Crypto Potato 2026-06-10 07:08:21

How One Guy Used Claude Code to Discover a Billion-Dollar Bug

Taylor Hornby, a security researcher who works with Shielded Labs, discovered a bug on May 29, 2026 – just one day after Anthropic released Opus 4.8- that resulted in billions of dollars removed from the project’s market capitalization. The flaw affected a shielded pool within the protocol’s design that powered private Zcash transactions, and was serious enough to trigger an emergency response across the entire ecosystem. It resulted in a sudden sell-off that saw ZEC’s price crash by roughly 60%, thereby erasing more than $4 billion in market cap. The short version of the story is relatively simple: a missing constraint in Zcash’s Orchard circuit could have allowed a malicious prover to spend the same shielded note many times over while producing different nullifiers. In practice, this means an attacker could have inflated ZEC within the Orchard pool without leaving an on-chain fingerprint. The scary part is that this bug has existed since Orchard went live, and this happened in May 2022. Therefore, the total exposure window lasted for around four years, before it was ultimately patched shortly after Hornby discovered it. AI Helped Find The Critical Vulnerability This story isn’t just about the flaw, but the way it was found. Hornby said he used a custom “zcash-full-stack-auditor” agent framework with Claude Opus 4.8. It was designed to work at maximum effort and was pointed at the halo2 implementation, including the Orchard circuit. The AI was searching for soundness and zero-knowledge security issues. The researcher reported that around 6 p.m. on May 29, one of the audit agents flagged a vulnerability that it believed could be used to double-spend Orchard notes. Hornby then used Claude to help write proof-of-concept code against a similar circuit, before testing the issue against the real Orchard circuit. Testing the Exploit with Claude Hornby later built a full test in Zcash’s local regtest mode, where the exploit doubled the value of an Orchard note until the test wallet balance exceeded 10 million ZEC. These transactions were never broadcast to mainnet or testnet, of course, but the test itself was significant because regtest applies the exact same validation rules, meaning that it could have been done on mainnet with the same degree of success. Per the official disclosure, the full PoC took roughly six hours to develop using Claude Code’s help. Hornby said the model needed relatively little guidance beyond a few hints. Of course, it’s important to understand that this doesn’t mean that AI independently “hacked Zcash.” Taylor Hornby is a renowned specialist security researcher. That audit was targeted, and the tools were custom-built. Still, the case shows how some frontier AI models are beginning to significantly reduce the time required to investigate highly complex, technical systems. The post How One Guy Used Claude Code to Discover a Billion-Dollar Bug appeared first on CryptoPotato .

La maggior parte ha letto le notizie

Whales Turn Bullish on Zcash (ZEC)—Can This F...
2026-06-10
Why is SIREN’s price down today? $0.70 suppor...
2026-06-10
XRP Slips Toward $1.10 as Ripple Taps RLUSD t...
2026-06-10
Solana Institute CEO Pushes Senate to Pass CL...
2026-06-10
XRP, XLM, and LINK Get Featured in Brand New...
2026-06-10
Solana Defends $63 as CME Adds SOL Index Futu...
2026-06-10
May Jobs Report Kills Rate Cut Hopes: Bitcoin...
2026-06-10
Indian Rupee Holds Ground Against US Dollar D...
2026-06-10

Leggi la dichiarazione di non responsabilità : Tutti i contenuti forniti nel nostro sito Web, i siti con collegamento ipertestuale, le applicazioni associate, i forum, i blog, gli account dei social media e altre piattaforme ("Sito") sono solo per le vostre informazioni generali, procurati da fonti di terze parti. Non rilasciamo alcuna garanzia di alcun tipo in relazione al nostro contenuto, incluso ma non limitato a accuratezza e aggiornamento. Nessuna parte del contenuto che forniamo costituisce consulenza finanziaria, consulenza legale o qualsiasi altra forma di consulenza intesa per la vostra specifica dipendenza per qualsiasi scopo. Qualsiasi uso o affidamento sui nostri contenuti è esclusivamente a proprio rischio e discrezione. Devi condurre la tua ricerca, rivedere, analizzare e verificare i nostri contenuti prima di fare affidamento su di essi. Il trading è un'attività altamente rischiosa che può portare a perdite importanti, pertanto si prega di consultare il proprio consulente finanziario prima di prendere qualsiasi decisione. Nessun contenuto sul nostro sito è pensato per essere una sollecitazione o un'offerta