Zcash in October 2026: A Bug, a New Pool, an ETF and 25-Second Blocks

On 15 October 2026 ZEC traded at about $1,128, down 11% on the day. In mid-September it had reached $1,249, its highest price since 2016. Two years ago it was around $16. In between, Zcash found a flaw that could have let anyone counterfeit ZEC without detection, shipped two emergency upgrades and a new shielded pool, and saw its price fall about 40% in a matter of days. It also got a US-listed ETF, and it is three weeks from the largest change to its block schedule since 2019.

This is the fifth post in our October series, after Bitcoin, Solana, Ethereum and stablecoins. As before, supply is computed from the protocol rules rather than taken from an aggregator, every other figure is sourced and dated, and anything that could not be reconciled is left out.

The snapshot

Supply: bitcoin's schedule, with a few twists

Zcash copies bitcoin's monetary design: a 21 million cap and a subsidy that halves every four years. Two early details shift the numbers. The first 20,000 blocks paid a ramping "slow start" reward. And in 2019 the Blossom upgrade cut block time from 150 to 75 seconds while halving the per-block reward, so issuance per hour stayed the same. Adding it up block by block gives about 16.99 million ZEC issued at block 3,518,163. That is roughly 80.9% of the cap, and Blockchair's market data and the shielded-pool trackers imply the same figure.

The subsidy has been 1.5625 ZEC per block since the November 2024 halving, and the next halving falls around November 2028. Not all of it goes to miners. Under NU6.1, which activated on 24 November 2025, 20% of each block reward funds development until that 2028 halving. 8% goes to Zcash Community Grants, and 12% accrues in an in-protocol "lockbox" that coinholders control directly. Spending from it needs a quorum of 420,000 ZEC and a simple majority. Miners receive the remaining 80%.

Privacy is optional, and most ZEC is not private

Zcash has two kinds of address. Transparent addresses work like bitcoin's: sender, receiver and amount are all public. Shielded addresses use zero-knowledge proofs, so the network can check that a transaction is valid without seeing who sent what to whom. Shielded funds sit in pools, one for each generation of the cryptography.

29.2% of all ZEC was shielded on 14 October. Most ZEC still sits in transparent addresses, largely because exchanges and custodians hold it that way. A coin is only as private as the pool it is in. The share in shielded pools is the number that measures whether Zcash's privacy is actually being used.

The Orchard bug

Orchard was the shielded pool Zcash launched in May 2022. On 29 May 2026, during a Shielded Labs audit, researcher Taylor Hornby found a soundness flaw in its zero-knowledge circuit. Blockhead reported that he used Anthropic's Claude in the work. In principle, the flaw let an attacker create ZEC inside the pool out of nothing. Because shielded balances are hidden, nobody would have seen it happen.

• 2 June: an emergency soft fork disabled Orchard transactions.
• 3 June: NU6.2 activated at block 3,364,600 with a corrected circuit and restored Orchard.
• Early June: ZEC fell from above $600 to below $350, roughly 40%, and kept falling after the fix shipped.
• 28 July: Ironwood (NU6.3) activated at block 3,428,143. It opened a new pool on the fixed and formally verified circuit, made Orchard exit-only, and added a "turnstile" that meters coins leaving Orchard.

No evidence that the flaw was exploited has been found. The design of the fix matters more than that reassurance, though. A counterfeit in a hidden pool cannot be ruled out just by looking. It can only be caught when coins leave. The turnstile does exactly that: if more ZEC ever tried to exit Orchard than had entered it over its lifetime, the difference would show up. Holders have been moving across. When Ironwood launched, about 3.6 million ZEC sat in Orchard. By mid-October only about 350,000 was left, and Ironwood held 4.11 million.

The lesson applies beyond Zcash. In any system that hides balances, a soundness bug is a supply bug, and supply can only be audited at the boundary. Ironwood also includes recoverable notes under ZIP 2005, preparation for a future in which quantum computers could break today's elliptic-curve keys.

