I’m done, I’m done—a bug that had been hiding for 7 years just took down an entire blockchain 😂
On October 27, someone found a vulnerability on Iron Fish, a privacy-focused blockchain, that let the same funds be spent over and over. They moved all the coins created out of thin air through a cross-chain bridge to Base. On the other side, the bridge minted about 2.98 billion wIRON across 14 transactions in a single day. There are only about 76.9 million IRON in total, so this was equivalent to printing 38.7 times the supply.
Then they dumped it all. Two new wallets poured the tokens into pools on Base and sold them all over the next 14-plus hours, taking away about $197,400. Some of the proceeds went to crypto exchanges, while the rest was swapped for about 0.865 bitcoin. wIRON was still selling for around 7 cents in the morning, but by evening it was practically worthless. Now there’s only about $300 in liquidity left in the pools.
The people who got stuck holding the bag afterward had it worst. 212 addresses picked up cheap wIRON and tried to use the cross-chain bridge to swap it back for real IRON, burning about 192 million tokens in total. There’s no way to tell from the blockchain whether they’ll actually get paid.
In the early hours of October 31, Beijing time, the team announced that it was ending all support for the entire network. After submitting the patch, they archived the code repository. The code that caused the problem had been reviewed by both internal and external auditors, and somehow nobody caught it.
I’m really going to have to take the words “audited” with a grain of salt from now on. Coins you’ve been accumulating for years could be ruined by a single line of code that nobody spotted.
Beginners should watch and learn more, and trade less. If you’re buying crypto, stick to $BTC
On October 27, someone found a vulnerability on Iron Fish, a privacy-focused blockchain, that let the same funds be spent over and over. They moved all the coins created out of thin air through a cross-chain bridge to Base. On the other side, the bridge minted about 2.98 billion wIRON across 14 transactions in a single day. There are only about 76.9 million IRON in total, so this was equivalent to printing 38.7 times the supply.
Then they dumped it all. Two new wallets poured the tokens into pools on Base and sold them all over the next 14-plus hours, taking away about $197,400. Some of the proceeds went to crypto exchanges, while the rest was swapped for about 0.865 bitcoin. wIRON was still selling for around 7 cents in the morning, but by evening it was practically worthless. Now there’s only about $300 in liquidity left in the pools.
The people who got stuck holding the bag afterward had it worst. 212 addresses picked up cheap wIRON and tried to use the cross-chain bridge to swap it back for real IRON, burning about 192 million tokens in total. There’s no way to tell from the blockchain whether they’ll actually get paid.
In the early hours of October 31, Beijing time, the team announced that it was ending all support for the entire network. After submitting the patch, they archived the code repository. The code that caused the problem had been reviewed by both internal and external auditors, and somehow nobody caught it.
I’m really going to have to take the words “audited” with a grain of salt from now on. Coins you’ve been accumulating for years could be ruined by a single line of code that nobody spotted.
Beginners should watch and learn more, and trade less. If you’re buying crypto, stick to $BTC
