Iron Fish shuts down its privacy blockchain after a 2019 bug let an attacker spend the same coins repeatedly and cash out through a bridge

A privacy blockchain has switched itself off over a bug that sat in its code for more than seven years. Iron Fish said on October 30 that it was ending all remaining support for its network after an investigation with the ChainPort bridge operator found the cause of unusual wIRON issuance on Base: an inflation bug in the Iron Fish chain itself, crypto.news and DeFiprime reported.

The project had warned users on October 28 to avoid buying wIRON on Base or using the bridge, DeFiprime reported. The root cause, according to the team's postmortem, was a commit from early 2019 implementing the chain's Merkle tree. Its interaction with how a note's nullifier is calculated, the marker that is supposed to stop shielded funds being spent twice, let an attacker spend the same note repeatedly, gather the resulting coins and exit through ChainPort. "This code path was within the scope of both our external and internal audits, but the bug wasn't caught during review," the team said.

Iron Fish committed a patch and a detailed postmortem, then shut down and archived its repository. It did not disclose how much was minted or withdrawn, or offer a compensation plan, crypto.news reported. The outlet said screenshots shared by traders showed wIRON's displayed market value on the Aerodrome exchange collapsing from about $200 million to a few thousand dollars, figures it cautioned reflect thin trading pairs rather than confirmed losses.

The network went live on April 20, 2023, and Base, the Coinbase-backed network, acquired the Iron Fish development team in March 2025, according to crypto.news. The foundation had already moved the chain into maintenance mode in April 2026, DeFiprime noted, so the shutdown ends the last of its commitments, though independent nodes may keep running.