Iron Fish has announced an end to all remaining network support after uncovering an inflation bug dating back to early 2019 that allowed an attacker to spend the same shielded funds repeatedly and exit through the ChainPort bridge.
Summary
- Iron Fish traced the exploit to its Merkle tree implementation and a flaw involving note nullifiers.
- The attacker repeatedly spent the same notes before aggregating funds and moving them through ChainPort.
- Internal and external audits covered the affected code path but failed to identify the vulnerability.
- The team said it committed a patch and included a postmortem before archiving its repository.
According to Iron Fish’s announcement, the investigation began after the team noticed abnormal activity involving wIRON and ChainPort several days earlier. Working with the bridge operator and reviewing its logs, developers traced the problem to the Iron Fish blockchain itself.
The statement did not disclose the total amount created through the exploit, the value withdrawn through the bridge, or a compensation plan for affected holders.
Iron Fish traces repeated spending to a 2019 flaw
The team traced the vulnerability to an early 2019 code commit implementing a standard Merkle tree, a structure used to organize and verify blockchain records.
In its explanation, Iron Fish identified an interaction between that implementation and the way a note’s nullifier is calculated. A nullifier is part of the mechanism used to prevent shielded funds from being spent again after a transaction.
Because of the flaw, the attacker could spend the same note more than once. Iron Fish said the attacker compounded the exploit, gathered the resulting notes and moved funds out through ChainPort.
“This code path was within the scope of both our external and internal audits,” the team wrote, while acknowledging that reviewers had missed the bug.
Before withdrawing support, developers said they committed a patch and included a detailed postmortem in the associated pull request. The announcement described the repository’s shutdown and archiving as the final steps.
Ending developer support does not, by itself, establish that every independently operated node has stopped. The statement specifically announced the withdrawal of all remaining support for the network.
wIRON charts show a collapse in the Base trading pair
Screenshots shared by traders AzFlin and Abu showed a steep fall in the displayed market capitalization of wIRON, the wrapped token trading on Base.
AzFlin described a decline from approximately $200 million to $2,000. His screenshot of the wIRON/USDC pair on Aerodrome displayed a market capitalization near $1,900 and just $302 in liquidity, alongside a warning that the pair had very little liquidity.
Abu shared a separate chart showing a displayed capitalization of roughly $1,600 after the collapse.
Those figures describe the wrapped token’s trading-pair valuation. They do not establish that the attacker stole $200 million, and Iron Fish’s announcement supplied no dollar loss estimate.
The project’s connection to Base predates the incident. In October 2025, crypto.news previously reported that Base was developing private transactions after acquiring the Iron Fish development team in March that year.
Coinbase CEO Brian Armstrong described the acquisition as bringing the team into Base to work on privacy infrastructure. The report described Iron Fish’s use of zero-knowledge proofs to conceal transaction details and its connections to other blockchains through ChainPort.
Earlier audits examined the core protocol and mining code
Iron Fish’s published security history includes a core-protocol audit by Inversed Tech, finalized on June 1, 2023.
The review covered protocol design, the Rust implementation of its privacy mechanism, and zero-knowledge proof circuits. Iron Fish listed 37 findings, including three critical issues and one warning, and said the identified problems were resolved and checked again.
One critical issue discovered before mainnet launch involved asset ID malleability, which could have broken the requirement that transaction inputs and outputs balance for each asset. Developers addressed that issue before the network launched on April 20, 2023.
A separate FishHash review involved Trail of Bits. Commissioned in January 2024, the seven-day assessment examined the mining algorithm’s specification and CPU implementations in Rust and C++.
Its stated scope concerned mining performance, memory requirements, and specialized hardware resistance.
ChainPort’s documented role extended beyond moving assets. In an August 2024 security notice, the Iron Fish Foundation described the bridge’s address screening, including checks against U.S. Office of Foreign Assets Control sanctions lists.
The same notice said ChainPort could freeze affected tokens and investigate suspicious activity, with the capability to freeze assets at particular addresses or burn funds identified as malicious.
