Yesterday, Zcash underwent an upgrade designed to close the Orchard pool vulnerability. We break down how it went and what users need to know.
On July 28, 2026, the Ironwood upgrade was activated on the Zcash mainnet at block 3,428,143. Developers launched a new private transaction pool to replace Orchard, where a critical vulnerability was discovered in late May. At activation, Orchard held about 3.66 million Zcash (ZEC▲$465.18) tokens.
Hot topic: Zcash Launches Ironwood Upgrade — ZEC Recovers to $500 After 50% Drop
The new Ironwood pool started with a zero balance. All funds from the old pool must be moved by their owners through a “turnstile” mechanism that limits withdrawals to the verifiable deposit amount.
Contents
How Ironwood Fixes the Orchard Vulnerability: ‘Turnstile‘ and Formal Verification
The Orchard bug was discovered on May 29 by Shielded Labs security engineer Taylor Hornby while analyzing code with Anthropic’s Claude Opus 4.8. The flaw had existed since the pool launched in May 2022 and could have allowed counterfeit ZEC to be minted undetectably.
Developers released an emergency patch in June, but Orchard’s private nature made it impossible to prove cryptographically whether the vulnerability had been exploited.
Ironwood solves the problem with a boundary check. Orchard has been placed in restricted mode: no new funds can enter, and existing coins are blocked from internal transfers. Withdrawals are only possible through the turnstile into Ironwood. The protocol-level mechanism ensures that no more ZEC can leave the old pool than was deposited. As funds migrate, supply integrity can be verified without accessing private transaction data.
Zcash co-founder Sean Bowe said:
“Cross-team collaboration has just changed Zcash’s history forever, eliminating all sources of undetectable counterfeiting errors from the new Ironwood protocol.”
The upgrade also adds quantum-recoverable records under ZIP 2005, providing a recovery path if quantum computing compromises current cryptography.
Read more: Zcash Blockchain Outage: Network Block Production Stopped for 4 Hours
ZEC Price Reaction and User Migration
The Ironwood launch didn’t trigger significant market reaction–the upgrade date was known in advance. ZEC fell 1.5% in 24 hours to $461, and 9.3% over the week.
ZEC Price Movement Over 24 Hours, as of July 29, 2026. Source: CoinGecko
At activation, Orchard held about 3.6 million ZEC. According to the migration tracker, about 40,207 ZEC have already been moved to the new Ironwood pool. Migration is handled at the wallet level.
Crypto wallets with Ironwood support will prompt users to move funds from the old pool. In the Zodl wallet, manual migration is already available, with an automatic option coming later. Users don’t need to create a new wallet or change addresses–incoming transfers to existing Orchard addresses are automatically routed to the new pool.
Privacy infrastructure provider Nym warned of temporary privacy risks during migration. Since every Zcash holder must move funds to the new pool, users who migrate without additional protection may expose information linking their IP address to wallet balances. Developers recommend taking time with migration and using privacy tools like Tor or NymVPN when moving funds.
Learn more: Zcash to Launch Quantum-Ready Wallets
