Privacy-focused layer-1 blockchain Iron Fish has ceased all remaining network support after confirming a critical inflation vulnerability in code introduced in an early 2019 Merkle tree commit. The flaw involved nullifier logic intended to prevent a shielded note from being spent more than once, allowing attackers to reuse the same note, withdraw the funds and move proceeds off-chain through ChainPort, the bridge behind Iron Fish's wrapped token wIRON. Unusual activity involving wIRON and ChainPort prompted an investigation that traced the problem to Iron Fish's blockchain rather than the bridge. The project said the vulnerability had survived internal and external audits and that ledger integrity could no longer be trusted. Iron Fish launched its mainnet in April 2023 and entered maintenance mode in April 2026 before ending support. The team submitted a fix patch, published a post-mortem in an associated pull request, and is closing and archiving its code repository. Iron Fish disclosed the vulnerability on Oct. 30, 2026, warned holders not to buy wIRON as support ended, and said software that cannot be upgraded instantly remains vulnerable as exploit discovery becomes increasingly commoditized across the crypto industry.