Zcash's Ironwood network upgrade is approaching testnet activation, according to a July 4 post from CoinMarketCap. The upgrade is the protocol's answer to a counterfeiting vulnerability disclosed in May 2026 inside the Orchard shielded pool, a disclosure that sent ZEC down roughly 40% by CoinMarketCap's count. Other reporting puts the drawdown closer to 50% before an 80% rebound off the lows, so the exact damage depends on which window you measure.
The goal of Ironwood is blunt: let anyone running a Zcash node verify, on their own, that the circulating supply is sound. Since the Orchard disclosure, that has not been possible.
The bug that broke supply verification
On May 29, 2026, security researcher Taylor Hornby, working with Shielded Labs, found a soundness flaw in the zero-knowledge proof circuit behind Orchard, the shielded pool Zcash activated in May 2022. In theory, the flaw could have let an attacker mint counterfeit ZEC inside the pool without anyone noticing.
Developers moved fast. A temporary soft fork disabled Orchard, and the NU6.2 hard fork activated at block 3,364,600 with a corrected proof circuit. No evidence of actual exploitation has surfaced.
The patch stopped the bleeding but left a wound open. As Zooko Wilcox and Jason McGee put it, users "cannot simply inspect the chain and prove that no counterfeit funds were ever created inside Orchard before the patch." Because Orchard is a shielded pool, its contents are private by design. If counterfeit ZEC was minted before the fix, it would be sitting inside the pool, invisible.
A turnstile between the old pool and the new one
Ironwood resolves that uncertainty with an accounting mechanism Zcash calls a turnstile. The upgrade seals the legacy Orchard pool: no new outputs, no internal circulation. Every ZEC still inside must exit through the turnstile to enter a new shielded pool built on the corrected circuit.
The turnstile enforces one rule: the total value leaving the old pool cannot exceed the value that verifiably entered it. If counterfeit coins exist in there, they cannot all come out. Honest holders migrate; any phantom supply gets trapped behind the gate.
Per the Zcash team, the payoff lands immediately at activation: "users will be able to independently verify that the circulating supply of Zcash is sound, just by running a node." That restores the property the May disclosure took away, without ever needing to know whether the bug was actually exploited.
Late July target at block 3,417,100
Testnet activation is the near-term milestone, with mainnet targeted around late July 2026 at block height 3,417,100, per reporting from CryptoNewsZ. Two independently developed consensus implementations are involved, one from Valar Group and one from the Zcash Foundation, with the Valar version under audit. Migration tooling is already staged for testnet, including a desktop wallet fork with migration code and firmware updates for Keystone devices.
The dual-implementation approach matters here. A supply-integrity fix that itself shipped with a consensus bug would be a disaster for a chain already burned once this year, and independent implementations checking each other reduce that risk.
For holders, the practical takeaway is that funds in the old Orchard pool will need to migrate through the turnstile after activation. Wallet software is being updated to handle that, but anyone self-custodying ZEC in a shielded address should expect a migration step rather than assume balances carry over untouched.
The broader market backdrop is not doing Zcash any favors. The Crypto Fear & Greed Index sits at 25, in Fear territory, as of July 4, 2026, with BTC at $62,440 (+1.4% in 24 hours) and ETH at $1,748 (+2.2%). A privacy chain trying to rebuild trust is doing it in a market that is not handing out benefit of the doubt.
Overview
Zcash's Ironwood upgrade is nearing testnet activation, with mainnet targeted around late July 2026 at block 3,417,100. The upgrade seals the Orchard shielded pool, where a counterfeiting bug was disclosed in May 2026, and forces all remaining ZEC through a turnstile into a new pool built on a corrected proof circuit. The turnstile caps withdrawals at verified deposits, trapping any counterfeit supply that may exist. At activation, node operators regain the ability to independently verify Zcash's circulating supply, a property the chain lost six weeks ago along with roughly 40-50% of its price.
