Zano has restarted its blockchain from block 3,833,000, effectively removing about a month of transaction history after a vulnerability in its newly introduced Gateway Address system allowed unauthorized ZANO and Freedom Dollar (fUSD) tokens to enter circulation.
The rollback came after Zano determined that the unauthorized assets could not be reliably separated from legitimate coins once they had entered the network. The recovery therefore reverted the chain to the point immediately before Hard Fork 6, which activated Gateway Addresses on August 26. The decision also removed legitimate transactions recorded during the affected period.
Zano said the incident did not compromise wallet spend keys or ordinary transaction privacy. However, exchanges, miners, stakers, node operators and other services must migrate to the recovered chain for the restart to function across the network.
KEY TAKEAWAYS
- Zano restarted its blockchain from block 3,833,000 following a Gateway Address vulnerability.
- The exploit created 36.9 million unauthorized ZANO and approximately 1.8 quadrillion fUSD before the rollback.
- The attack did not compromise users’ wallet spend keys or ordinary transaction privacy, according to Zano.
- Legitimate transactions from the affected period were also removed from the recovered chain.
- Zano is working with exchanges and other service providers to restore affected balances.
- The project says reimbursement will be funded through its development fund, team contributions and other committed support rather than by creating additional ZANO.
GATEWAY ADDRESS VULNERABILITY TRIGGERS EMERGENCY ROLLBACK
Gateway Addresses were introduced through Hard Fork 6 to make it easier for exchanges, bridges and payment services to integrate with Zano. Unlike Zano’s traditional UTXO based addresses, Gateway Addresses use an account style balance that allows services to manage funds more similarly to account based blockchain systems. The feature became the entry point for the exploit shortly after the hard fork. According to Zano’s post mortem, an attacker registered a Gateway Address on August 28 after paying the required 100 ZANO registration fee. The following day, the attacker used the vulnerability to create approximately 18.4 million ZANO in a single transaction. Another exploit on September 25 produced a further 18.4 million ZANO, followed by the creation of approximately 1.8 quadrillion fUSD.
The unauthorized ZANO was particularly difficult to remove because it behaved like legitimate ZANO once created.
Zano explained:
“These coins functioned as authentic ZANO and could be spent normally.”
That left the project with limited options for restoring the intended supply without rewriting the affected portion of the ledger.
ROLLBACK REMOVES LEGITIMATE TRANSACTIONS TOO
Zano’s decision to return the chain to block 3,833,000 means transactions confirmed after that point are absent from the recovered blockchain. Users who made legitimate payments during the affected month may therefore see those transactions missing from their current chain history.
The rollback also has limits beyond Zano’s own network. Transactions involving assets that had already been settled on separate blockchains cannot be reversed by changing Zano’s history. The team has advised affected users to retain transaction IDs and trading records while the recovery process is finalized. Exchanges and other services must independently migrate to the recovered chain, meaning users are expected to wait for individual platforms to confirm that deposits and withdrawals have resumed before moving funds.
MEXC was among the exchanges that temporarily suspended ZANO and fUSD deposits and withdrawals while the recovery was implemented.
ZANO BEGINS RECOVERY AFTER NETWORK RESTART
The project says its priority is now restoring balances affected by the rollback and helping exchanges, wallets and payment providers return to normal operations. Zano has said recovery funding will come from its development fund, members of the team and contributors who have committed support. The project also said it does not intend to increase ZANO’s supply to finance the recovery.
The technical investigation has since produced a formal post mortem covering how the Gateway Address vulnerability was exploited and why it remained undetected. Zano has also said the affected Gateway Address functionality will remain subject to further review, auditing and testing before it is considered for restoration. The incident also exposed weaknesses in the testing process surrounding the new feature. According to Zano’s post mortem, internal audits, bug bounty efforts and AI assisted testing did not identify the vulnerability before it was exploited.
CONCLUSION
Zano’s month-long rollback demonstrates the difficult choices that can follow a protocol level vulnerability when unauthorized assets become indistinguishable from legitimate supply.
The restart removed the unauthorized ZANO and fUSD activity, but it also erased legitimate transactions and created additional work for exchanges, service providers and users. Zano now faces the task of restoring affected balances while demonstrating that the Gateway Address system and related code can operate safely.
The recovery process will ultimately depend not only on the updated software but also on coordinated adoption across the network. For Zano, restoring the intended token supply was only the first step. Rebuilding confidence in the network’s infrastructure and its ability to protect asset issuance will be the longer term challenge.
