Ironwood Goes Live as Zcash Locks Down Orchard and Forces a $1.8B Migration

The NU6.3 upgrade went live July 28 at block height 3,428,143, introducing a separate Ironwood shielded pool, a new transaction format, and a mandatory accounting checkpoint for funds leaving Orchard. New shielded payments are now directed to Ironwood, while Orchard has been restricted to withdrawals.

The change follows the discovery of a critical cryptographic weakness that had remained inside Orchard since the pool launched in May 2022. Independent security researcher Taylor Hornby found the flaw on May 29 during an artificial intelligence (AI)-assisted audit conducted under contract for Shielded Labs using Anthropic’s Claude Opus 4.8 model.

A Flaw With Counterfeiting Implications

The vulnerability affected an elliptic-curve scalar multiplication component within the Halo 2 proving system. The incomplete circuit constraints could have allowed a malicious user to generate counterfeit Orchard notes that appeared valid and carried unique nullifiers indistinguishable from legitimate transactions.

Developers said there was no evidence the flaw had been exploited, no detected unauthorized ZEC creation and no known loss of user funds or privacy. However, Orchard’s privacy design means researchers cannot conclusively reconstruct its internal history to prove that exploitation never occurred.

Zcash’s existing turnstile architecture prevented the global supply from exceeding the protocol’s 21 million ZEC cap. Even so, the vulnerability weakened confidence that every coin circulating privately inside Orchard had been legitimately created.

Zcash developers responded within days. An emergency soft fork temporarily restricted Orchard activity, followed by the NU6.2 hard fork that corrected the circuit and restored functionality in early June. Ironwood became the longer-term solution rather than leaving the network dependent on a patched version of the same pool.

Ironwood Creates a New Accounting Boundary

Ironwood maintains a separate note commitment tree, nullifier set, chain history and value pool. The old Orchard pool cannot create new outputs or process internal transfers, leaving its remaining funds to exit through the protocol’s public turnstile.

That checkpoint ensures the total amount leaving Orchard cannot exceed the amount that legitimately entered it. Any hypothetical counterfeit notes created through the old vulnerability would remain trapped because they could not cross into Ironwood without violating the publicly enforced accounting limit.

The design allows node operators to verify Zcash’s circulating supply by examining balances across Ironwood, Sapling, Sprout, and the remaining audited Orchard value. As legitimate users migrate, Orchard’s balance should decline, creating an increasingly narrow upper bound on any potential hidden irregularities.

Orchard reportedly held about 3.6 million to 3.76 million ZEC at activation, worth roughly $1.7 billion to $1.9 billion at contemporaneous prices. Ironwood began with no balance, although early trackers showed tens of thousands of ZEC moving into the new pool shortly after activation.

Formal Verification and Quantum Recovery

Project Tachyon and other contributors applied formal verification, independent audits and AI-assisted analysis to Ironwood’s critical circuits and supporting libraries. The work sought to mathematically exclude the category of unconstrained cryptographic operations that caused the Orchard vulnerability.

Ironwood also implements quantum-recoverable notes under ZIP 2005. The feature does not make Zcash resistant to quantum computing today, but it creates a recovery path that could allow users to reclaim funds if future breakthroughs compromise the cryptography protecting the pool.

Wallet providers, exchanges, and node operators must update their software to support NU6.3. Zodl, Cake Wallet, and other services have released or planned migration tools, while infrastructure operators were directed toward the Zebra-based Z3 software stack as support for the legacy zcashd client ended.

ZEC Retreats as Annual Gains Hold

ZEC traded near $466 after the activation, down 4.8% over 24 hours, 14.1% over seven days and 15.7% over 14 days. The cryptocurrency remained up 19.2% over 30 days and more than 1,000% over one year, highlighting the divide between short-term selling and its longer-term advance.

The decline pushed ZEC below $500 as the wider cryptocurrency market weakened ahead of the Federal Reserve’s July 29 policy decision. Trading volume remained near $300 million, suggesting active repositioning rather than a collapse in liquidity.

Ironwood does not change Zcash’s privacy model or maximum supply. Its immediate test will be whether wallets, exchanges, and users migrate Orchard balances smoothly while maintaining privacy. Its broader significance rests on whether formal methods and public turnstile accounting can strengthen confidence in private digital money without sacrificing the secrecy those systems are designed to provide.