Zooko Wilcox, lead developer and co-founder of Zcash (ZEC), has disclosed a new emergency protocol designed to protect the coin’s cryptographic integrity as the network prepares for a major upgrade. The Ironwood hard fork, also known as Network Upgrade 6.3 (NU6.3), is scheduled to activate on July 28, 2026, at block 3,428,143. This upgrade will permanently segregate the vulnerable Orchard pool and immobilize any potentially counterfeit ZEC that may have been secretly introduced.
Zcash addresses critical vulnerability
Shielded Labs, an independent nonprofit organization focused on privacy-focused blockchain research, recently revealed a critical bug in Zcash’s protocol. Taylor Hornby, a researcher with Shielded Labs, identified a flaw in the Orchard pool’s cryptography that may have permitted the undetectable minting of new coins.
According to Zcash developers, the vulnerability was discovered and patched at the protocol level before any evidence of real-world abuse surfaced. The quick response helped prevent large-scale exploitation, but Wilcox’s team is implementing additional precautions to ensure confidence in the total supply’s accuracy.
Zooko Wilcox emphasized that the emergency steps are intended to ensure “the supply of ZEC is mathematically and publicly verifiable by anyone running node software.”
The “turnstile” mechanism for supply transparency
Under the new protocol, the original (and now suspect) Orchard pool will be cordoned off. All funds currently held in the old pool can only move to a freshly initialized, clean Orchard pool using a purpose-built “turnstile” gateway. This mechanism mathematically enforces that only legitimate, non-forged balances are permitted to pass through.
The turnstile system examines the total quantity of coins ever deposited into the original pool. Only this provably valid amount can exit to the new pool. If illicit issuance did occur in the past, any forged ZEC will become irretrievably locked inside the original pool, effectively removed from circulation.
Mini dictionary: The Orchard pool refers to a privacy-focused feature of Zcash that enables shielded, confidential transactions using advanced zero-knowledge cryptography. The pool is designed to obscure sender, receiver, and amount data, enhancing transaction privacy on the Zcash blockchain.
| Orchard Pool (Old) | Orchard Pool (After Hard Fork) |
|---|---|
| Susceptible to bug, potential hidden ZEC | Clean cryptography, only verified funds admitted via turnstile |
| Frozen balances if forged coins exist | Mathematically verified circulating supply |
| Deposits and withdrawals blocked post-fork | Fresh pool, balances accessible after migration |
Temporary service interruptions expected
In anticipation of the Ironwood upgrade, Zcash developers have warned that some exchanges, wallets, and swap services may need to temporarily halt ZEC deposits and withdrawals through their platforms in order to conduct software tests.
Zcash’s team underlined that these interruptions are routine technical steps—rather than signs of unsolved security problems—and do not threaten users’ coins.
Service providers may briefly suspend ZEC deposit and withdrawal functions as a matter of technical procedure while the new system goes live, but users’ funds remain secure throughout the transition.
Users who manage their ZEC through private wallets should expect that their Orchard balances may temporarily appear inaccessible as network nodes process the transition between the old and new pools.
Zcash, launched in 2016, is a privacy-centric cryptocurrency utilizing zero-knowledge proof technology to provide confidential transactions. It remains one of the leading projects focused on cryptographic privacy in digital assets.
