Quick answer: The Iron Fish shutdown came on Oct. 30, 2026: the team ended all remaining support after an attacker used a 2019 Merkle tree bug to spend the same note more than once and exit through the ChainPort bridge, per the team’s post on X. IRON fell 60% in 24 hours to about $0.0146, per CoinGecko.
The Iron Fish shutdown is now final. On Oct. 30, 2026, at 21:16 UTC, the team behind the privacy-focused blockchain said it is “officially ending all remaining support for the Iron Fish network” after it found an inflation bug that sat in its code since early 2019.
In other words, the attacker did not break a bridge or steal keys. Instead, they found a way to spend the same private note more than once, stacked up the extra coins and cashed out through the ChainPort bridge.
What happened to Iron Fish?
The trouble surfaced on Oct. 28, 2026, at 02:39 UTC, when Iron Fish warned on X that it was investigating “abnormal wIRON issuance on Base.” It told users to avoid buying wIRON or using the bridge because “full 1:1 backing cannot be assured.”
Two days later, however, the shutdown post gave the cause. After reviewing ChainPort’s logs, the team said the problem was “an inflation bug in the Iron Fish blockchain itself,” not in the bridge. The attacker “compounded the exploit, aggregated their notes, and exited through the ChainPort bridge.”
How could one note be spent twice?
Iron Fish, like Zcash, hides balances inside encrypted “notes.” So when you spend a note, the chain records a nullifier, a unique tag that stops the same note being used again.
According to the team, a 2019 commit in its Merkle tree code had a subtle flaw. A DefiPrime breakdown of the postmortem explains that a copied branch in the tree let a note be proven at a second, unfunded position. As a result, that position produced a different nullifier, and the network saw a “new” spend and let the attacker create more value than they held.
Two limits matter:
- The bug let an attacker re-spend their own note. It did not let anyone spend other users’ funds.
- The postmortem also says on-chain data alone cannot prove which past transactions used the flaw, so nobody has published the exact amount created.
The team added: “This code path was within the scope of both our external and internal audits, but the bug wasn’t caught during review.”
Why can’t Iron Fish just patch it?
The team committed a fix before it archived the repository. However, the fix changes how the code builds tree roots. Per the postmortem summary, the existing mainnet and testnet histories are incompatible with the patch. It only works for a brand-new chain with a fresh genesis, and there is no migration plan for current balances.
Before this, the project already ran in maintenance mode, with the foundation running only bootstrap nodes, the explorer and the website. Those now go away. Independent nodes may keep running, but nobody officially maintains the network anymore.
What does this mean for IRON and wIRON holders?
Meanwhile, the market reacted fast. IRON traded near $0.0146 at 07:51 UTC on Oct. 31, 2026, down about 60% in 24 hours and 80% in seven days, per CoinGecko. Its market cap is roughly $1.1 million, more than 99.9% below the $17 all-time high from April 2023.
On Base, DefiPrime cites a reading of 3,925,937.8 wIRON in supply at block 53143118. That shows the wrapped token’s supply, not how much native IRON still backs it. Iron Fish has not said when, or whether, full backing can be restored.
For now, if you hold IRON or wIRON, treat both as high risk. Do not buy wIRON hoping for a quick rebound, and be wary of anyone offering a “recovery” or “migration” tool. Iron Fish has not announced one. Our guide on how to spot crypto scams covers the most common tricks.
Market implications: why attackers now target old code
Notably, this is the second privacy-chain inflation exploit we have covered this year, after the Pirate Chain exploit that minted 39.8M ARRR. It also echoes the Initia unbacked mint and a quarter where crypto hacks topped $1.18B despite audits.
Still, the team’s own warning is the bigger story. It said software “that can’t be upgraded immediately (most of crypto) is in an extremely precarious position” and that finding bugs in complex code “is becoming commoditized” as AI models improve. Expect more scrutiny of older, low-activity chains and their bridges. For a wider view of these risks, see our explainer on DeFi risks.
Iron Fish Shutdown FAQ
Why is Iron Fish shutting down?
Iron Fish said on Oct. 30, 2026 that an inflation bug in a 2019 Merkle tree commit let an attacker spend the same note more than once. Because the patch cannot fix the chain’s existing history, the team ended all remaining support and archived the code.
Were Iron Fish users’ funds stolen directly?
No. Per the postmortem, the bug only let an attacker re-spend their own note, not other users’ notes. Instead, the damage comes from new, unbacked coins that the attacker moved out through the ChainPort bridge, which dilutes everyone else.
Is wIRON on Base still backed 1:1?
Iron Fish said on Oct. 28, 2026 that “full 1:1 backing cannot be assured” and asked users to avoid buying wIRON or using the bridge. It has given no timeline for restoring backing.
What is the IRON price after the exploit?
IRON traded near $0.0146 on Oct. 31, 2026, down about 60% in 24 hours and about 80% in a week, per CoinGecko. That is more than 99.9% below its $17 peak from April 2023.
Not financial advice. Crypto assets are volatile and can lose all their value. Always do your own research (DYOR).
