Zcash developers are sealing off a shielded pool that carried a critical bug, and a new node built for speed is already backing the fix.
Key Takeaways
- Ironwood (NU6.3) seals Zcashs old Orchard pool at block 3,428,143 on July 28.
- Taylor Hornbys May bug find pushed ZEC lower before it stabilized above $500.
- Sean Bowe and Dev Ojhas Zakura node syncs Zcash 5 times faster than Zebra.
The Ironwood hard fork, known as NU6.3, activates around July 28, 2026, at block height 3,428,143. It closes a soundness flaw in the Orchard shielded pool and opens a new pool built on corrected code. Alongside it, a fast new node called Zakura is already live, giving operators a faster way to run the network.
A Bug Nobody Could See
Security researcher Taylor Hornby, working with Shielded Labs, found the flaw in late May 2026. The bug sat inside OrchardтАШs cryptographic circuits. In theory, it lets someone mint counterfeit ZEC inside the shielded pool without leaving a trace. ZcashтАЩs privacy design, the same feature that protects users, also blocks outside observers from checking whether anyone has exploited it.
Developers moved fast. A soft fork shut down the Orchard pool temporarily. A hard fork, NU6.2, patched the immediate danger. ZECs price dropped sharply on the news before recovering part of its losses. The episode tested a core Zcash promise: that privacy and provable scarcity can coexist.
How Ironwood Locks the Old Pool
Once Ironwood activates, the legacy Orchard pool stops accepting new deposits or internal transfers. Existing coins in the old pool still work, but only if they move through a new checkpoint called a turnstile on their way to the new Ironwood pool.
The turnstile enforces a simple rule. Outflows from the old pool cannot exceed the coins that legitimately went in. That means the total circulating ZEC supply becomes verifiable the moment Ironwood turns on, without waiting for every user to migrate.
Two outcomes are possible if counterfeit coins existed. If no excess supply tries to leave the old pool, that stands as strong evidence that nothing was exploited. If excess supply does appear, the turnstile blocks it from leaving, and the extra coins get destroyed, giving the public proof of what happened.
Project Tachyon is running formal verification on the new Ironwood circuits, producing machine-checked proofs rather than relying only on manual code review.
What Users Need to Do
Node operators must upgrade before block 3,428,143 hits, expected around 8 a.m. EST on July 28. Wallet providers tied to the Zcash Open Development Lab are adding prompts to guide shielded fund migration. Users holding transparent balances or funds outside the old Orchard pool do not need to take action. The legacy zcashd node software is reaching end of life around the same window, pushing remaining users toward modern clients.
Zakura Enters the Race
Zakura 1.0.0 launched July 15, 2026, forked from the Zcash Foundations Zebra codebase. Sean Bowe, a Zcash cofounder and the cryptographic engineer leading Project Tachyon, built it with Dev Ojha, the Osmosis cofounder now leading Valar Group. Both projects are funded through private ZEC donations.
Zakura syncs the Zcash mainnet in about four hours and 20 minutes, compared to roughly 20 hours and 46 minutes for Zebra in the same test. Pruned snapshots let a new node bootstrap in under two minutes. A zcashd compatibility mode keeps older wallets and integrations working during the transition.
тАЬZakura syncs mainnet from the network far faster than Zebra in this trace, reaching the chain tip while Zebra is still in the sandblasting range,тАЭ the Zakura blogpost details.
Bowe and Ojha say the long-term goal is Visa and Mastercard-level throughput, near 50,000 transactions per second, for private payments. Todays shielded pool tops out near one transaction per second. Getting there depends on cryptography upgrades from Tachyon and Valar Group working alongside faster node software like Zakura.
The Zcash Foundation says it welcomes the new client, framing multiple independent node implementations as a safeguard against the kind of single point of failure that let the Orchard bug go unnoticed for as long as it did.