Zcash Fixes Critical Node Vulnerability Protecting $1.5M in ZEC

Developers of the privacy-focused cryptocurrency Zcash (ZEC) have successfully patched a critical security flaw in the network's node software that put approximately 25,000 ZEC at risk. The vulnerability, discovered by security researcher Alex "Scalar" Sol, could have allowed malicious actors to bypass transaction verification and illicitly withdraw funds from the legacy Sprout privacy pool. At current market rates, the potential loss was estimated at nearly $1.5 million, though developers confirm the exploit was never utilized.

Technical Details of the zcashd Vulnerability

The security flaw resided within the zcashd node software, affecting multiple versions released from July 2020 to the present. According to technical reports, the bug caused nodes to skip proof verification for specific transactions involving the deprecated Sprout pool. This oversight potentially enabled malicious miners to fabricate transactions and drain the remaining shielded balance of the pool.

• The vulnerability affected the Sprout legacy pool.
• It originated in software updates dating back to July 2020.
• A total of 25,000 ZEC was identified as being at risk.
• The fix was officially released in v6.12.0 on March 31, 2026.

Swift Response and Network Recovery

Following the private disclosure by Sol, Zcash developers expedited the release of patch v6.12.0. Major mining pools and network participants acted rapidly, deploying the update within three days of its release to secure the blockchain. To maintain the integrity of the total supply, Zcash utilizes a "turnstile" mechanism, which is designed to prevent the malicious inflation of tokens when moving funds between different privacy pools. This mechanism acts as a fail-safe to ensure that even if a pool is compromised, the total circulating supply of the cryptocurrency remains verifiable and capped.

Responsible Disclosure and Bug Bounty

The incident highlights the importance of white-hat security research within the decentralized finance ecosystem. For his role in identifying the flaw and following responsible disclosure protocols, Alex Sol was awarded a bounty of 200 ZEC. The Zcash ecosystem relies on these proactive security audits to maintain its reputation as a leading privacy-preserving blockchain that utilizes Zero-Knowledge Proofs (zk-SNARKs).

In conclusion, the timely intervention by developers and the coordination of the mining community have ensured that user funds remain safe. While the vulnerability existed for several years, the lack of exploitation suggests that the network's security monitoring remains robust. Zcash users are encouraged to ensure their node software is updated to the latest version to maintain optimal network security and synchronization.