Zcash core developer Sean Bowe confirmed the mainnet Ironwood upgrade (protocol version NU6.3) activation block height at 3,428,143, expected around July 28, 2026, at 12:00 UTC — one week later than the original July 21 target. Electric Coin Company, Zcash Foundation, and Shielded Labs have pledged to upgrade in sync.
AI-Powered Find: A Bug Lurking for Nearly 4 Years
The vulnerability was embedded in the zero-knowledge proof circuit of the Orchard privacy pool, with two lines of code hidden undetected since May 2022. It theoretically allowed unlimited minting of counterfeit ZEC within the shielded pool, leaving no on-chain trace due to the pool's anonymity. Security engineer Taylor Hornby uncovered it on May 29 using Anthropic's AI model; the fix was deployed June 1. After Shielded Labs disclosed details on June 5, ZEC plunged 38% within 24 hours. However, Zcash's turnstile mechanism capped total supply, and no evidence indicates the bug was exploited on mainnet.
Pool Swap and Verification Gates
Ironwood introduces two defenses: first, a new shielded pool replaces the old Orchard pool, which will gradually cease accepting new deposits. Second, a control flag in the zk-proof circuit prohibits transfers from the privacy pool to other internal addresses, while allowing self-change returns. Combined with the turnstile, all funds leaving the old pool must pass an accounting checkpoint before entering the new pool. This trade-off between anonymity and auditability defines Ironwood's most intriguing aspect.
On May 9, 2026, ZEC briefly hit $642 — a 650% rally from its 2024 low — overtaking Monero as the largest privacy coin by market cap. The SEC closed its investigation into Zcash Foundation in January, and Grayscale filed for a spot Zcash ETF (ticker ZCSH). Ironwood's progress pushed ZEC up roughly 12% recently. With less than three weeks until activation, the bug saga remains unresolved until old pool funds complete migration.