The team behind the Zano blockchain has revealed that an attacker utilized a Gateway Address vulnerability to create 36.9 million unauthorized ZANO tokens, alongside Freedom Dollar (fUSD) tokens, prior to a decision to roll the blockchain back by one month.
According to a post-mortem published on Thursday, the attacker first exploited the vulnerability on August 29 by minting approximately 18.4 million ZANO in a single transaction. The exploit was repeated on September 25, generating another 18.4 million ZANO before the same method was applied to create fUSD tokens. Zano noted that a portion of the unauthorized supply entered the ecosystem, functioning as authentic coins that could be spent normally.
The scale of the unauthorized minting explained the team's decision to roll back about a month of blockchain history, which included legitimate transactions. Although the team acknowledged that the rollback would harm user trust, they maintained it was necessary to remove the unauthorized supply because the illicit coins were indistinguishable from legitimate ones.
Exploit Setup and Detection
Zano's report stated that the attacker paid a 100 ZANO fee, valued at approximately $553 at the time of publication, to set up the exploit entry. The attacker registered a Gateway Address on August 28, paid the registration fee, and tested a fabricated asset prior to executing the first unauthorized mint the following day.
The initial mint of 18.4 million ZANO went unnoticed for nearly a month because the unauthorized coins appeared as ordinary outputs. Internal teams only flagged the activity following the second large mint. Zano added that previous AI-assisted testing, internal audits, and bug bounties had failed to detect the bug.
Recovery Efforts
Zano announced on Wednesday that it is working to restore affected balances using a combination of the developer fund, personal funds from team members, and committed contributions. Recovery operations will run primarily through exchanges and payment services. Exchanges will replay withdrawals that were reversed by the rollback, while the Zano team will credit the affected deposits.
