Announcements Crypto & Anonymous Payments

How protect your IP address during and after the Ironwood upgrade

NymVPN extending free passes for Zcash users to transfer their ZEC privately and securely without leaking your IP

August 5, 20269 mins read

Update on Ironwood and Nym

Take your time to transfer your shielded ZEC securely, as Zcash devs have recommended. To help, Nym has extended its free NymVPN offer to shielded ZEC holders to protect their privacy in the period after the Ironwood upgrade. Here's what you need to know.

What you should know: Zcash's Ironwood

NymVPN is now free for Zcash users for one month. Why? Because Zcash and Nym share an ethos: a private internet means private finance, free from surveillance. Nym is a proud supporter of Zcash which is an awesome technology that values freedom.

The reason why Zcash users get access to NymVPN for free is specific: on 28 July 2026, the Ironwood upgrade (NU6.3) seals Zcash's Orchard pool at block 3,428,143, and every holder of funds in the Orchard pool will have to migrate them to the new Ironwood pool before using them. That migration is less private than the rest of Zcash, and NymVPN closes the part of the gap that matters most.

When you migrate, two things become visible:

The amount you move is written to the public blockchain through the turnstile: that is by design, so anyone can verify the supply.
And the transaction is broadcast from your device, so your IP address can be linked to that amount by your lightwallet server or by anyone watching your network.

Zcash's zero-knowledge proofs shield what is on the chain: they were never meant to hide the network underneath it.

This is where Nym has you covered. To help Zcasherd prepare for a private Ironwood migration, NymVPN is free for a month. Nym may extend that offer, and plans to integrate directly into Zcash wallets, since the migration may take time.

Why the network layer matters now

How NymVPN protects an Ironwood migration: your wallet's traffic passes through the Nym mixnet, so the lightwallet server and network see a Nym exit IP, not your personal IP address. And Nym network noise hides the traffic patterns.

Under normal use, your shielded ZEC transactions don't reveal amounts to your wallet server, so your network exposure is limited. Ironwood changes that. The Orchard pool is sealed, so the only way to use those funds is to migrate them. Note that this is by design in order to provide all users a complete public accounting of how many ZEC leave the Orchard pool.

However, this migration will reveal the amount you hold and link it to your IP and your identity unless you protect that layer yourself. This is where NymVPN helps.

Some of Zcash's own security researchers reached the same conclusion. Shielded Labs' Ironwood docs and founder Zooko Wilcox, writing on the Zcash forum name the primary defense plainly: network-level privacy tools like Nym or Tor protect you if you connect your network traffic via these tools before you begin to migrate.

"For every user, the number one most important issue is having network-level privacy (i.e. Tor or Nym) before migrating." — Zooko Wilcox, on the Zcash Community Forum

Take your time to migrate privately

Nym and Shielded Labs are also partnering to build and host a Nym-enabled zainod server. Zainod is the indexing service that allows Zcash wallets to synchronize with the blockchain and submit transactions. By routing those connections through the Nym mixnet, the new server will give wallets network-level privacy without requiring users to connect directly to an ordinary lightwallet server that can see their IP address. We expect the server to be available around the second week of August at the latest.

Users should not feel pressured to move their funds as soon as Ironwood activates. We believe it is more important to migrate privately and securely than to migrate quickly. As Shielded Labs has previously explained, it is highly unlikely that the Orchard vulnerability was exploited. An additional encouraging sign is that the total balance of the Orchard pool has remained steady at approximately **3.7 million ZEC&& over the past two months. Users should therefore be patient and take the time to migrate in a way that protects their privacy.

Get NymVPN free and protect your ZEC transfer

The ZEC ⇄ $NYM swapper: Enter your Zcash address to receive your free one-month NymVPN passphrase.

Go to Nym's ZEC ⇄ $NYM swapper, Generate my deposit address, and enter your Zcash wallet address. You'll receive a 1-month free pass for NymVPN: no card or signup required.

Notes: You'll need to send a small amount of ZEC for proof of ownership of shielded ZEC and as a sybil defense mechanism. Optionally, you can also get your $ZEC converted to $NYM tokens with the same swapper to help support nodes in the Nym network and get 85% off a future NymVPN subscription.

