Privacy Blockchain Iron Fish Confirms Inflation Vulnerability, Ends Remaining Support

According to Huoxing Finance, the official team behind the privacy blockchain Iron Fish has announced that it will formally terminate all remaining support for the Iron Fish network effective today. The team stated that several days ago, they observed anomalous activity involving wIRON and the ChainPort cross-chain bridge. After collaborating with ChainPort and reviewing its logs, they confirmed that the root cause was an inflation vulnerability inherent to the Iron Fish blockchain itself. The vulnerability traces back to a commit made in early 2019 in the implementation of the Merkle tree. At the time, developers implemented a standard Merkle tree; however, due to subtle differences in how票据 nullifiers were calculated, attackers were able to spend the same票据 multiple times, then aggregate them and withdraw via the ChainPort bridge. The team noted that this code path had been included in both external and internal audits, but the issue went undetected during reviews. Prior to shutting down and archiving the Iron Fish codebase, the team submitted a patch for the vulnerability and included a post-mortem explanation in the associated pull request. The Iron Fish mainnet launched on April 20, 2023; the development company was later acquired by Coinbase. The foundation had previously announced in April 2026 that it would transition into maintenance mode.