Zcash developers are closing in on a July 21 mainnet launch for Ironwood, a network upgrade built to let any node operator verify the coin’s circulating supply on day one.
Key Takeaways:
Zcash targets July 21, 2026 for Ironwood mainnet activation after sealing the Orchard pool.ZEC trades at $462.33 on July 4, up 13.3% in seven days and over 1,000% in a year. Node operators must migrate to Zebra or updated clients before Ironwood’s mainnet launch.The upgrade traces back to a discovery on May 29. Security researcher Taylor Hornby, working under contract for Shielded Labs, found a soundness flaw inside the Orchard shielded pool’s elliptic curve code. The bug lived in a piece of the halo2_gadgets crate handling point multiplication. A prover could swap in the wrong base point and still get the circuit to accept an invalid proof.
That flaw mattered because Orchard hides sender, receiver and amount by design. A counterfeit note created inside the pool would look identical to a real one. The bug had sat in the code since Orchard went live in May 2022 as part of the NU5 upgrade.
Rapid Patch, No Confirmed LossesZcash’s core engineers, including Daira-Emma Hopwood, Kris Nuttycombe and Jack Grigg, confirmed the issue within hours of Hornby’s report. A soft fork disabled new Orchard actions around June 1 to contain exposure. A hard fork, NU6.2, followed on June 3 with a corrected verifying key, restoring full Orchard functionality.
Orchard transactions paused for roughly a day during the rollout. Transparent and Sapling transfers kept running the whole time. Zcash Open Development Lab and Shielded Labs both say they found no evidence that the bug was ever exploited, and the network’s turnstile accounting, which tracks value entering and leaving each pool, showed no signs of unauthorized minting.
There’s a catch developers can’t patch away. Orchard’s privacy means nobody can prove a negative. No cryptographic method exists to confirm counterfeiting never happened, only that it probably didn’t.
Ironwood Closes the GapAnnounced June 6, Ironwood is the fix for that remaining uncertainty. It ships as NU6.3 and was built by ZODL alongside Tachyon, Valar Group, the Zcash Foundation and Shielded Labs.
The upgrade opens a new Ironwood shielded pool built on the patched Orchard circuit, now backed by ongoing formal verification and added independent audits. At the same time, the old Orchard pool gets sealed. Wallets will block new deposits into it, internal transfers between users inside the pool get disabled, and funds can only leave through the turnstile toward Ironwood or a transparent address.
Timeline and What Users Need to Do Market ResponseZEC’s price tells its own story of the past six weeks. The token fell more than 50% from around $630 down to the $250 to $300 range once the vulnerability became public, then rebounded sharply once the patch and Ironwood plan landed.
As of July 4, ZEC trades at $462.33, up 13.3% over the past seven days, even after a flat 24-hour session. Zooming out, the coin is up more than 1,000% over the past year, a stretch that includes both a run to a 52-week high near $744 in November 2025 and the Orchard scare in late May.
For now, the work left is coordination. Formal verification results are due before mainnet, and wallet, exchange, and infrastructure providers still need to ship updated support in the next two and a half weeks.
