Iron Fish Halts Network Support Following Critical Exploit

The team behind the private L1 blockchain Iron Fish announced it is ending all remaining support for the network after discovering a fundamental vulnerability that has existed since 2019.

Timeline of the Critical Incident

• October 27: Through the ChainPort bridge on the Base network, 2.98 billion wIRON were minted—nearly 39 times the total existing supply of IRON.
• Attackers sold the tokens for approximately $197,400, as confirmed by Bitquery data.

On October 28, the team warned users about issues with wIRON backing and recommended ceasing use of the bridge. On October 31, the cause of the outage was confirmed.

The vulnerability allowed attackers to repeatedly spend the same shielded coins, effectively creating unbacked assets.

The flaw in the blockchain had existed for seven years. The problematic code had been reviewed by both internal and external auditors, but the vulnerability remained undetected.