The Zcash (ZEC) network is preparing for the Ironwood hard fork (NU6.3) on July 28, 2026, at block 3,428,143, to permanently seal the vulnerable Orchard shielded pool and lock away any potentially counterfeit coins. The emergency upgrade, detailed by founder Zooko Wilcox on July 19, addresses a critical flaw discovered in May by Shielded Labs researcher Taylor Hornby.
The bug could have allowed an attacker to create fake ZEC inside the privacy-preserving Orchard pool without leaving an obvious public record. Developers quickly patched the vulnerability and restored activity through the NU6.2 hard fork with corrected cryptography, and no evidence of exploitation was found. However, because Orchard’s complete privacy prevents definitive proof, the network cannot guarantee that hidden issuance did not occur before the fix.
The Turnstile Strategy: Ironwood will launch a new, clean Orchard pool with corrected circuits while the original pool is sealed. Funds can only leave the old pool through a specially designed “turnstile” gateway. This mechanism enforces a strict balance check: it prevents more ZEC from exiting than legitimately entered over the pool’s entire history. Any hypothetical excess counterfeit ZEC will remain permanently frozen inside the old pool, effectively becoming digital waste. Node operators will be able to independently verify the accurate circulating supply.
Users do not need to take immediate action, but cryptocurrency exchanges, wallets, and swap services that have not completed software testing may temporarily suspend ZEC deposits and withdrawals. The Zcash team emphasizes that such pauses are routine technical adjustments and not a threat to asset security. Private-wallet holders may also see their Orchard balances temporarily unavailable until wallet providers add migration tools.
The hard fork follows broader security work within the Zcash ecosystem. An AI-assisted review using Anthropic’s Mythos system found no additional serious vulnerabilities, and developers are pursuing further independent audits and formal verification for the updated cryptography. By sealing Orchard and controlling withdrawals via the turnstile, Ironwood aims to preserve Zcash’s mathematical integrity and demonstrate its ability to protect its economy under strong privacy guarantees.
