Zcash Activates Ironwood Upgrade After Counterfeiting Scare

Weeks after a critical vulnerability sparked a market rout and raised questions about Zcash’s supply, the privacy-focused cryptocurrency has activated Ironwood, an upgrade designed to ensure any counterfeit coins can never enter circulation.

The Ironwood upgrade retires the Orchard shielded pool, which holds roughly 3.7 million ZEC worth about $1.7 billion, and begins migrating users into a new shielded pool. The upgrade also introduces new accounting rules for Zcash’s circulating supply while preserving the network’s privacy guarantees.

The road to Ironwood began in May, when security researcher Taylor Hornby, using Claude Opus 4.8, discovered a four-year-old flaw in Orchard that could have allowed an attacker to create counterfeit ZEC. Developers issued an emergency patch in June, but because shielded transactions intentionally hide their details, there was no way to prove whether the vulnerability had ever been exploited.

The uncertainty sparked a sharp selloff, with Zcash falling 38% as investors questioned whether the cryptocurrency’s supply could be trusted.

To address the vulnerability, Zcash founder Zooko Wilcox proposed Ironwood, which replaces Orchard with a new shielded pool and a “turnstile” accounting system that prevents more ZEC from leaving the old pool than was verifiably deposited. As a result, any counterfeit coins, if they exist, remain permanently trapped.

News of Ironwood led to a rebound in Zcash, with the cryptocurrency recovering roughly $2.5 billion in market value in early June as investors welcomed the proposed fix. The coin today trades for roughly $464, just below an $8 billion market capitalization.

By July, developers had completed extensive testing while exchanges, wallets, and mining pools prepared for the Ironwood upgrade. With Ironwood now live, Zcash also gains quantum-resistant transaction records and a formally verified proof circuit intended to reduce the risk of similar vulnerabilities in the future.

Critics, including privacy infrastructure provider Nym, however, argue the migration creates a temporary privacy risk.

“Under normal use, your shielded ZEC transactions don’t reveal amounts to your wallet server, so your network exposure is limited. Ironwood changes that,” Nym said in a blog post on Monday.

Because every Zcash holder must move funds into the new shielded pool, Nym explained, users who migrate without additional protections could expose information linking their IP address to their wallet balance. To mitigate this risk, Zcash developers have advised users not to rush the migration and recommend using privacy tools such as Tor or NymVPN while moving funds.