Iron Fish Shuts Down After a Seven-Year-Old Bug Let an Attacker Double-Spend Its Shielded Coins

Iron Fish announced the end of all network support after a vulnerability — a Merkle-tree flaw committed in early 2019, predating its 2023 mainnet — was exploited to spend the same shielded notes repeatedly, with proceeds moved out through the ChainPort bridge. The team, acquired by Coinbase’s Base in 2025, committed a patch and postmortem and is archiving the repository; the amount minted is undisclosed and no compensation was announced.