- Published on
Zano exploiter created 36.9M unauthorized ZANO before blockchain rollback
- Authors
- Name
- DeepHorus
Zano disclosed that an attacker exploited its Gateway Address flaw, minting 36.9 million unauthorized ZANO and about 1.8 quadrillion Freedom Dollar (fUSD). The team rolled back one month of blockchain history, removing the illicit supply but also legitimate transactions. Zano said the reversal was necessary because the fabricated coins were indistinguishable from authentic holdings and were spendable.
The attacker registered a Gateway Address on Aug. 28 and paid the 100-ZANO setup fee, worth about $553 at publication. After testing a fabricated asset, the attacker minted about 18.4 million ZANO in one transaction on Aug. 29. A second exploit on Sept. 25 minted another 18.4 million ZANO before internal teams flagged the activity nearly a month later.
The attacker also used the flaw to create roughly 1.8 quadrillion fUSD, producing ordinary-looking outputs. Limited exchange liquidity restricted how much unauthorized supply could reach the market. Quinten van Welzen, Zano’s head of marketing and growth, said only a small fraction was traded.
In its Thursday post-mortem, Zano acknowledged that reversing about a month of history would hurt trust. The project argued that removal was nevertheless necessary because invalid coins could not be separated from legitimate ones. The compromise therefore affected both supply integrity and user confidence.
Zano said AI-assisted testing, internal audits and bug bounties had failed to identify the bug. The first large mint escaped notice because its unauthorized outputs looked like standard transactions, and detection followed the second mint. The breach exposed failures across testing, auditing and monitoring.
Zano said Wednesday it is restoring balances with its developer fund, team members’ personal funds and committed contributions. Recovery will run through exchanges and payment services, replaying withdrawals reversed by the rollback and crediting affected deposits. The immediate priority is repairing user balances and restoring confidence after the Gateway Address exploit.
