Iron Fish shuts down after an inflation bug: what IRON miners should do now

Iron Fish, the privacy-focused proof-of-work chain mined on GPUs with the FishHash algorithm, is finished as a supported project. On October 30 the team announced it was ending all remaining support for the network after finding an inflation bug that let an attacker spend the same funds more than once. For miners, the takeaway is simple: IRON no longer has developers behind it, and there is no fix for the current chain.

What happened

On October 28 Iron Fish warned about abnormal issuance of wIRON, the wrapped token on Base, asked users not to buy it or use the ChainPort bridge, and said full 1:1 backing could not be assured. The same day MEXC suspended IRON deposits and withdrawals at the project's request (MEXC sign-up).

Two days later the team explained the cause. The bug came from an early 2019 commit in the Merkle tree code. Because of how a note's nullifier was calculated, the holder of a note could prove it at a second position, get a different nullifier and spend it again. The attacker repeated this, gathered the coins and left through ChainPort. Other users' notes could not be stolen this way, but new IRON that should not exist was created.

The team says this code path was covered by both external and internal audits, yet the bug was missed. A patch and a draft postmortem were committed to the Iron Fish repository before it was archived.

Why the chain cannot simply be patched

• The fix changes consensus roots, so it only works for a brand new chain with a new genesis block.
• The existing mainnet history, live since April 2023, cannot be made compatible with it.
• The team has not announced a migration, a relaunch or a compensation plan, and has not given a loss figure.

Ending developer support does not mean every independent node is switched off at once. But nobody is left to ship releases, fix bugs or coordinate with pools and exchanges.

What this means for GPU miners

• Stop treating IRON as a target. Coins mined now come from a chain with known inflation and no maintainers.
• Check your pool balance. If your pool still holds unpaid IRON, see whether it is paying out at all before you add more hashrate.
• Do not count on selling. With MEXC deposits frozen and wIRON on Base flagged by the team itself, there is no clear market for fresh coins.
• Move FishHash rigs elsewhere. Compare other GPU coins in a profitability calculator before switching.

This also changes our earlier take on ForgeMiner 1.9.0 and old GPUs: Iron Fish is no longer an option for an RX 580 or a GTX 1660.