Iron Fish has ended all remaining network support after discovering a critical inflation bug that allowed an attacker to repeatedly spend shielded funds and exit through the ChainPort bridge. The team traced the vulnerability to an early 2019 Merkle tree implementation and a flaw in note nullifier calculation. Although internal and external audits covered the affected code path, they failed to detect the issue, according to the announcement.
The investigation began after abnormal activity involving wIRON and ChainPort was noticed several days earlier. The attacker compounded the exploit by spending the same notes more than once, gathering the resulting funds and moving them through ChainPort. Iron Fish committed a patch and postmortem before archiving its repository, but did not disclose the total amount created, the value withdrawn, or any compensation plan.
Screenshots shared by traders showed wIRON’s displayed market capitalization on Base falling from about $200 million to roughly $2,000. On Aerodrome, the wIRON/USDC pair showed a market cap near $1,900 and just $302 in liquidity. These figures describe the wrapped token’s trading-pair valuation, not a confirmed theft amount.
The Iron Fish project had connections to Base: Coinbase CEO Brian Armstrong said the team was brought into Base in March 2025 to work on privacy infrastructure. Earlier audits by Inversed Tech and Trail of Bits reviewed core protocol and mining code but did not catch the nullifier flaw.
In a separate Halloween attack, blockchain security firm Blockaid identified the Step Drainer toolkit across at least 12 DeFi websites. The affected projects included Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. Blockaid warned users to avoid connecting wallets or signing transactions. Flap confirmed its official domain was hijacked and redirected to an unauthorized site, while StonkFun said it restored its website after moving to new infrastructure and was unaware of any affected users.
The DNS attacks follow a similar incident in May 2025 when Curve Finance migrated to a new domain after a wallet-draining clone. No confirmed attacker, victim count, or aggregate loss figure was disclosed in the DeFi frontend attacks.
