Zcash just closed a bug that could've minted fake ZEC for 4 years

On July 27, Zcash activated its Ironwood upgrade (NU6.3) — the network "sealed" the old Orchard shielded pool, which held 3.66 million ZEC (roughly $1.7 billion), and opened a new pool starting from a zero balance. The urgency came from a vulnerability that had gone unnoticed for four years.

On May 29, 2026, researcher Taylor Hornby of Shielded Labs found a flaw in Orchard's proving scheme — one that had existed since the pool launched in May 2022 and could theoretically have let an attacker mint counterfeit ZEC without leaving a trace on-chain. Developers patched it within days; available evidence suggests it was never exploited — the pool's balance grew steadily across all four years, with no anomalous outflows, CoinDesk reports.

• Ironwood activated at block 3,428,143 on July 28, 2026
• The new pool is protected by a turnstile mechanism: withdrawals can never exceed what was actually deposited
• Transaction records are now quantum-resistant from the very first block
• The new proving scheme underwent formal verification — a mathematical proof the software behaves correctly in every case

ZEC dropped 38% after May's vulnerability disclosure but had nearly recovered by the time Ironwood activated — the token trades around $463 with roughly $8 billion in market cap, though it did slip another 8% on the day of the upgrade itself.

Migration to the new pool is voluntary and already underway — 1,500 ZEC had moved over by launch. Developers are advising against rushing: some privacy is temporarily lost during the transition, and there's no real upside to moving in the first few days.

This piece is informational, not a recommendation to buy, sell, or hold any asset.