Iron Fish to end remaining network support after confirming inflation bug
Privacy-focused blockchain Iron Fish said it will formally end all remaining support for the Iron Fish network on the day of the announcement, after identifying what it described as an inflation vulnerability in the chain itself. The team said it noticed unusual activity involving wIRON and the ChainPort bridge several days earlier. After working with ChainPort and reviewing its logs, it concluded that the root cause was not limited to bridge behavior but traced back to Iron Fish’s own code. According to the project, the flaw dates to a commit made in early 2019 during the implementation of a Merkle tree. Although developers built a standard Merkle tree, a detail in how note nullifiers were calculated allowed an attacker to spend the same note multiple times, aggregate the related notes, and then move them out through ChainPort. Iron Fish said the code path had been covered by both external and internal audits, but the issue was not detected during review. The team added that it submitted a patch before shutting down and archiving the ironfish code repository, and included a postmortem in the related pull request. Iron Fish mainnet launched on April 20, 2023. Its development company was later acquired by Coinbase, and the foundation said in April 2026 that the project had moved into maintenance mode.
