On July 28, the Zcash mainnet implemented the Ironwood update at block #3,428,143. This update introduces a new private transaction pool to replace Orchard, which was found to have a critical vulnerability at the end of May.
— Zcash Open Development Lab (@zodl_co) July 28, 2026
The vulnerability was identified by Taylor Hornby, a security engineer at Shielded Labs, who analyzed the code using the AI model Opus 4.8 from Anthropic. This issue had existed since the pool's launch in May 2022 and theoretically allowed for the covert generation of counterfeit ZEC. During testing, the researcher was able to produce coins through a working attack code.
The team addressed the vulnerability in early June through a two-step process: a soft fork temporarily disabled transactions in Orchard, followed by a hard fork that restored functionality. Developers found no evidence of exploitation; however, the design of the private pool does not allow for cryptographic proof of this: the amounts of transactions are hidden by design, making it impossible to determine if fake coins were created based solely on the transactions.
How Ironwood Will Address the Issue
The update resolves the issue by implementing checks at the pool's boundaries. Orchard has been switched to a restricted mode: no new funds will be added, and existing coins are locked for internal transfers—withdrawals can only occur through a "turnstile" in Ironwood.
A protocol-level mechanism has been built in to ensure that no more ZEC is withdrawn from the old storage than was deposited into it.
As funds migrate, this will allow for the verification of emission integrity without access to private transaction data. Ironwood operates on a corrected version of the Orchard protocol, having undergone formal verification (mathematical checks prior to deployment) and a third-party security audit, according to Zcash.
What Users Should Do
The transition is being facilitated at the wallet level: applications supporting Ironwood will prompt users to transfer funds from the old storage. There is no need to create a new wallet or change addresses—incoming transfers to existing Orchard addresses will automatically redirect to the new pool.
At Zodl, the migration is already available manually, with developers promising an automated option later. Users without assets in Orchard simply need to update their application.
The launch of the upgrade had a minimal effect on ZEC's price. The date for deploying Ironwood was announced in advance, as developers shared the information on June 9. Over the past day, the coin's value dropped by 4.3% to $468.
Hourly chart of ZEC/USDT on Binance. Source: TradingView.It is worth noting that after the vulnerability was revealed in early June, ZEC's price plummeted by 48%, falling to $302.48.