Zano said an attacker exploited a vulnerability in its Gateway Address feature to mint 36.9 million unauthorized ZANO tokens, prompting the project to roll back roughly one month of blockchain history. The incident also involved the unauthorized creation of Freedom Dollar (fUSD) tokens. Rollbacks of confirmed blockchain history are uncommon remedies, since these networks are normally designed so that settled blocks are treated as permanent records.

According to the disclosure, the attacker created roughly 18.4 million ZANO in a single transaction on Aug. 29. The attacker repeated the exploit on Sept. 25, minting another 18.4 million ZANO. Some of the unauthorized assets entered the wider Zano ecosystem.

The counterfeit coins posed a difficult problem because they behaved like legitimate ZANO, remaining freely transferable and spendable. That made it impossible for the team to identify and remove only the unauthorized portion of the supply. With no on-chain marker separating counterfeit from genuine coins, no targeted remedy short of a chain-level reversal was available.

How the Gateway Address exploit unfolded

The attacker registered a Gateway Address on Aug. 28, paying a 100 ZANO registration fee, and tested a fabricated asset before executing the first unauthorized mint. The initial creation of 18.4 million ZANO went undetected for almost a month. Only after the second mint did internal teams identify the activity and begin investigating the vulnerability. The detection gap meant the flaw remained exposed long enough for the same method to be used a second time.

Zano said the flaw had not been detected by earlier AI-assisted testing, internal audits, or bug bounty efforts. The team ultimately concluded that removing the unauthorized supply required a blockchain rollback.

Rollback erased legitimate transactions

Zano restarted the blockchain from block 3,833,000, immediately before Hard Fork 6 introduced Gateway Addresses. The rollback removed both the unauthorized assets and legitimate transactions recorded during the affected period. Choosing the block immediately before Hard Fork 6 means the restarted chain begins without Gateway Addresses, the feature at the center of the exploit.

The team acknowledged that reversing legitimate blockchain history would affect users and services, but said the unauthorized coins could not otherwise be distinguished from genuine ZANO.

Zano is now working to restore affected balances. The recovery effort will draw on the developer fund, contributions from team members, and committed outside support. Exchanges and payment services will play a central role in restoring legitimate deposits and withdrawals disrupted by the rollback. How quickly those services restore deposits and withdrawals, and how completely affected balances are rebuilt, are the immediate items to watch as Zano works back toward normal network operations.

The incident highlights the consequences of a supply vulnerability when unauthorized tokens retain the same spending properties as genuine assets. Zano has disabled the affected functionality as it works to restore normal network operations.

Primary source: Cointelegraph