Zano exploiter minted 36.9M ZANO, 1.8 quadrillion fUSD before rollback

Zano has disclosed that an exploiter of its Gateway Address vulnerability minted 36.9 million ZANO and roughly 1.8 quadrillion Freedom Dollar (fUSD) tokens over about a month before the network rolled its blockchain back by a month, according to a Thursday post-mortem. The team said the rollback also affected legitimate transactions, but argued that removing unauthorized supply was necessary because those coins could not be separated from genuine ones. Zano acknowledged the decision could damage trust.

The first unauthorized mint occurred on Aug. 29, when the attacker created about 18.4 million ZANO in a single transaction, the post-mortem said. That mint went unnoticed for nearly a month because the unauthorized coins appeared like ordinary outputs. Internal teams flagged the activity only after a second mint on Sept. 25, when the attacker created another 18.4 million ZANO and then used the same method to produce approximately 1.8 quadrillion fUSD. Zano said the coins functioned as authentic ZANO and could be spent normally.

Quinten van Welzen, Zano's head of marketing and growth, told Cointelegraph that only a small fraction of the minted assets reached the market because exchange liquidity limited what could be sold. The attacker paid 100 ZANO to set up the exploit, worth about $553 at the time of publication, according to the post-mortem. Before the first mint, the attacker registered a Gateway Address on Aug. 28, paid the registration fee, and tested a fabricated asset.

Zano said AI-assisted testing, internal audits and bug bounties failed to catch the bug. The project is working to restore affected balances using its developer fund, team members' personal funds and committed contributions. Zano said Wednesday that recovery will primarily run through exchanges and payment services, with exchanges to replay withdrawals reversed by the rollback and the team crediting affected deposits.