Zano Exploiter Minted 1.8 Quadrillion fUSD Before Blockchain Rollback

Zano has revealed that an attacker abusing a flaw in its Gateway Address feature created 36.9 million ZANO and about 1.8 quadrillion Freedom Dollar (fUSD) tokens before the team decided to roll the blockchain back by roughly a month. According to Thursday’s post-mortem, the first exploit came on Aug. 29 and produced about 18.4 million ZANO in a single transaction. The attacker repeated it on Sept. 25 for another 18.4 million ZANO, then used the same method to mint the fUSD. The team said these coins worked like genuine ZANO and could be spent normally.

Why Zano Rolled Back the Blockchain

The fake coins looked identical to legitimate ones, so the team saw no way to remove them without erasing about a month of history, including real transactions. Zano admitted this would hurt trust but argued it was necessary to wipe out the unauthorized supply.

How the Attacker Set Up the Exploit

The attacker paid a 100 ZANO fee, about $553, to register a Gateway Address on Aug. 28, then tested a fabricated asset before the first mint the next day. That mint went unnoticed for nearly a month because it resembled ordinary outputs, and internal teams only flagged it after the second one. AI-assisted testing, internal audits and bug bounties all missed the bug.

Zano Plans to Restore Affected Balances

Zano said on Wednesday that it is using its developer fund, team members’ personal money and committed contributions to restore balances. Recovery will mainly run through exchanges and payment services, which will replay withdrawals reversed by the rollback while the team credits affected deposits.