Zcash targets July 21, 2026 for Ironwood mainnet activation after sealing the Orchard shielded pool. The upgrade responds to a soundness flaw discovered May 29 by security researcher Taylor Hornby inside Orchard's elliptic curve code, which had existed since the pool launched in May 2022. Ironwood opens a new shielded pool built on patched circuits while blocking new deposits into the legacy Orchard pool, allowing full nodes to verify total supply without relying on developer assurances. ZEC traded at $462.33 on July 4, up 13.3% over seven days and more than 1,000% over the past year, rebounding from a 50% drop following the vulnerability disclosure. The privacy-focused cryptocurrency's network requires node operators to migrate to Zebra or updated clients before the July 21 mainnet launch.
Security Researcher Discovers Orchard Pool Flaw May 29
Taylor Hornby, working under contract for Shielded Labs, found the soundness flaw on May 29 inside the Orchard shielded pool's elliptic curve code. The bug existed in the halo2_gadgets crate handling point multiplication, where a prover could substitute the wrong base point and still get the circuit to accept an invalid proof. Orchard hides sender, receiver and amount by design, meaning a counterfeit note created inside the pool would appear identical to a legitimate one. The flaw had been present in the code since Orchard went live in May 2022 as part of the NU5 upgrade.
Zcash Engineers Deploy Soft Fork Around June 1 and Hard Fork NU6.2 on June 3
Zcash core engineers Daira-Emma Hopwood, Kris Nuttycombe and Jack Grigg confirmed the issue within hours of Hornby's report. A soft fork disabled new Orchard actions around June 1 to contain exposure. A hard fork, NU6.2, followed on June 3 with a corrected verifying key, restoring full Orchard functionality. Orchard transactions paused for roughly one day during the rollout, while transparent and Sapling transfers continued operating. Zcash Open Development Lab and Shielded Labs both reported finding no evidence the bug was exploited, and the network's turnstile accounting, which tracks value entering and leaving each pool, showed no signs of unauthorized minting. Orchard's privacy design means no cryptographic method exists to prove counterfeiting never occurred.
Ironwood Upgrade Opens New Shielded Pool and Seals Legacy Orchard
Announced June 6, Ironwood ships as NU6.3 and was built by ZODL alongside Tachyon, Valar Group, the Zcash Foundation and Shielded Labs. The upgrade opens a new Ironwood shielded pool built on the patched Orchard circuit, backed by ongoing formal verification and added independent audits. The old Orchard pool gets sealed: wallets will block new deposits, internal transfers between users inside the pool get disabled, and funds can only exit through the turnstile toward Ironwood or a transparent address. Once the legacy pool stops accepting new value and stops circulating internally, any theoretical counterfeit notes become contained. Full node operators can then sum balances across active pools and confirm total supply aligns with protocol limits. Ironwood also carries ZIP 2005, a set of note format changes designed to support recovery in a future quantum computing scenario.
Testnet Activation Completed July 3-4, Mainnet Targeted July 21
Testnet activation for Ironwood occurred around July 3 and 4. Zebra, the Rust client maintained by the Zcash Foundation, and Valar Group's independent implementation are both running release candidates against testnet. Mainnet activation is targeted for around July 21, tied to a zcashd end-of-support block. Developers state hashrate signaling appears ready and existing testnet time provides wallets sufficient runway, with no delay currently planned. Node operators on older zcashd builds must migrate to Zebra or an updated client before that date. Wallets are expected to prompt users to migrate shielded funds out of the old Orchard pool, often requiring a single approval.
ZEC Trades at $462.33 on July 4 After 50% Drop and Recovery
ZEC fell more than 50% from around $630 to the $250 to $300 range after the vulnerability became public, then rebounded once the patch and Ironwood plan were announced. As of July 4, ZEC trades at $462.33, up 13.3% over the past seven days following a flat 24-hour session. Over the past year, the coin is up more than 1,000%, a period including a run to a 52-week high near $744 in November 2025 and the Orchard disclosure in late May. Investor Chamath Palihapitiya publicly flagged Ironwood's supply verification model as a meaningful step for the coin. Formal verification results are due before mainnet, and wallet, exchange and infrastructure providers must ship updated support in the next two and a half weeks.
FAQ
What security flaw did Taylor Hornby discover in Zcash on May 29?
Taylor Hornby discovered a soundness flaw on May 29 inside the Orchard shielded pool's elliptic curve code in the halo2_gadgets crate handling point multiplication. A prover could substitute the wrong base point and still get the circuit to accept an invalid proof, potentially allowing counterfeit notes that would appear identical to legitimate ones. The flaw had existed since Orchard launched in May 2022.
When will Zcash's Ironwood mainnet activation occur?
Zcash targets July 21, 2026 for Ironwood mainnet activation, tied to a zcashd end-of-support block. Testnet activation occurred around July 3 and 4, with Zebra and Valar Group's implementation running release candidates. Node operators on older zcashd builds must migrate to Zebra or an updated client before July 21.
How did ZEC price respond to the Orchard vulnerability and Ironwood announcement?
ZEC fell more than 50% from around $630 to the $250 to $300 range after the vulnerability became public, then rebounded following the patch and Ironwood plan. As of July 4, ZEC traded at $462.33, up 13.3% over seven days and more than 1,000% over the past year.