Activate the freepass, and save your 24-word anonymous passphrase from your Account somewhere secure. No email, no account, no KYC, nothing that identifies you.
Download NymVPN and Sign into account (not Create new account) by pasting your passphrase.
Connect to NymVPN before you migrate. Fast mode is decentralized and hides your IP address with 2-hop obfuscation and speeds faster than Tor. Mixnet mode, routed through the Noise Generating Mixnet, goes further by hiding your traffic patterns with network noise. It's slower, but the strongest and most anonymous option for anyone at higher risk.

That is all it takes to stop your IP being linked to your balance during the move.

See your Zcash wallet security recommendations for everything else.

Want maximum privacy?

If you want even more privacy, you can delink your IP address used by your wallet in your initial block synchronization from migration, by turning on Fast mode on NymVPN for any block synchronization prior to migration and Mixnet mode for the migration of your balance and smaller block synchronizations.

Here's how to do the recommend configuration:

With NymVPN connected in Fast mode, first turn on your wallet and make sure your wallet is fully synchronized with the blockchain.
then switch to Mixnet mode, select a different exit node, and then complete your Orchard-to-Ironwood migration with a "send" from Orchard to Ironwood pools in your wallet as usual, likely by hitting a "migrate" button. This will unlink any block synchronization IP address from the IP address used in your Ironwood migration.

Note: The Mixnet mode can be slow and unreliable, so you may need to try multiple times to migrate fully with NymVPN on.

Using Zodl Wallet? Migrate using Tor in-app

Some wallets like Zodl also enable Tor, and Tor can be used during migration. However, it may have issues with syncing with the blockchain. With Zodl, make sure to turn Tor on in Zodl before migration by going to Advanced Settings then Tor Protection and Enable before you press the Migrate Immediately or Migrate with Privacy button.

If you want to delink your IP address of your Ironwood migration from your initial block synchronization and you find block synchronization is not working fast enough over Tor, you can install NymVPN and sync in Fast mode before hitting the Migrate button with Tor enabled.

Ask your wallet to add Nym

Other Zcash wallets are building native Nym integration too. If you want this protection inside the wallet you already use, ask its developers when it is coming.

Building a wallet yourself? Read Nym's implementation guidance for Zcash wallets and the SDK docs and demos for how to integrate the Nym mixnet into wallet infrastructure with Nym's new SDK. And using the Nym mixnet via the SDK is free for a limited time.

No NymVPN, and your wallet has no Nym or Tor? Hold tight

Don't worry. Nym is working with Shielded Labs to host a Nym-enabled server (zainod) that routes through the mixnet by default. Any wallet that connects to it gives its users network-level privacy automatically, with nothing to install: your migration traffic is protected even if your wallet hasn't added Nym or Tor yet. Nym will announce it when it is live.

What NymVPN protects, and what it doesn't

Let's be clear about the boundary. NymVPN protects the network layer: it stops your IP address, and the metadata tied to it, from being linked to the balance you migrate.

It does not hide the amount itself, because the turnstile records that on the public chain by design. To reduce what the amount reveals, follow your wallet's guidance on splitting your transfer into smaller migrations.

Network-level privacy via Nym wallet integrations or simply by using NymVPN behind your personal wallet is necessary for a safe migration: pair it with your wallet's amount-hiding for the full picture.

Can I use any VPN for the Ironwood upgrade?

You can, but a centralized VPN won't make your migration private. A regular VPN is run by one company that sees both your real IP and your traffic: a single, centralized point that can link you to your transaction, and that can be compelled to hand that link over. You are not removing the middleman, only swapping one for another.

NymVPN is different by design. Your traffic is routed across a decentralized network of independent nodes, so no single operator, Nym included, can tie your identity to what you are sending. That is the difference between a promise not to log and an architecture that can't.

Get protected before you migrate

Ironwood activated on 28 July. You do not need to migrate immediately, but you should prepare before you do. Set up NymVPN or another network-privacy tool before moving your funds, and take the time to migrate privately rather than rushing.

About the authors

Casey Ford, PhD

Communications Lead

Casey is the Head of Communications, lead writer, and editorial reviewer at Nym. He holds a PhD in Philosophy and researches the intersection of decentralized technologies and social life.

New low prices

The world's most private VPN

Try NymVPN for free

New low prices

The world's most private VPN

Try NymVPN for free

Keep Reading...

Crypto & Anonymous Payments

Is Zcash anonymous? Shielded and transparent transactions explained

Zcash can be one of the most private ways to hold crypto, or barely private at all. The difference is how you use it, and what the network can still see.

July 26, 20268 mins read