NU7: 25-second blocks on 5 November

The next upgrade, NU7, activated on testnet on 6 October. The mainnet target is 5 November 2026, and the final activation height is due to be fixed on 20 October.

• Block time falls from 75 seconds to 25 (ZIP-218). The subsidy per block is cut in proportion, so issuance per hour does not change and the halving schedule stays on its dates. Coinholder sentiment polls backed the faster blocks with 99.9% and keeping the halving schedule with 98.9%, with about 2.4 million ZEC taking part.
• The Network Sustainability Mechanism arrives. Under ZIP-235, 60% of transaction fees are removed from circulation. Under ZIP-234, removed coins are reissued gradually, starting in February 2031.
• The older v4 transaction format is disabled, continuing the retirement of Sprout-era features.
• The upgrade ships in Zebra, the Zcash Foundation's node. zcashd, the original node software, is deprecated. Node, indexer and block-explorer operators must update. Wallets should need little or no change.

For payments, 25-second blocks mean a first confirmation three times faster than today. A merchant waiting for, say, ten confirmations would wait about four minutes instead of twelve. Fees are already small. Under ZIP-317 a simple transaction pays 0.0001 ZEC, about 11 cents at mid-October prices.

Institutions arrive

Grayscale's Zcash Trust became an exchange-traded fund on NYSE Arca under the ticker ZCSH on 25 August 2026. It is the only US-listed product offering spot ZEC exposure, and it charges a 2.5% annual fee. Its net assets were about $677 million on 13 October. Flows go both ways. The fund had $6.85 million of net redemptions over 12 and 13 October. A second fund backed by the Winklevoss twins has been proposed.

Cypherpunk Technologies, a Nasdaq-listed company that began buying ZEC after an October 2025 private placement led by Winklevoss Capital, held 323,394 ZEC as of 11 August. That is about 1.9% of supply, bought at an average of $341.83, and the company has stated a target of 5%. It has also agreed to buy a mining fleet that would give it roughly 18% of Zcash's hashrate. One company holding that much of both the supply and the mining power is a concentration worth watching.

Regulation: the EU closes the regulated door in 2027

The EU's Anti-Money Laundering Regulation applies from 10 July 2027. From that date, crypto-asset service providers and credit institutions may not hold or transact in anonymity-enhancing coins. In practice, ZEC, Monero and similar assets must come off EU-regulated exchanges and custodians. Owning them and keeping them in self-custody stays legal. Whether optional privacy is enough to fall outside the rule has not been tested. Exchanges' delistings so far have treated ZEC alongside Monero.

The US is moving the other way: a listed ETF and a listed treasury company now hold ZEC. That split will shape where Zcash liquidity sits from 2027 onward. EU users who want ZEC would have to use self-custody and non-EU platforms. That would tend to make their activity less visible to EU regulators, not more.

What this means for payments

Zcash is the longest-running live system for private payments that can still be audited. A shielded transaction can carry a viewing key, so an auditor or a counterparty can see what the public cannot. That is the kind of confidentiality businesses want for payroll and supplier payments, and that public stablecoin chains do not offer by default. The constraints are real, though. Most liquidity is on exchanges that hold ZEC transparently. The EU will remove it from regulated platforms in 2027. And the asset is volatile: it fell about 40% in early June, then more than tripled by mid-September. For now, Zcash is a reference design for private settlement more than a settlement currency. Payment privacy is likely to reach mainstream rails through systems that copy its ideas, such as confidential-transfer features on stablecoin chains, rather than through ZEC itself.

How these numbers were checked

• Issued supply is computed from Zcash's subsidy schedule at block 3,518,163. It is cross-checked against Blockchair's price and market cap and against the shielded-pool tracker's implied total. All three agree to within about 0.1%.
• Shielded pool balances come from zeczcash.com at block 3,518,049 (14 October 2026).
• Upgrade dates and heights come from the reports linked in each section. NU7's 5 November date is a target until the activation height is fixed on 20 October.
• The development-fund lockbox balance is omitted because the published figure could not be reconciled with the funding schedule without disbursement records.