NymVPN is free for Zcash users: Protect your IP address during the Ironwood upgrade
Network-level anonymity for your Orchard-to-Ironwood transfers, so migrating your ZEC doesn't link your balance to your identity
Share
NymVPN is now free for Zcash users for one month. Why? Because Zcash and Nym share an ethos: a private internet means private finance, free from surveillance. Nym is a proud supporter of Zcash which is an awesome technology that values freedom.
The reason why Zcash users get access to NymVPN for free is specific: on 28 July 2026, the Ironwood upgrade (NU6.3) seals Zcash's Orchard pool at block 3,428,143, and every holder of funds in the Orchard pool will have to migrate them to the new Ironwood pool before using them. That migration is less private than the rest of Zcash, and NymVPN closes the part of the gap that matters most.
When you migrate, two things become visible:
- The amount you move is written to the public blockchain through the turnstile: that is by design, so anyone can verify the supply.
- And the transaction is broadcast from your device, so your IP address can be linked to that amount by your lightwallet server or by anyone watching your network.
Zcash's zero-knowledge proofs shield what is on the chain: they were never meant to hide the network underneath it.
This is where Nym has you covered. To help Zcasherd prepare for a private Ironwood migration, NymVPN is free for a month. Nym may extend that offer, and plans to integrate directly into Zcash wallets, since the migration may take time.
Why the network layer matters now
How NymVPN protects an Ironwood migration: your wallet's traffic passes through the Nym mixnet, so the lightwallet server and network see a Nym exit IP, not your personal IP address. And Nym network noise hides the traffic patterns.
Under normal use, your shielded ZEC transactions don't reveal amounts to your wallet server, so your network exposure is limited. Ironwood changes that. The Orchard pool is sealed, so the only way to use those funds is to migrate them. Note that this is by design in order to provide all users a complete public accounting of how many ZEC leave the Orchard pool.
However, this migration will reveal the amount you hold and link it to your IP and your identity unless you protect that layer yourself. This is where NymVPN helps.
Some of Zcash's own security researchers reached the same conclusion. Shielded Labs' Ironwood docs and founder Zooko Wilcox, writing on the Zcash forum name the primary defense plainly: network-level privacy tools like Nym or Tor protect you if you connect your network traffic via these tools before you begin to migrate.
"For every user, the number one most important issue is having network-level privacy (i.e. Tor or Nym) before migrating." — Zooko Wilcox, on the Zcash Community Forum
Take your time to migrate privately
Nym and Shielded Labs are also partnering to build and host a Nym-enabled zainod server. Zainod is the indexing service that allows Zcash wallets to synchronize with the blockchain and submit transactions. By routing those connections through the Nym mixnet, the new server will give wallets network-level privacy without requiring users to connect directly to an ordinary lightwallet server that can see their IP address. We expect the server to be available around the second week of August at the latest.
Users should not feel pressured to move their funds as soon as Ironwood activates. We believe it is more important to migrate privately and securely than to migrate quickly. As Shielded Labs has previously explained, it is highly unlikely that the Orchard vulnerability was exploited. An additional encouraging sign is that the total balance of the Orchard pool has remained steady at approximately **3.7 million ZEC&& over the past two months. Users should therefore be patient and take the time to migrate in a way that protects their privacy.
Get NymVPN free and protect your ZEC transfer
- Go to Nym's ZEC ⇄ $NYM swapper, Generate my deposit address, and enter your Zcash wallet address. You'll receive a 1-month free pass for NymVPN: no card or signup required.
Notes: You'll need to send a small amount of ZEC for proof of ownership of shielded ZEC and as a sybil defense mechanism. Optionally, you can also get your $ZEC converted to $NYM tokens with the same swapper to help support nodes in the Nym network and get 85% off a future NymVPN subscription.
- Activate the freepass, and save your 24-word anonymous passphrase from your Account somewhere secure. No email, no account, no KYC, nothing that identifies you.
- Download NymVPN and Sign into account (not Create new account) by pasting your passphrase.
- Connect to NymVPN before you migrate. Fast mode is decentralized and hides your IP address with 2-hop obfuscation and speeds faster than Tor. Mixnet mode, routed through the Noise Generating Mixnet, goes further by hiding your traffic patterns with network noise. It's slower, but the strongest and most anonymous option for anyone at higher risk.
