Zano's $553 Entry Fee Bought 36.9M Unauthorized Coins and a Month-Long Regret 🪙

The attacker who exploited Zano's Gateway Address vulnerability used it to mint 36.9 million Zano (ZANO) along with Freedom Dollar (fUSD) tokens before the project rolled its blockchain back by roughly a month, according to a post-mortem published Thursday. The team said the exploit began on Aug. 29 with a single transaction that created approximately 18.4 million ZANO, followed by a second mint of 18.4 million ZANO on Sept. 25 using the same method, after which the attacker generated fUSD the same way. "These coins functioned as authentic ZANO and could be spent normally," Zano wrote in its post-mortem, noting that a portion of the unauthorized supply entered the Zano ecosystem.

The post-mortem provides the figures behind the team's decision to roll back about a month of blockchain history, a step the project acknowledged would damage trust but said was necessary because the unauthorized supply could not be reliably distinguished from legitimate ZANO. The attacker paid 100 ZANO to register a Gateway Address on Aug. 28, a fee worth about $553 at the time of publication, then tested a fabricated asset before executing the first unauthorized mint the following day. The initial 18.4 million ZANO went undetected for nearly a month, with the team stating the unauthorized outputs resembled ordinary transactions and were only flagged internally after the second mint.

Zano said AI-assisted testing, internal audits and its bug bounty program had failed to identify the vulnerability prior to the exploit. The project is now working to restore affected balances using its developer fund, contributions from team members' personal funds and committed contributions from partners, with recovery primarily routed through exchanges and payment services. Zano added that exchanges will replay withdrawals reversed by the rollback and that the team will credit affected deposits, though it did not provide a timeline for completing the restoration.