Zcash activated its Ironwood (NU6.3) network upgrade on July 28, 2026, at block height 3,428,143, sealing the Orchard shielded pool containing approximately 3.66 million ZEC — worth roughly $1.7 billion at current prices — and opening a new shielded pool starting from zero. The upgrade was develo...
"The flaw had been live since Orchard launched in May 2022." — CoinDesk Tech Desk, July 28, 2026
Zcash activated its Ironwood (NU6.3) network upgrade on July 28, 2026, at block height 3,428,143, sealing the Orchard shielded pool containing approximately 3.66 million ZEC — worth roughly $1.7 billion at current prices — and opening a new shielded pool starting from zero. The upgrade was developed in 60 days following the May 29 disclosure of a counterfeiting vulnerability in the Orchard zero-knowledge proof circuit, a flaw that had gone undetected for four years despite multiple professional audits.
The vulnerability, discovered by security researcher Taylor Hornby using Anthropic's Claude Opus 4.8 AI model, could have theoretically allowed unlimited ZEC minting inside the shielded pool with no on-chain trace. No evidence of exploitation has been confirmed. The Ironwood upgrade introduces a turnstile mechanism that caps withdrawals from the sealed Orchard pool to verifiable deposits, formal verification of the proof circuit using the Lean theorem prover, and quantum-recoverable note structures under ZIP 2005.
ZEC traded at $462.93 on July 28, down 5.33% in 24 hours and 14.88% over the prior week, despite the successful activation. The token remains approximately 64% below its October 2025 cycle high near $1,290.
On May 29, 2026, Taylor Hornby — a security researcher contracted by Shielded Labs the previous month — identified an under-constrained element in the Orchard Action zero-knowledge proof circuit. The flaw allowed mathematically invalid inputs to pass an elliptic-curve check that should have rejected them. Within a single day, Hornby wrote a working exploit and verified it produced unlimited counterfeit ZEC on a local testnet.
The discovery was AI-assisted. Hornby paired Anthropic's Claude Opus 4.8 model, released one day prior, with a custom auditing framework designed to probe the Orchard circuit for constraint weaknesses. The bug had been present since the Orchard pool launched in May 2022 — roughly four years in live production code, surviving reviews by multiple teams of cryptographers.
Hornby privately disclosed the issue to Zcash founder Zooko Wilcox on May 29. A patch shipped on June 1. An emergency hard fork activated on June 3 to enforce the fix network-wide. On June 5, Shielded Labs made the vulnerability public. ZEC dropped approximately 38–40% in the 48 hours following public disclosure, falling from approximately $610 to a low near $368 by late June according to market data at the time.
The Orchard pool's design made it impossible to determine whether the vulnerability had been exploited. Shielded transactions by definition leave no auditable trail. A CoinDesk Research report published in July found no on-chain evidence of exploitation, but acknowledged the inherent limitation of analyzing privacy pool integrity post-hoc.
Ironwood was developed in approximately 60 days — an accelerated timeline for a protocol that typically plans upgrades over 6–12 month cycles. The upgrade reuses the Orchard Action structure and Halo2 proof system but introduces its own note commitment tree, nullifier set, chain value pool, and chain-history metadata, all delivered through a new v6 transaction format.
Three architectural changes define Ironwood relative to its predecessor:
Formal Verification. The Ironwood proof circuit specification underwent formal verification using the Lean theorem prover, in collaboration with zkSecurity and the Zcash Open Development Lab. The approach verifies the mathematical correctness of the cryptographic specification rather than auditing implementation code. According to the development team, this is sufficient to rule out the class of undetectable counterfeiting bugs that affected Orchard, provided standard cryptographic assumptions hold.
Quantum-Recoverable Notes. Under ZIP 2005, each coin's on-chain record is structured for future recovery if quantum computers eventually break the elliptic-curve cryptography currently securing Zcash shielded pools. This does not make Zcash quantum-secure today. It creates a migration path that preserves fund recovery in a post-quantum scenario.
Supply Verifiability. Ironwood was designed to make it possible for every user to independently verify the soundness of ZEC circulating supply — a property the Orchard vulnerability had made theoretically uncertain.
Node operators were required to upgrade to Zebra 6.0.0 prior to activation at block height 3,428,143, approximately 13:00 UTC on July 28. The Zcash Foundation also released Zebra 6.1.0 with additional post-activation fixes.
At the time of Ironwood activation, the ZEC supply was distributed as follows:
| Pool | ZEC Balance | % of Mined Supply | |------|------------|-------------------| | Transparent | 12,411,671 | 73.9% | | Orchard (sealed) | 3,765,121 | 22.4% | | Sapling | 591,989 | 3.5% | | Sprout | 22,747 | 0.1% | | Ironwood | 0 | 0.0% | | Unmined | 4,208,472 | — |
Total mined supply: approximately 16.79 million ZEC out of a 21 million maximum.
The turnstile mechanism is the critical accounting control. Funds exiting the sealed Orchard pool must pass through a protocol-level gate that caps total withdrawals at the sum of deposits previously recorded for that pool. If counterfeit ZEC exists within Orchard, the turnstile ensures it cannot escape into the new Ironwood pool or the transparent supply.
