A bridge printed 39 times all the IRON there is. Two wallets sold it for $197K and sent most of it to FixedFloat and Bitcoin
Iron Fish's coin on Base lost almost all of its value in one day. We followed every mint, swap and transfer to find out who printed it, who sold it and where the money went.
- 2.98B
- 14 of 14
- $197.4K
- 53.90 ETH
- 0.865 BTC
- 66 times
01 · What happenedWhat happened to wIRON
On Tuesday morning, one wIRON on Base sold for about 7 cents. By the evening it was worth almost nothing. Someone had printed billions of new ones and sold them.
wIRON is a copy of IRON, the coin of Iron Fish, a blockchain built for privacy where amounts and addresses stay hidden. Its copy lives on Base, the blockchain built by Coinbase, so that people can trade it in Base's markets. The project's developers joined Base last year, and in April the Iron Fish Foundation said it was moving to maintenance mode.
Bitquery traced the crash with its Base data. In a single day, the bridge that makes wIRON created, or minted, 2.98B of them, far more than all the IRON that exists. Every mint passed the bridge's own checks. Two new wallets sold the lot for $197.4K. One sent its share to FixedFloat, an instant exchange that swaps coins without an account. The other parked its share overnight in Aave, a lending app, and then swapped it for bitcoin through THORChain, a network that swaps coins across blockchains.
Then came a run on the bridge, as more than 200 wallets picked up the cheap wIRON and asked for real IRON in return. The public record does not show why the bridge signed those mints, or whether it has paid the claims.
02 · How wIRON is madeHow the ChainPort bridge makes wIRON
A bridge moves a coin from one blockchain to another. ChainPort runs the one between Iron Fish and Base, and it works in both directions.
Going in, you send IRON to ChainPort on Iron Fish. ChainPort's system then signs a message for Base. A program on Base, the bridge contract, checks that message. If the signature checks out, and the transaction comes from an account ChainPort has approved, it mints the same amount of wIRON for you, less a small fee.
Going out, you burn your wIRON, which destroys it, and give an Iron Fish address. ChainPort then sends you real IRON from what it holds there.
So each wIRON is a claim on one IRON that ChainPort holds. That only works if the bridge never mints more than it holds. Iron Fish hides amounts, so nobody outside can check what ChainPort holds there. The Base side is public, and that is where this story happened. We traced two other bridge failures this month, the WAX bridge hack and the Initia hack.
03 · 14 mints14 mints in 14 hours
The first bad mint came early on Tuesday, when a little under a million wIRON went to a fresh wallet. More followed all through the day, to two wallets that we call wallet A and wallet B. Wallet A got almost all the coins. Its last four mints, that evening, were the biggest by far.
Every mint took the normal path, even though the amounts were wildly out of line. The same ChainPort account that sends everyday mints sent all of them. Each one passed the bridge's signature check and its maintainer check, the same steps a normal mint took the week before. Each amount even had the usual fee taken off.
| Time (UTC), 27 Oct | Sent to | wIRON minted | Before the 0.3% fee |
|---|---|---|---|
| 04:33:03 | Wallet A | 997,000 | 1,000,000 |
| 07:03:57 | Wallet B | 99,700 | 100,000 |
| 07:11:03 | Wallet B | 894,309 | 897,000 |
| 07:37:39 | Wallet B | 994,009 | 997,000 |
| 08:07:57 | Wallet B | 994,009 | 997,000 |
| 09:00:59 | Wallet A | 4,985,000 | 5,000,000 |
| 09:14:05 | Wallet A | 4,985,000 | 5,000,000 |
| 10:07:57 | Wallet B | 994,009 | 997,000 |
| 14:40:57 | Wallet B | 994,009 | 997,000 |
| 17:26:07 | Wallet A | 9,970,000 | 10,000,000 |
| 17:28:03 | Wallet A | 79,760,000 | 80,000,000 |
| 17:59:01 | Wallet A | 299,100,000 | 300,000,000 |
| 18:14:57 | Wallet A | 189,430,000 | 190,000,000 |
| 18:26:13 | Wallet A | 2,382,830,000 | 2,390,000,000 |
| Total | 2,977,027,045 |
Nothing on Base shows why the checks passed. A stolen signing key would leave this record. So would a fake deposit on Iron Fish that ChainPort's system believed, or someone on the inside.
04 · How bigHow big 2.98B wIRON is
Iron Fish's own figures put all the IRON there is at 76.9M. In a single day the bridge minted 38.7 times that, and about a thousand times the wIRON that sat on Base before.
Wallet A's share alone could never have been backed. Wallet B's share could have been, on paper. It came to under 5M wIRON, far less than all the IRON there is, but still more than the whole supply on Base before Tuesday. Base data cannot show whether anyone locked IRON for wallet B's mints.
05 · The dumpSelling into thin pools
People trade wIRON in pools, where you swap one coin for another against a shared pile of both. Just before the first bad mint, the two main pools on Base held about $74K in USDC and ETH between them. One paired wIRON with USDC, a dollar stablecoin, on Aerodrome. The other paired it with ETH on Uniswap.
