On July 28, the Zcash mainnet implemented the Ironwood update at block #3,428,143. This update introduced a new private transaction pool to replace Orchard, where a critical vulnerability was discovered in late May.
https://t.co/N3GWdyQipM
— Zcash Open Development Lab (@zodl_co) July 28, 2026
The flaw was discovered by Shielded Labs security engineer Taylor Hornby, who analyzed the code using Anthropic’s Opus 4.8 AI model. The issue had existed since the pool’s launch in May 2022 and theoretically allowed the undetected creation of counterfeit ZEC. In the test network, the researcher successfully generated coins using a working attack code.
The team addressed the vulnerability in early June through a two-step process: a soft fork temporarily disabling transactions in Orchard, followed by a hard fork that restored operations. Developers found no signs of exploitation. However, the private pool’s design does not allow cryptographic proof of this, as transaction amounts are concealed, making it impossible to determine if fake coins were created.
How Ironwood Addresses the Issue
The update resolves the issue by implementing checks at the pool’s boundary. Orchard has been put into a restricted mode: no new funds can enter, and existing coins are locked from internal transfers—withdrawals are only possible through a “turnstile” in Ironwood.
The protocol includes a mechanism ensuring that no more ZEC is withdrawn from the old storage than was deposited. As funds migrate, this will allow verification of emission integrity without accessing private transaction data. Ironwood operates on a corrected Orchard protocol, has undergone formal verification (mathematical model checking before deployment), and has passed an external security audit, according to Zcash.
What Users Should Do
The transition is implemented at the wallet level: apps supporting Ironwood will prompt users to transfer funds from the old storage. Creating a new wallet or changing addresses is unnecessary—incoming transfers to existing Orchard addresses are automatically redirected to the new pool.
In Zodl, migration is already available manually, with an automatic option promised later by developers. Users without assets in Orchard only need to update the app.
The upgrade’s launch did not significantly impact the ZEC price. The Ironwood deployment date was announced in advance—developers announced it on June 9. Over the past day, the coin’s price fell by 4.3% to $468.
Earlier, after the vulnerability was disclosed in early June, the ZEC price plummeted by 48% to $302.48.
