Key Notes
- Iron Fish says a longstanding inflation flaw enabled repeated spending of shielded notes and is ending remaining network support.
- Bitquery traced about 2.98 billion wIRON mints and $197,400 in sale proceeds, not billions of dollars stolen.
- The published patch changes consensus roots and is intended for a new chain rather than an in-place mainnet repair.
Iron Fish is ending its remaining network support after identifying an inflation vulnerability that allowed an attacker to spend the same shielded funds repeatedly and exit through the ChainPort bridge. The team traced the design flaw to code dating to early 2019 and said internal and external audits had missed it.
The announcement was published on October 30 in UTC. It followed abnormal issuance of wrapped IRON, or wIRON, on Base and a warning that the wrapped token’s backing could no longer be assured.
A Timeline From Abnormal Mints to Support Withdrawal
- October 27: Bitquery recorded 2,977,027,045 wIRON minted on Base through ChainPort in fourteen transactions.
- October 28: Iron Fish warned against buying wIRON on Base or using the bridge while it investigated the issuance.
- October 30: The team attributed the incident to a bug in Iron Fish itself and announced the end of its remaining support.
In its October 28 investigation, Bitquery put the new issuance at about 38.7 times the approximately 76.9 million native IRON then in existence. It calculated that two newly active wallets sold the minted tokens for roughly $197,400 in USDC and ETH.
Those figures measure different things: 2.98 billion is a token quantity, while $197,400 is estimated sale proceeds. Neither establishes a multibillion-dollar theft. Bitquery also said the public Base record could not establish whether ChainPort fulfilled subsequent requests to redeem wIRON for native IRON, or whether the two selling wallets shared an operator.
The Bug Allowed Repeated Spending of Shielded Notes
Iron Fish said its review with ChainPort traced the cause to an interaction between its Merkle tree and note nullifiers. A nullifier is intended to let the network recognize that a shielded note has already been spent without revealing the note’s private details.
The technical postmortem explains that the old tree copied a populated branch into an empty position. The same funded note could consequently authenticate at a different position and generate a different nullifier, evading the repeated-spend check.
The finding concerns a holder repeatedly spending a note they control; it does not demonstrate that this mechanism lets an attacker spend an arbitrary other user’s note. The postmortem also keeps the reproduced code-level flaw separate from attribution of particular historical shielded transactions.
The 2019 date describes the origin of the faulty design, not seven years of live mainnet operation. Iron Fish’s mainnet launched on April 20, 2023.
The Published Fix Is Not a Mainnet Upgrade
The team said it committed a patch and included a postmortem before its planned repository shutdown and archiving. But the repository’s compatibility warning says the changed note-tree roots are incompatible with existing mainnet and testnet history.
The implemented fix is intended for a new chain with a new genesis. It does not provide an activation rule or migration plan that repairs the existing chain in place. Publishing corrected code therefore does not establish that the current network has been safely upgraded.
Maintenance Mode Preceded the Exploit
The Foundation had already moved into maintenance mode in April, ending grants and reducing development while continuing supporting infrastructure. That announcement followed Coinbase’s acquisition of the development company and thanked independent miners and node operators for keeping the network running.
The new support withdrawal should likewise not be read as proof that every independently operated node has stopped. The disclosure provides no compensation plan or verified campaign-wide loss figure.
Iron Fish’s earlier warning told users to avoid buying wIRON on Base or using the bridge because full one-to-one backing could not be guaranteed. Token burning or a redemption request alone is not evidence that a holder has received the corresponding native assets.
The case adds a protocol-security failure to the project wind-downs covered in CoinScreamer’s Recall Foundation report and review of crypto-project closures. Recall’s shutdown was economic and explicitly not the result of a hack; the reasons should remain distinct.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