Wallet A started selling within four minutes of its first mint. About two thirds of its coins went straight into the Aerodrome pool, and most of the rest went through swap routers such as KyberSwap. Wallet B joined in less than three hours later. The prices here come from every trade in those pools, using Bitquery's own DEX trade data.
The price fell from about 7 cents to a fraction of a cent by midday. Buyers pushed it back up to around 7 cents within two hours of the first dump, and each new batch knocked it down again. The four big mints that evening finished it off. It has not recovered.
The two wallets got back $197.4K in all. Most of it came in the first few hours, while the pools still held money. Wallet A's last batch, the biggest of all, fetched just $6.6K.
06 · Where the money wentWhere the $197K went
Wallet A paid for its first gas, the small fee every transaction needs, with ETH from FixedFloat. That ETH arrived 53 minutes before the first bad mint.
The money went back to the same place. Wallet A swapped its USDC for ETH and sent most of it to 20 fresh addresses on Base. Each one passed the ETH on to FixedFloat's hot wallet, the wallet the exchange pays out of, within three minutes. That is how an exchange's one-time deposit addresses work, and Bitquery's address labels mark the receiving wallet as FixedFloat's.
A smaller part took a detour. Wallet A moved some ETH to Ethereum through Symbiosis, another bridge, and from there into two more FixedFloat deposit addresses. In all, 53.90 ETH reached FixedFloat, about $125K at the time.
Wallet B took a slower road. It started with gas from a middle wallet that Gate, a large exchange, had paid earlier that morning, and after selling it moved its money in stages over the next day. First it swapped nearly all its money to USDC, then parked the USDC in Aave in the afternoon. Then it waited.
Early on Wednesday, wallet B took the money out, swapped it back to ETH and crossed to Ethereum through Relay, a bridge that pays out in seconds. It sent 1.0 ETH to a HitBTC deposit address and put the rest, 29.89 ETH, into THORChain in exchange for bitcoin. Less than a minute later, the middle wallet sent a little ETH of its own into THORChain, naming the same Bitcoin address.
Scammers showed up too. Bots sent dust from look-alike addresses to both wallets and made fake "ETH" tokens appear to leave them, hoping to be copied by mistake later. That trick is address poisoning. We left those fake transfers out of every total.
07 · The bitcoinThe bitcoin moved again
THORChain paid 0.878 BTC to one Bitcoin address within about 20 minutes: 0.865 BTC for wallet B's ETH and the rest for the middle wallet's swap. Each payout met the minimum written into its swap order. A Binance hot wallet also sent that address a small payment, 14 minutes after wallet B's HitBTC deposit. It was worth about 1 ETH, the same as that deposit, but nothing on-chain links the two.
Then the address started to move. It ran a test first, sending a fifth of its bitcoin to an address that needs two keys to spend and getting it back about half an hour later. At 07:52 UTC on Wednesday it sent all 0.906 BTC, about $73K, to a new address of the same kind in one transaction.
The coins did not stay there long. The address still held them at 08:01 UTC, but by 08:41 all of them had moved again, in transactions not yet confirmed. They went to a fresh address and were split in two, 0.544 BTC and 0.363 BTC. The smaller part was then spent together with bitcoin from two other addresses, which usually means one wallet holds all three. Those other coins arrived on 27 October from sources we have not traced. The new addresses can be watched with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money goes next.
08 · The runThe run on the bridge
Burning wIRON is how you ask ChainPort for IRON. Before Tuesday that was rare, about one burn a day, most of them around 8,000 coins. That changed fast.
After the bad mints, wIRON cost almost nothing, yet each coin still claimed one IRON. So people bought the cheap coins and burned them. More than 200 senders burned 192.0M wIRON, 66 times the whole supply before the attack. Nearly all of it came from wallets that got their coins after the bad mints began, and one wallet alone burned 79.1M.
Every burn passed the same signature check as a mint. They kept passing after Iron Fish's warning early on Wednesday, and 10.0M more wIRON was burned before our data ends. Iron Fish hides amounts and addresses, so the public record cannot show whether ChainPort paid any of these claims. If it does, the IRON held for honest wIRON runs out long before the claims do.
09 · Who paysWho is left holding the loss
The money the two wallets took came from two places. About $73.6K left the two pools, money that liquidity providers had put in so that others could trade. The rest came from traders who bought wIRON during the dump.
People who held wIRON before the attack lost almost all of its value. Their coins were worth $217K at the old price and about $14 when our data ends. Whether they ever get IRON for them depends on what ChainPort does next.
