Zano says exploiter minted 36.9 million unauthorized ZANO before one-month rollback
Zano said an attacker exploited a Gateway Address vulnerability over the past month to create 36.9 million unauthorized ZANO and Freedom Dollar (fUSD) tokens before the project chose to roll back its blockchain by about one month. In a post-mortem published Thursday, the team said the attacker first used the bug on Aug. 29 to mint roughly 18.4 million ZANO in a single transaction, then repeated the exploit on Sept. 25 to mint another 18.4 million ZANO and later create fUSD through the same method. According to Zano, some of the unauthorized assets entered the ecosystem. The team said the coins were indistinguishable from legitimate ZANO and could be spent normally, which is why it concluded that a rollback was necessary even though it would also affect legitimate transactions and damage trust. Zano added that the attacker paid a 100 ZANO registration fee, worth about $553 at publication, to set up the exploit after registering a Gateway Address on Aug. 28. The project also said AI-assisted testing, internal audits and bug bounty efforts did not catch the flaw. On Wednesday, Zano said it was working to restore affected balances using its developer fund, personal funds from team members and committed contributions, with exchanges and payment services expected to handle much of the recovery process.
