Zcash activates Ironwood upgrade, sealing potentially compromised pool

Jul 27, 2026

Zcash has activated its Ironwood network upgrade to address a critical counterfeiting vulnerability in its old Orchard shielded pool. The upgrade seals the $1.7B pool, trapping any potential fake coins with a "turnstile" mechanism, and introduces a new, formally verified pool with quantum-resistant features. Users must now migrate their funds to the new system.

Orchard pool vulnerability

▪A critical vulnerability discovered in May in Zcash's Orchard shielded pool could have allowed an attacker to create counterfeit ZEC.
▪The flaw, which existed since the Orchard pool's launch in 2022, would have left no on-chain trace if exploited.
▪Evidence suggests the Orchard vulnerability was not exploited, as the pool's balance grew steadily while the flaw was active.
▪The vulnerability was discovered by Shielded Labs researcher Taylor Hornby using an AI model.
▪The discovery of the flaw caused ZEC's price to fall by over 38%, with one report stating it shed over half its value.

Ironwood upgrade deployment

▪Zcash activated the Ironwood network upgrade (formally NU6.3) on July 28, 2026, at block height 3,428,143.
▪The upgrade was proposed by Zcash founder Zooko Wilcox as a definitive repair for the counterfeiting vulnerability.
▪The Ironwood upgrade replaces the compromised Orchard shielded pool with a new, secure one that started with a balance of zero ZEC.

Formal verification process

▪The Ironwood upgrade also introduces quantum-resistant transaction records to reduce future security risks.
▪The new Ironwood pool's protocol has undergone formal verification, a mathematical process to prove its code is correct.
▪The verification produced a public Lean proof with over 2,700 theorems, guaranteeing "balance integrity" against counterfeiting bugs.

Orchard pool sealing mechanism

▪A "turnstile" mechanism caps total withdrawals from the Orchard pool to the amount that was verifiably deposited.
▪Users must voluntarily migrate their funds from the old Orchard pool to the new Ironwood pool.
▪This turnstile system is designed to permanently trap any potential counterfeit coins inside the sealed Orchard pool.
▪Privacy provider Nym warned that migrating funds without tools like Tor could expose a user's IP address and wallet balance.
▪The Ironwood upgrade sealed the old Orchard pool, which held approximately 3.7 million ZEC (worth $1.7 billion) and is now closed to new deposits.

Future NU7 upgrade plans

▪The NU7 upgrade also intends to double the shielded transaction capacity per block, resulting in a ~6x increase in throughput.
▪Zcash's next planned upgrade, NU7, aims to reduce block times from 75 seconds to about 25 seconds.