Zano's post-mortem shows a Gateway Address flaw let an attacker mint 36.9 million unauthorized ZANO, forcing the team into a full month-long chain rollback.
Zano News
Zano's decision to roll its blockchain back by a month came down to a problem the team could not solve any other way: 36.9 million unauthorized Zano (ZANO) coins had entered circulation and were functionally identical to real ones. A post-mortem published Thursday lays out how that supply was created and why a narrower fix was never on the table.
The root cause was a flaw in Zano's Gateway Address feature, introduced through a hard fork earlier this year. An attacker registered a Gateway Address on Aug. 28, paid a 100 ZANO setup fee worth roughly $553, and ran a test with a fabricated asset before exploiting the flaw for the first time the next day. That first attempt alone generated close to 18.4 million unauthorized ZANO in a single transaction.
Second Mint Exposed the First
Nothing about the initial mint looked unusual to the network. The coins behaved exactly like legitimate ZANO, and the team's post-mortem states plainly that they "functioned as authentic ZANO and could be spent normally." As a result, the first batch sat undetected for close to a month.
The attacker returned on Sept. 25 and repeated the exploit, minting a second batch of roughly 18.4 million ZANO before applying the same technique to create unauthorized Freedom Dollar (fUSD) tokens. It was this second round that drew internal attention and led the team to flag the activity.
With both mints confirmed, Zano's engineers faced a supply they could not isolate from the legitimate ledger. Because the unauthorized coins carried no distinguishing marker, removing them selectively was not possible without rewriting the chain itself. The team opted to reset the distributed ledger to the block height immediately preceding the hard fork that introduced Gateway Addresses, erasing roughly a month of activity, including transactions from users who had done nothing wrong.
Related Article: Zano Restarts Blockchain at Block 3,833,000 After Gateway Exploit
Zano framed the rollback as the lesser of two damages. Leaving the unauthorized supply in place would have broken the project's fixed-supply guarantee indefinitely, since there was no way to tell real ZANO from minted ZANO once both were circulating. Unlike a conventional double spending attack, where a bad actor tries to spend one balance twice, the Gateway Address flaw let the attacker create spendable balance that never should have existed in the first place. The team acknowledged the reset would cost it community trust but argued that outcome was preferable to permanent, undetectable inflation of the coin's supply.
Audits and Bug Bounties Missed the Flaw
The post-mortem also addressed how the flaw slipped through Zano's existing safeguards. According to the team, the bug was not caught by internal audits, bug bounty submissions, or AI-assisted testing before it was exploited, raising questions about how thoroughly the Gateway Address feature had been reviewed before its hard-fork rollout.
Recovery efforts are running on a separate track from the rollback itself. In a post shared the day before the post-mortem, Zano said it would draw on its developer fund, personal contributions from team members, and other committed funds to make affected users whole.
Exchanges are expected to replay the withdrawals that the rollback invalidated and credit the corresponding deposits, rather than users having to resubmit claims individually.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
