On 2026-06-05 Shielded Labs disclosed a soundness bug in the Orchard proof circuit — a value-balance constraint written too loosely — that had existed since Orchard launched in 2022 and could, in theory, have let an attacker mint counterfeit ZEC inside the shielded pool with no on-chain signature. It was found 2026-05-29 (by Taylor Hornby, using Anthropic's Opus 4.8) and patched 2026-06-01. ZEC fell ~38%. Shielded Labs stated there is "no definitive way to determine" whether it was exploited, because Orchard's privacy hides it.
That "no on-chain signature" is the crux: minting counterfeit notes does not change the pool's declared value. The counterfeit only becomes visible when it is deshielded — crossing the "turnstile", the consensus rule that a pool can never hold negative value. So the turnstile is the only detection surface, and the sharpest attack is exactly the one asked about: deshield the fake value under the cover of incoming legitimate shields, keeping the pool balance plausible so it never goes negative. This page reconstructs Orchard's entire per-block flow history and tests it for that fingerprint.
A composite of the signals below. Only a turnstile breach is hard proof and would peg it to 100 (red); every other signal is confounded by legitimate behaviour, so a clean turnstile caps the needle in the inconclusive band. Updates as new blocks land.
The hard guarantee. If cumulative deshields ever exceeded cumulative shields+migrations, the pool balance would go negative. It never has.
Every unit that left Orchard was backed by a unit that entered earlier — the green line stays above the orange, and the gap is the live balance.
The attack: deshield counterfeit value, but only when incoming legitimate shields refill the pool, so the balance never drops suspiciously. If that happened, deshielding would trail shielding — a correlation peak at a short positive lag (deshield a day or two after the cover arrives). The confound is real and must be stated plainly: shields and deshields are both driven by overall activity, so some same-day correlation is expected regardless (busy days have more of both). The tell-tale is therefore not the correlation's size but its shape: a lopsided lean toward positive lags. We report the excess of positive-lag over negative-lag correlation as the "masked-deshield" component of the index — but even a positive lean is equally explained by ordinary behaviour (people deshield in the days after they transact), so it can raise a flag, never settle the question.
Pearson r between daily shields and deshields, deshield offset by lag days. Symmetric peak at 0 = co-activity; a lean toward lag > 0 = deshields following shields.
If a large counterfeit stash sat in Orchard, the rational move once the bug was public (and un-mintable after the 2026-06-01 patch) is to cash it out to transparent fast. The opposite — the pool retaining most of its value and draining only slowly — is the single most reassuring observation available, and the one the index weighs. Caveat, stated bluntly: a post-disclosure surge in deshielding is also exactly what a −38% crash produces from ordinary holders fleeing, so gross deshields can't be pinned on an attacker; we net out concurrent re-shielding and Ironwood migration and look at what the pool actually lost.
Extraction is throughput-limited: value can only leave Orchard as fast as deshield transactions are actually made. Even at the elevated post-disclosure pace, fully draining the current pool to transparent would take the time below — a sustained, highly visible outflow, not an instant exit. This bounds how quickly any counterfeit could have been realised and means a large exploit would show as a long, conspicuous deshield wave.
The leading digit of naturally-occurring amounts follows Benford's law. Fabricated/structured amounts often don't. This checks every per-block Orchard→transparent deshield (≥ 0.001 ZEC).
Loading the full Orchard flow history.