Any hypothetical counterfeiter faces a binary choice: attempt to migrate funds through the turnstile, risking exposure if total withdrawal requests exceed verified deposits; or leave the counterfeit coins permanently locked in a pool that can no longer accept new deposits. Migration is voluntary and user-driven. Wallet providers such as Zodl (version 3.8.0) support direct migration without requiring new wallets or addresses.
As of activation, the Orchard pool held approximately 22.4% of all mined ZEC. Until migration completes, the majority of Zcash's shielded supply sits in a pool that is permanently frozen for new deposits.
Ironwood is part of a broader technical overhaul. On July 15, 2026 — 13 days before Ironwood activation — the Zakura 1.0.0 full-node implementation went live. Maintained by Sean Bowe, a founding member of Zcash's zero-knowledge cryptography team, and Dev Ojha, co-founder of Osmosis, Zakura offers roughly five times faster block synchronization than the Zebra node and reduces block propagation times below 500 milliseconds.
Zakura is engineered to support a long-term target of 50,000 transactions per second for shielded payments. According to CoinDesk, the performance target was described as aspirational, with near-term milestones at approximately 10,000 TPS through Project Tachyon.
The next planned upgrade, NU7, would reduce Zcash block times from 75 seconds to 25 seconds — a 300% increase in throughput — and double shielded transactions per second. NU7 had its first testnet live as of May 22, 2026. ZCAP member and coinholder voting showed more than 90% support for the Tachyon scaling and quantum recoverability priorities.
Additionally, ZIP 233, 234, and 235 outline a Network Sustainability Mechanism (NSM) that would introduce ZEC burning and issuance smoothing. ZIP 235 proposes burning 60% of transaction fees. These remain roadmap proposals rather than activated consensus rules.
The Orchard vulnerability disclosure produced one of the sharpest single-event drawdowns in ZEC history. From approximately $610 on June 4 to a low near $368 in late June, ZEC lost over 40% of its value. The decline took the token's market capitalization from approximately $10.2 billion to $6.2 billion.
Recovery followed the announcement of the Ironwood activation date. By late July, ZEC had rebounded to approximately $578, a gain of roughly 57% from the late-June trough. However, activation day itself saw a 5.33% decline, with ZEC trading at $462.93 on July 28. The 24-hour trading volume on July 28 was elevated but not exceptional relative to the June disclosure period.
Market capitalization stood at approximately $7.8 billion as of July 28, ranking ZEC 12th among all cryptocurrencies. Circulating supply was 16.79 million ZEC against a hard cap of 21 million.
The sell-the-news pattern — prices declining on the day of a long-anticipated technical event — is consistent with prior Zcash and broader crypto upgrade cycles. Whether ZEC sustains its recovery from June lows will likely depend on whether Orchard-to-Ironwood migration proceeds without supply anomalies.
The Orchard incident raises several structural questions for privacy-preserving blockchain protocols.
Audit Limitations. A vulnerability that survived four years and multiple expert reviews demonstrates the limits of conventional code auditing for complex zero-knowledge circuits. That an AI-assisted framework discovered the flaw within a day of deployment underscores both the potential of automated analysis tools and the difficulty of the problem space.
Supply Integrity in Privacy Systems. The fundamental tension in privacy coin design is between transaction confidentiality and supply auditability. Zcash's approach — sealing the compromised pool and requiring turnstile migration — is a pragmatic solution, but it does not retroactively prove supply integrity for the period between May 2022 and June 2026. The design explicitly accepts this limitation.
Formal Verification as Standard. The Ironwood team's decision to formally verify the proof circuit specification rather than rely solely on implementation audits may set a precedent. If the approach demonstrates effectiveness, other ZK-based protocols may face pressure to adopt similar verification standards, with corresponding implications for development timelines and costs.
Economic Value Distribution. From an economic-value perspective, the Ironwood episode illustrates how protocol-level risk concentrates economic value in infrastructure development and security research. The 60-day emergency rebuild required coordinated effort from Shielded Labs, the Zcash Foundation, zkSecurity, and the Zcash Open Development Lab — entities whose funding ultimately derives from the protocol's block reward allocation and grants.
The Ironwood activation represents the fastest emergency protocol rebuild in Zcash's 10-year history. Sixty days from vulnerability disclosure to mainnet deployment is a compressed timeline by any blockchain standard. The technical response — formal verification, turnstile accounting, quantum-forward note design — addresses the immediate counterfeiting risk and several longer-term structural weaknesses.
The unresolved question is whether the Orchard vulnerability was ever exploited. The privacy guarantees that make Zcash's shielded pools valuable are the same guarantees that make post-hoc exploitation detection impossible. The turnstile mechanism is designed to contain this risk, not eliminate it. Markets are pricing the uncertainty: ZEC remains well below its pre-disclosure levels despite a 57% recovery from June lows.
For the broader privacy protocol ecosystem, the Orchard-to-Ironwood transition is a case study in the costs of zero-knowledge circuit complexity. The bug was not in the implementation alone but in the mathematical specification — the kind of error that conventional auditing is least equipped to catch. The shift toward formal verification and AI-assisted analysis may represent a permanent change in how zero-knowledge systems are secured.