Iron Fish Ends Network Support After 2.98 Billion wIRON Issued on Base
Key Facts
On October 30, 2026, Iron Fish announced it was ending all remaining support for the network after linking abnormal activity in the wIRON token to an inflation flaw in the Iron Fish chain itself. The company said the attacker exited through the ChainPort bridge, shifting the focus of the incident from the bridge alone to the integrity of the chain that issued the underlying asset. Iron Fish had previously warned users against buying wIRON on Base or using the bridge. It said in its warning: "Please avoid buying wIRON on Base or using the bridge until further notice." It added that "full 1:1 backing cannot be guaranteed" at that time.
Bitquery data showed that ChainPort issued 2.98 billion wIRON on Base on October 27, across 14 minting transactions. The token is the Base version of IRON, according to the report. Bitquery said all 14 transactions passed the bridge's signature and maintenance checks and were sent from the same account used for routine minting. This indicates that the minting transactions passed the bridge's stated checks, while the Iron Fish team attributed the underlying flaw to its blockchain. The report said 14 out of 14 transactions passed those checks, identifying the issuance path that preceded the project's warning.
In the asset redemption claims process, 192.0 million wIRON was burned by 212 claimants seeking original IRON, according to Bitquery. The report tracked the claims in data published on October 28. But the public record on Base does not show whether ChainPort paid those claims. That leaves the redemption status unresolved in the available information on the burns. Iron Fish had said in its warning that full 1:1 backing could not be guaranteed, placing redemption claims at the center of concerns about the wrapped token.
TokenPost said the flaw stemmed from code committed in early 2019, when Iron Fish implemented its Merkle tree architecture. The team said the affected code path was within the scope of both its internal and external audits, but was not detected during review. Iron Fish said: "This code path was within the scope of our external and internal audits, but the flaw was not detected during review." According to the technical analysis in the patch, the attacker could double-spend a note they had authority to spend. The vulnerability did not allow direct spending of other users' notes, a limitation that defines the scope of the exploit described in the analysis.
A pinned read of the wIRON contract on Base showed a supply of 3,925,937.805213 units at block 53143118, while the paused status returned false. This is a reading of the contract's state at that block and does not establish the amount of assets backing the token or the issuance volume resulting from the exploit. The recorded supply value alone therefore does not represent an estimate of what the bridge issued on October 27, when Bitquery reported 2.98 billion wIRON. The distinction between published contract data and the issuance transactions tracked in the report is important in assessing the token's status. The recorded paused status was also false in that snapshot, without by itself establishing the status of all bridge or network operations.
On October 30, TokenPost reported that the team had submitted a patch and attached a detailed post-incident analysis to the related change request. But the patch is for a new chain with a new genesis block and is incompatible with the history of the current network, according to the patch details included in the evidence. Submitting it therefore does not automatically address the existing network or its balances. The team later announced it was ending support and archiving the code repository, while the process for claims to redeem original IRON remained unclear in the public data tracked by Bitquery. The announcement that support was ending did not establish that every independent node on the network had stopped.