Zcash Activates Ironwood Upgrade, Locks $1.7 Billion Shielded Pool After Bug Discovery

Zcash rolled out its Ironwood upgrade on Tuesday, sealing off its main private funds pool holding roughly 3.66 million ZEC, worth close to $1.7 billion, and opening a fresh pool that started completely empty.

Why the Old Pool Was Closed

The upgrade, officially called NU6.3, replaced the previous shielded pool known as Orchard. A researcher at Shielded Labs discovered back in late May that Orchard’s underlying code had carried a flaw since it launched in 2022, one that could have theoretically allowed someone to create fake coins without leaving any trace on the blockchain. Developers fixed the issue quickly, but there was no way to check what may have happened during the four years the bug existed.

How the New System Limits Risk

Since shielded transactions hide details but public deposit and withdrawal amounts remain visible, the network can enforce a rule at the pool’s edge that blocks more coins from leaving than were ever verified going in. This effectively traps any potentially fraudulent coins inside the old pool permanently. Users must now voluntarily move their funds into the new pool, which had already seen 1,500 ZEC transferred shortly after launch.

Added Protections in Ironwood

Beyond closing the vulnerability, the new pool includes safeguards designed to keep transaction records secure even if quantum computing eventually threatens current encryption methods. The system’s verification code is also undergoing a rigorous mathematical review process aimed at preventing similar bugs from slipping through undetected in the future.

ZEC was trading near $474 ahead of the switch, down for the day and week, though still up sharply over the past year. Analysts say the real test now is how quickly the bulk of the network’s private holdings actually migrate to the new pool.