The Zcash network upgrade, codenamed Ironwood, is scheduled for July 28, 2026. We break down what to know about the upcoming update.
The Ironwood upgrade is designed to address the “infinite” vulnerability discovered in May in the Orchard private transaction pool. Ironwood will close the current Orchard pool, block new activity in it, and create a new private pool. Funds leaving Orchard will have to pass through a check-in point to determine whether fake ZEC▲$465.18 tokens were created due to the bug.
Hot topic: JPMorgan Identifies the Biggest Risk for Bitcoin in 2026
The upgrade was originally planned for July 21 but was pushed back one week to give ecosystem participants–crypto exchanges, mining pools, and crypto wallets–time to prepare their systems.
After the vulnerability was discovered, ZEC crashed 50% but has since partially recovered to $500.
Contents
What Is Ironwood and How Will It Close the Orchard Vulnerability in Zcash?
In May 2026, Shielded Labs security engineer Taylor Hornby discovered a critical vulnerability in the Orchard pool–a key component of Zcash’s private transactions. The bug had existed since Orchard’s activation in May 2022 and could have allowed unlimited counterfeit ZEC to be minted undetectably within the pool.
Due to the pool’s private nature, the team could not cryptographically prove whether the vulnerability had been exploited before the fix, though Shielded Labs considers that scenario unlikely.
Ironwood’s mechanism includes a “turnstile” system: users will be able to migrate funds from the old Orchard pool to the new one, and the transition will check whether any counterfeit tokens were created. As Shielded Labs explained:
“When migrating funds from the existing Orchard pool to the new one, any hypothetical counterfeiter will face a choice: attempt to move the counterfeit funds and risk exposing their existence, or leave them and risk being unable to move them in the future.”
Read more: Best Privacy Coins 2026 — Why Monero, Zcash & DASH Are Making a Comeback
Ironwood Formal Verification: Proving the Absence of Vulnerabilities
Zcash founder Zuko Wilcox-O’Hearn said the Tachyon Formal Verification Initiative is “on the verge of creating a mathematical proof” that will confirm the absence of undetectable counterfeiting vulnerabilities in Zcash’s new private pools. This would resolve the long-standing trade-off between privacy and the ability to verify a cryptocurrency’s money supply.
In response to the vulnerability, the community launched a “multi-pronged” review combining extensive security audits, analysis using advanced AI tools, and formal verification to confirm Ironwood’s correctness. Zcash developer Sean Bowe said “all major organizations have committed to activating the upgrade” at block height 3,428,143.
Market Reaction: ZEC Recovers to $500
After the Orchard vulnerability was disclosed on June 3, ZEC crashed 50%–from $602 to $299. In the following weeks, the price partially recovered.
At the time of writing, ZEC trades at roughly $500, up 7% over 24 hours and nearly 21% over the past month.
Zcash has also reached a significant monetary milestone: more than 80% of the 21 million ZEC maximum supply has already been issued, underscoring the asset’s scarcity in the long term.
Learn more: Zcash vs Bitcoin in 2026 — Is Zcash a Better Privacy Coin Than Bitcoin for Investors?