10 · The first reportsChecking the first reports
Iron Fish posted on X early on Wednesday that it was looking into "abnormal wIRON issuance" and had asked ChainPort for an urgent review. The researcher depinwhale had posted a trace about three and a half hours earlier. Here is how both hold up.
| Source | Claim | Record | Verdict |
|---|---|---|---|
| Iron Fish | Abnormal wIRON issuance on Base | 14 mints, 2.98B coins, 38.7 times all IRON | Confirmed |
| Iron Fish | Full 1:1 backing cannot be assured | 2.79B on Base against 76.9M IRON in existence | Confirmed |
| depinwhale | About 2.98B wIRON minted in 14 hours | 2,977,027,045 in 13 hours 53 minutes | Matches |
| depinwhale | Every mint signed by the account ending 9d82 | All 14 mint transactions came from that ChainPort account, which also sends normal mints | Matches |
| depinwhale | Every batch sold within minutes into the two Base pools | Sold within minutes. 68% of wallet A's coins went straight into Aerodrome, the rest mostly through swap routers | Mostly |
| depinwhale | The sellers got roughly $200K | $197.4K | Matches |
| depinwhale | The second wallet parked $72.7K in Aave | 72,672 USDC went in; it came out at 03:10 UTC on 28 October | Matches, then moved |
| depinwhale | The first wallet sent its money to Ethereum, then into FixedFloat | 47.57 ETH went to FixedFloat straight from Base; 6.33 ETH went through Ethereum | Partly |
| depinwhale | Last clean block 53,143,118 | The first bad mint is in block 53,143,118; the last clean block is 53,143,117 | Off by one |
11 · What we cannot seeWhat the record cannot tell us
Four questions stay open. The first is why the bridge signed. Several causes fit the Base record, from a stolen key to a faked deposit on Iron Fish. The second is whether ChainPort paid out IRON for the burns.
The third is whether wallets A and B belong to the same people. They never sent each other anything, their gas came from two places, and each cashed out its own way. The fourth is whether wallet B's mints had real deposits behind them. Four of its mints were for 997,000 wIRON before the fee, exactly what wallet A received from its first mint.
12 · If you hold wIRONIf you hold wIRON
Iron Fish has asked people not to buy wIRON on Base or use the bridge until further notice. It says full backing "cannot be assured". The numbers on Base agree. Base now holds 2.79B wIRON, against 76.9M IRON in total.
A burn is a request that ChainPort has to fill from the IRON it holds. Nothing on Base shows whether it will.
13 · How we traced itHow we traced the Iron Fish bridge hack
We started from the mints of 27 October and followed every coin out of the two wallets. Mints, burns, swaps and transfers come from Bitquery's Base and Ethereum data. We read the wIRON supply and the pool balances straight from Base, and every price comes from Bitquery's own trade data. For Bitcoin we also used public block explorers, because the last payouts came after our Bitcoin data ended.
The full Base, Ethereum and Bitcoin histories are also sold as files. Bitquery does this kind of tracing for clients through its crypto investigation services.
Base and Ethereum data run to 07:00 UTC on 28 October. The Bitcoin addresses were last checked at 08:41 UTC. Anything later is not covered.
Dollar values use Bitquery's ETH price at the time of each sale and count USDC at $1. The bitcoin value uses Bitquery's price for cbBTC, a bitcoin token on Base.
The split of the $197.4K between pools and buyers is rough, because liquidity providers added and removed liquidity during the day.
Iron Fish hides amounts and addresses, so nothing here covers what happened on Iron Fish itself, including any IRON that ChainPort paid out.
Exchange and bridge names come from Bitquery's address labels and from how the addresses behave. The record shows where money went, not who controls a wallet.
Two burns came through relay contracts that send transactions for smart wallets, so the sender on record for those two is the relay.
14 · The addressesWhere to look
These are the main wallets and transactions in this story, with the full address under each. Each one links to the explorer.
Follow the wIRON money in plain English
Every transfer in this story comes from Bitquery's Base, Ethereum and Bitcoin data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Base dataset and the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any bridge, wallet, protocol, exchange or service.
The findings describe transactions and balances observed on Base, Ethereum and Bitcoin between 26 and 28 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Iron Fish, ChainPort, Coinbase, Base, FixedFloat, Gate, HitBTC, Binance, Aave, Relay, Symbiosis, THORChain, Aerodrome, Uniswap, KyberSwap, depinwhale or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that sold the minted wIRON are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Iron Fish hacked?
The ChainPort bridge that makes wIRON on Base minted 2.98B coins on 27 October, far more than all the IRON that exists. Every mint passed the bridge's own signature check. Neither ChainPort nor Iron Fish has said how that happened.
How much was taken in the Iron Fish bridge hack?
Two wallets sold the new coins for about $197.4K in USDC and ETH. People who held wIRON before the attack saw about $217K of value fall to almost nothing.
Where did the stolen money go?
Wallet A sent 53.90 ETH to FixedFloat. Wallet B sent a little to HitBTC and swapped most of the rest for bitcoin through THORChain. That bitcoin moved to a new address early on 28 October.
Is it safe to use the ChainPort bridge for IRON?
Iron Fish has asked people not to buy wIRON on Base or use the bridge until further notice. Base now holds far more wIRON than all the IRON there is.
What is wIRON?
wIRON is a copy of Iron Fish's IRON coin on Base, made by the ChainPort bridge. Each one is meant to be backed by one IRON held by ChainPort.