That is all it takes to stop your IP being linked to your balance during the move.
See your Zcash wallet security recommendations for everything else.
Want maximum privacy?
If you want even more privacy, you can delink your IP address used by your wallet in your initial block synchronization from migration, by turning on Fast mode on NymVPN for any block synchronization prior to migration and Mixnet mode for the migration of your balance and smaller block synchronizations.
Here's how to do the recommend configuration:
- With NymVPN connected in Fast mode, first turn on your wallet and make sure your wallet is fully synchronized with the blockchain.
- then switch to Mixnet mode, select a different exit node, and then complete your Orchard-to-Ironwood migration with a "send" from Orchard to Ironwood pools in your wallet as usual, likely by hitting a "migrate" button. This will unlink any block synchronization IP address from the IP address used in your Ironwood migration.
Note: The Mixnet mode can be slow and unreliable, so you may need to try multiple times to migrate fully with NymVPN on.
Using Zodl Wallet? Migrate using Tor in-app
Some wallets like Zodl also enable Tor, and Tor can be used during migration. However, it may have issues with syncing with the blockchain. With Zodl, make sure to turn Tor on in Zodl before migration by going to Advanced Settings then Tor Protection and Enable before you press the Migrate Immediately or Migrate with Privacy button.
If you want to delink your IP address of your Ironwood migration from your initial block synchronization and you find block synchronization is not working fast enough over Tor, you can install NymVPN and sync in Fast mode before hitting the Migrate button with Tor enabled.
Ask your wallet to add Nym
Other Zcash wallets are building native Nym integration too. If you want this protection inside the wallet you already use, ask its developers when it is coming.
Building a wallet yourself? Read Nym's implementation guidance for Zcash wallets and the SDK docs and demos for how to integrate the Nym mixnet into wallet infrastructure with Nym's new SDK. And using the Nym mixnet via the SDK is free for a limited time.
No NymVPN, and your wallet has no Nym or Tor? Hold tight
Don't worry. Nym is working with Shielded Labs to host a Nym-enabled server (zainod) that routes through the mixnet by default. Any wallet that connects to it gives its users network-level privacy automatically, with nothing to install: your migration traffic is protected even if your wallet hasn't added Nym or Tor yet. Nym will announce it when it is live.
What NymVPN protects, and what it doesn't
Let's be clear about the boundary. NymVPN protects the network layer: it stops your IP address, and the metadata tied to it, from being linked to the balance you migrate.
It does not hide the amount itself, because the turnstile records that on the public chain by design. To reduce what the amount reveals, follow your wallet's guidance on splitting your transfer into smaller migrations.
Network-level privacy via Nym wallet integrations or simply by using NymVPN behind your personal wallet is necessary for a safe migration: pair it with your wallet's amount-hiding for the full picture.
Can I use any VPN for the Ironwood upgrade?
You can, but a centralized VPN won't make your migration private. A regular VPN is run by one company that sees both your real IP and your traffic: a single, centralized point that can link you to your transaction, and that can be compelled to hand that link over. You are not removing the middleman, only swapping one for another.
NymVPN is different by design. Your traffic is routed across a decentralized network of independent nodes, so no single operator, Nym included, can tie your identity to what you are sending. That is the difference between a promise not to log and an architecture that can't.
Get protected before you migrate
Ironwood activates on 28 July. You do not need to migrate immediately, but you should prepare before you do. Set up NymVPN or another network-privacy tool before moving your funds, and take the time to migrate privately rather than rushing.
About the authors
Casey Ford, PhD
Communications LeadTable of contents
Keep Reading...
Is Zcash anonymous? Shielded and transparent transactions explained
Zcash can be one of the most private ways to hold crypto, or barely private at all. The difference is how you use it, and what the network can still see.
Swap your Zcash (ZEC) for $NYM
New Nym swapper allows your to get native $NYM privately with your shielded ZEC for big discounts on NymVPN and more
$NYM on Edge: $NYM integrated on Edge Wallet
The self-custodial wallet built on privacy principles & a trusted partner in the Nym privacy stack
NYM token flow: Powering the most private network
Delivering value to NymVPN users, operators, and builders