Zano

<h2 id="header-0">Zano News</h2>
Zano's decision to roll its blockchain back by a month came down to a problem the team could not solve any other way: 36.9 million unauthorized<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/zano/"> Zano (ZANO)</a> coins had entered circulation and were functionally identical to real ones. A post-mortem<a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/zano_project/status/2105648653876474358?s=20"> published</a> Thursday lays out how that supply was created and why a narrower fix was never on the table.
<tweet-embed url="https://x.com/zano_project/status/2105648653876474358?s=20"></tweet-embed>
The root cause was a flaw in Zano's Gateway Address feature, introduced through a<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/hard-fork-blockchain"> hard fork</a> earlier this year. An attacker registered a Gateway Address on Aug. 28, paid a 100 ZANO setup fee worth roughly $553, and ran a test with a fabricated asset before exploiting the flaw for the first time the next day. That first attempt alone generated close to 18.4 million unauthorized ZANO in a single transaction.
<h2 id="header-1">Second Mint Exposed the First</h2>
Nothing about the initial mint looked unusual to the network. The coins behaved exactly like legitimate ZANO, and the team's post-mortem states plainly that they "functioned as authentic ZANO and could be spent normally." As a result, the first batch sat undetected for close to a month.
The attacker returned on Sept. 25 and repeated the exploit, minting a second batch of roughly 18.4 million ZANO before applying the same technique to create unauthorized Freedom Dollar (<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/currencies/freedom-dollar/">fUSD</a>) tokens. It was this second round that drew internal attention and led the team to flag the activity.
With both mints confirmed, Zano's engineers faced a supply they could not isolate from the legitimate ledger. Because the unauthorized coins carried no distinguishing marker, removing them selectively was not possible without rewriting the chain itself. The team opted to reset the<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/distributed-ledger"> distributed ledger</a> to the block height immediately preceding the hard fork that introduced Gateway Addresses, erasing roughly a month of activity, including transactions from users who had done nothing wrong.
Related Article: <a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/article/zano-restarts-blockchain-at-block-3833000-after-gateway-exploit">Zano Restarts Blockchain at Block 3,833,000 After Gateway Exploit</a>
Zano framed the rollback as the lesser of two damages. Leaving the unauthorized supply in place would have broken the project's fixed-supply guarantee indefinitely, since there was no way to tell real ZANO from minted ZANO once both were circulating. Unlike a conventional<a target="_blank" rel="noopener noreferrer nofollow" href="https://coinmarketcap.com/academy/glossary/double-spending"> double spending</a> attack, where a bad actor tries to spend one balance twice, the Gateway Address flaw let the attacker create spendable balance that never should have existed in the first place. The team acknowledged the reset would cost it community trust but argued that outcome was preferable to permanent, undetectable inflation of the coin's supply.
<h2 id="header-2">Audits and Bug Bounties Missed the Flaw</h2>
The post-mortem also addressed how the flaw slipped through Zano's existing safeguards. According to the team, the bug was not caught by internal audits, bug bounty submissions, or AI-assisted testing before it was exploited, raising questions about how thoroughly the Gateway Address feature had been reviewed before its hard-fork rollout.
Recovery efforts are running on a separate track from the rollback itself. In a<a target="_blank" rel="noopener noreferrer nofollow" href="https://x.com/zano_project/status/2105045132642791927?s=20"> post</a> shared the day before the post-mortem, Zano said it would draw on its developer fund, personal contributions from team members, and other committed funds to make affected users whole.&nbsp;
<tweet-embed url="https://x.com/zano_project/status/2105045132642791927?s=20"></tweet-embed>
Exchanges are expected to replay the withdrawals that the rollback invalidated and credit the corresponding deposits, rather than users having to resubmit claims individually.

Zano Rollback Followed 36.9M Unauthorized ZANO Mint

Table of Contents

Other articles published on Oct 2, 2026

Ethereum's zkAPI Brings Private AI Payments to Mainnet

South Korea Advances Plan To Tokenize Stocks and Bonds

Bill Gates Says AI Makes Nuclear Weapons 'Look Like Nothing'

Join our free newsletter for daily crypto updates!