Zcash has rolled out the Ironwood update to enhance security after a critical vulnerability was found in its transaction pool.
Zcash's mainnet has successfully implemented the Ironwood update as of July 28, 2026, at block #3,428,143. This significant update replaces the Orchard transaction pool, which was discovered to have a critical security vulnerability in May.
— Zcash Open Development Lab (@zodl_co) July 28, 2026
The vulnerability was uncovered by Taylor Hornby, a security engineer at Shielded Labs, using the AI model Opus 4.8 from Anthropic. The flaw, existing since the launch of the Orchard pool in May 2022, theoretically enabled the covert creation of counterfeit ZEC coins. Hornby demonstrated this risk with a working attack code during testing.
To address the vulnerability, Zcash developers executed a two-step fix in early June: first, a soft fork disabled transactions in the Orchard pool, followed by a hard fork that restored functionality. Although there was no evidence of exploitation found, the private nature of the pool’s design prevents cryptographic proof of integrity, since transaction amounts are obscured.
Improvements Introduced by Ironwood
The Ironwood update introduces boundary checks for the transaction pool and places Orchard in a restricted mode, prohibiting new fund additions while locking existing coins for internal transfers. Withdrawals can only be made through a designated “turnstile” in Ironwood, ensuring that the amount of ZEC withdrawn does not exceed what was initially deposited.
This migration process will help verify the integrity of emissions without needing access to private transaction data. Ironwood utilizes a refined version of the Orchard protocol, which has undergone formal verification and a third-party security audit.
User Guidance for Transition
The transition to Ironwood will be facilitated at the wallet application level, where users will be prompted to transfer funds from the old storage. There is no requirement to create new wallets or change addresses, as incoming transfers to existing Orchard addresses will be redirected to the new pool.
Manual migration options are currently available at Zodl, with plans for an automated solution in the future. Users without funds in Orchard simply need to update their applications.
Despite the launch of the Ironwood upgrade, ZEC's price experienced a slight decline of 4.3% to $468. Following the revelation of the vulnerability in early June, ZEC's value had dropped by 48%, reaching $302.48.
