Privacy Public Chain Iron Fish: Will terminate remaining support, confirm inflation vulnerability

The privacy public chain Iron Fish officially announced that it will formally terminate all remaining support for the Iron Fish network on that day. The team stated that several days ago, they observed unusual activities involving wIRON and the cross-chain bridge ChainPort. After collaborating with ChainPort and reviewing its logs, they confirmed that the reason was an inflation vulnerability present in the Iron Fish blockchain itself.

The official statement indicated that the vulnerability can be traced back to a commit in the implementation of the Merkle tree in early 2019. At that time, the developers implemented a standard Merkle tree, but due to a detail difference in the calculation method of the ticket nullifier, attackers were able to spend the same ticket multiple times, subsequently aggregating the related tickets and transferring them out through the ChainPort cross-chain bridge. The official statement noted that this code path had been included in both external and internal audit scopes, but it was not discovered during the review.

The team stated that they submitted a vulnerability patch before shutting down and archiving the ironfish codebase, and attached an explanation in the related PR. The Iron Fish mainnet was launched on April 20, 2023, and the developing company was later acquired by Coinbase; the foundation announced a transition to maintenance mode in April 2026.