According to Zano’s post-mortem announcement, the attacker registered a Gateway Address on Aug. 28 and exploited the vulnerability the following day to generate roughly 18.4 million ZANO in a single transaction. The first unauthorized mint remained undetected for nearly a month.
The attacker returned on Sept. 25, creating another approximately 18.4 million ZANO before using the same underlying weakness to generate about 1.8 quadrillion fUSD. Zano said the unauthorized coins behaved as genuine ZANO once created and could be transferred and spent normally.
How Did the Gateway Address Bug Create Valid-Looking ZANO?
Gateway Addresses were introduced with Zano’s Hard Fork 6 in late August to simplify integrations with exchanges, bridges, payment gateways and other services. Unlike Zano’s conventional UTXO addresses, Gateway Addresses use an account-based structure intended to make balances easier for external systems to manage.
Zano’s technical documentation requires 100 ZANO to register a Gateway Address, with the fee permanently burned. The attacker paid that fee before testing a fabricated asset and executing the first unauthorized mint.
The post-mortem attributes the exploit to missing verification in the Gateway Address implementation. The flaw allowed a specially constructed asset identifier to satisfy transaction proofs while introducing additional coins into an output. Once created, the unauthorized ZANO carried no marker that allowed the network to reliably distinguish it from legitimate supply.
The incident also exposed a failure in pre-launch controls. Zano said internal audits, bug-bounty work and AI-assisted testing had not identified the vulnerability before deployment. The first 18.4 million-token creation also failed to trigger an immediate alert, with the suspicious activity detected only after the second round of unauthorized minting.
Investor Takeaway
The primary technical risk was not simply that new tokens could be created, but that the resulting ZANO was valid at the protocol level. Once unauthorized supply becomes indistinguishable from ordinary coins, targeted freezing or removal becomes substantially harder.
Why Did Zano Roll Back an Entire Month?
Zano responded by coordinating an upgrade that restarted the blockchain from block 3,833,000, immediately before the introduction of the vulnerable Gateway Address functionality. The move discarded approximately a month of blockchain history, including transactions unrelated to the exploit.
The network recovery update says the rollback removed the unauthorized activity from the restored chain while leaving ZANO’s normal supply and emission schedule unchanged. Zano also said ordinary wallet spend keys and transaction privacy were not compromised.
The decision puts Zano alongside other networks that have treated rollback risk as preferable to leaving unauthorized assets in circulation. FinanceFeeds recently reported how Cronos reversed nearly two hours of blockchain history following the Tectonic exploit, recovering most of the affected value but also reversing legitimate transactions.
Harmony faced a comparable supply-integrity problem after attackers forged more than 3 trillion ONE tokens. Its proposed blockchain rollback similarly reflected the difficulty of isolating fraudulent supply after it had already moved through exchanges, bridges and decentralized applications.
Investor Takeaway
The rollback removed the unauthorized supply from the recovered chain, but it transferred part of the operational cost to legitimate users, exchanges and services whose transactions disappeared with the discarded history. Recovery execution is therefore now as important as the technical patch.
How Will Zano Restore Transactions Reversed by the Rollback?
Zano says it intends to restore affected balances without altering the network’s normal issuance schedule. Funding is expected to come from the project’s developer fund, personal funds contributed by team members and additional committed contributions.
Most reconciliation is expected to run through exchanges and payment providers. Withdrawals completed during the discarded period can effectively return to an exchange’s wallet after the rollback, requiring the exchange to replay them on the recovered chain. Deposits create the opposite problem because users may already have received account credit for transactions that no longer exist on the restored ledger.
The mechanics resemble the broader post-exploit reconciliation problems examined in FinanceFeeds’ guide to cross-chain exploit recovery, where blockchain state and records held by exchanges, bridges and external networks can diverge after emergency intervention.
ZANO was trading around $5.64 on Oct. 2, with a market capitalization near $87 million. The token was down roughly 24% over seven days, while reported 24-hour volume was only around $22,000, pointing to relatively thin market liquidity compared with the theoretical value of the unauthorized issuance.
Investor Takeaway
The 36.9 million unauthorized ZANO should not be treated as an equivalent realized market loss: available liquidity was far smaller than the nominal value of the minted supply. The more useful recovery indicators are exchange withdrawals reopening, successful balance reconciliation and evidence that services have fully migrated to the repaired chain.