard fork activated on 3 June 2026.
The Zcash Vulnerability
A flaw in the elliptic curve verification logic within the Orchard zero-knowledge proof circuit could have been exploited to create an unlimited amount of counterfeit ZEC within Orchard. A working proof of concept exploit was constructed by Shielded Labs and tested to be confirmed as a security vulnerability that has been present in the Zcash Orchard codebase since 2022.
Zcash developers deployed an emergency hard fork on 3 June 2026, which successfully patched the vulnerability. Work is ongoing to develop a method that would allow independent verification of ZEC supply integrity within the Orchard pool. See the Orchard Security Bug full report and work log for details.
Pirate Chain Is Not Affected
Pirate Chain (ARRR) is built on the Sapling shielded protocol and remains unaffected by the Zcash Orchard vulnerability. Orchard has not yet been implemented in the Pirate Chain codebase. The vulnerable code does not exist in Pirate Chain's codebase, and no variant of this exploit is possible on the current Pirate Chain network. No Pirate Chain (ARRR) funds have been compromised, and no exploit has occurred on Pirate Chain.
Looking Ahead
Orchard integration into Pirate Chain is not part of the current release. Pirate Chain's Orchard integration is currently underway and will uptake Zcash's Orchard bug fix, which will be extensively tested before any Pirate Chain Orchard release. No Orchard code will be deployed to Pirate Chain's mainnet until it has been thoroughly vetted.
The privacy, security, and integrity of the Pirate Chain network and its users' funds remain our highest priority.