Blockchain has become an integral part of various IoT applications, and it has been successful in boosting performance in various aspects. Applying blockchain as a trust solution for Internet-of-Things is a viable approach. The immutability of blockchain is essential to prevent anyone from manipulating registered IoT data transactions for illegitimate benefits. However, the increasing abuse of blockchain storage negatively impacts the development of IoT blockchain and potential stakeholders are discouraged from joining the IoT data sharing as the IoT data recorded on the blockchain contains private information. Hence, it is crucial to find ways to redact data stored on the IoT blockchain, which is also supported by relevant laws and regulations. Policy-based chameleon hash is useful primitive for blockchain rewriting, allowing the modifier to rewrite the transaction if they possess enough rewriting privileges that satisfy the access policy. However, this approach lacks traceability, which can be exploited by malicious modifiers to grant unauthorized user modification privileges for personal gain. To overcome this deficiency, we introduce a new design of policy-based chameleon hash with black-box traceability (PCHT), which enables the authority to identify the set of producers responsible for generating the pirate decoder. Specifically, PCHT is constructed by practical attribute-based encryption with black-box traceability (ABET) and collision-resistant chameleon hash with ephemeral trapdoor (CHET). After modeling PCHT, we present its concrete instantiation and rigorous security proofs. Finally, a PCHT-based redactable transaction scheme for IoT blockchain is given. Compared to the state-of-the-art mutable blockchain solutions, our scheme provides fine-grained blockchain rewriting and black-box traceability. The evaluation results demonstrate that our scheme is efficient and practical while still ensuring that no computational overhead is placed on IoT devices with limited computing resources.