Iron Fish shuts down network after inflation bug enabled double-spend exploit
Security & Exploits ·
The privacy-focused blockchain is closing operations after an attacker exploited a flaw to double-spend notes and move funds off-chain through ChainPort.
Iron Fish is shutting down its network following a critical inflation bug that allowed an attacker to double-spend notes within the protocol and exit the stolen value through the ChainPort bridge, according to a statement from the project's own account, cited in reporting on x.com. The team has also flagged that the wrapped version of its token on Base, along with the bridge connecting it, should now be treated as unsafe.
The mechanics of the exploit center on a defect in how the network validated transaction notes, the core unit of value transfer in Iron Fish's privacy-preserving design. An inflation bug of this kind lets an attacker create or reuse value that should not exist, effectively minting spendable funds without backing. Once generated, that value was moved off the native chain via ChainPort, a cross-chain bridge, putting it beyond the reach of any on-chain remediation the Iron Fish team could attempt.
The shutdown places Iron Fish in a familiar pattern among crypto projects that close after a hack drains or compromises their systems, a dynamic detailed in broader coverage of crypto shutdowns at leviathan.news. That overview notes that when a protocol is hit by an exploit, teams typically face a choice between rebuilding, pivoting, or winding down, and that the resulting shutdown notice is often the first signal users see that smart contract risk has materialized. Other projects cited in that same framework, including one that closed after a 2025 exploit and another whose infrastructure was hit by the Drift exploit, followed comparable paths — instructing users to withdraw remaining assets before deadlines rather than attempt a fix.
Separate coverage of the Iron Fish closure, tracked at defiprime.com, corroborates that the network is ending support following the inflation bug and the compromised bridge status. Together, the available reporting confirms the exploit mechanism, the bridge exit route, and the decision to cease network operations, though the two sources overlap substantially rather than offering fully independent detail.
What remains unclear is the total amount of value affected by the double-spend, whether any funds moved through ChainPort can be recovered or frozen, and what timeline or process Iron Fish will offer holders of the wrapped Base token to withdraw or exchange remaining assets. Also unresolved is whether ChainPort itself will take any action regarding the exploited funds that passed through its bridge, and whether other assets bridged through the same route face similar exposure.