Zano was forced to roll back its blockchain history by one month after an attacker minted 36.9 million fake ZANO coins. A post-mortem report from the developers revealed that the perpetrator exploited a vulnerability in the Gateway Address feature to mint the unauthorized coins. The attacker paid just 100 ZANO, worth approximately $553, to register a gateway address and trigger the exploit.
The counterfeit coins functioned identically to genuine ZANO and could be spent normally, as the system was entirely unable to distinguish the illicit tokens from legitimate assets. This critical flaw compelled the Zano team to take emergency measures by rolling back the entire blockchain roughly one month.
Evaded Audits and AI Testing
The exploit occurred in two separate stages without immediate detection by the developers. The first attack took place on August 29, 2026, when the hacker minted 18.4 million ZANO in a single transaction. This initial incident went completely undetected for nearly four weeks.
The team only flagged suspicious activity after the attacker launched a second attack on September 25, 2026. During this subsequent phase, the hacker minted an additional 18.4 million ZANO coins along with a quantity of Freedom Dollar (fUSD) tokens. The Gateway Address vulnerability managed to slip past every layer of the project’s defenses, as AI-assisted code testing, the team’s internal audits, and bug bounty programs all failed to detect the flaw prior to the exploit.
Team Pools Funds to Restore Balances
The decision to roll back the blockchain automatically invalidated extensive transaction history that occurred during the exploit period. Zano is now working to restore the balances of affected users. Compensation funds are being pooled from multiple sources, including the project’s developer treasury, personal funds from team members, and pledged contributions from ecosystem supporters.
Asset recovery will be executed primarily through crypto exchanges and payment service providers. Exchanges are tasked with replaying customer withdrawals that were nullified by the blockchain rollback. This process is intended to ensure all legitimate entities receive their funds without having to start over. Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
