Privacy Public Chain Iron Fish: Will terminate remaining support, confirm inflation vulnerability

The privacy public chain Iron Fish officially announced that it will formally terminate all remaining support for the Iron Fish network on that day. The team stated that several days ago, they observed abnormal activities involving wIRON and the cross-chain bridge ChainPort. After collaborating with ChainPort and reviewing its logs, they confirmed that the cause was an inflation vulnerability present in the Iron Fish blockchain itself.

The official statement indicated that this vulnerability can be traced back to a commit in the Merkle tree implementation in early 2019. At that time, the developers implemented a standard Merkle tree, but due to a detail difference in the calculation method of the note nullifier, attackers were able to spend the same note multiple times, subsequently aggregating the related notes and transferring them out through the ChainPort cross-chain bridge. The official stated that this code path had been included in both external and internal audit scopes, but it was not discovered during the review.

The team mentioned that they submitted a vulnerability patch before shutting down and archiving the ironfish codebase, and attached an explanation in the related PR. The Iron Fish mainnet was launched on April 20, 2023, and the developing company was later acquired by Coinbase; the foundation announced a transition to maintenance mode in April 2026.