Privacy-focused blockchain Iron Fish said it will formally end all remaining support for the Iron Fish network on the day of the announcement, after identifying what it described as an inflation vulnerability in the chain itself. The team said it noticed unusual activity involving wIRON and the ChainPort bridge several days earlier. After working with ChainPort and reviewing its logs, it concluded that the root cause was not limited to bridge behavior but traced back to Iron Fish’s own code. According to the project, the flaw dates to a commit made in early 2019 during the implementation of a Merkle tree. Although developers built a standard Merkle tree, a detail in how note nullifiers were calculated allowed an attacker to spend the same note multiple times, aggregate the related notes, and then move them out through ChainPort. Iron Fish said the code path had been covered by both external and internal audits, but the issue was not detected during review. The team added that it submitted a patch before shutting down and archiving the ironfish code repository, and included a postmortem in the related pull request. Iron Fish mainnet launched on April 20, 2023. Its development company was later acquired by Coinbase, and the foundation said in April 2026 that the project had moved into maintenance mode.
Privacy-focused blockchain Iron Fish said it will formally end all remaining support for the Iron Fish network on the day of the announcement.
The team said it observed unusual activity involving wIRON and the ChainPort cross-chain bridge several days earlier. After working with ChainPort and reviewing its logs, it confirmed that the cause was an inflation vulnerability in the Iron Fish blockchain itself.
Bug traced to an early 2019 code commit
According to the project, the flaw can be traced back to a commit made in early 2019 during the implementation of a Merkle tree. Iron Fish said developers implemented a standard Merkle tree at the time, but a detail in the way note nullifiers were calculated allowed an attacker to spend the same note multiple times, aggregate the related notes, and then transfer them out through the ChainPort bridge.
The project also said this code path had been included in both external and internal audits, but the issue was not found during those reviews.
Patch submitted before repository archive
The team said it submitted a fix before shutting down and archiving the ironfish code repository, and attached a postmortem to the related pull request.
Iron Fish mainnet launched on April 20, 2023. Its development company was later acquired by Coinbase, and the foundation said in April 2026 that the project had entered maintenance mode.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
