Zano details 36.9 million unauthorized token minting behind blockchain rollback

Traders Union
All News
Crypto
Zano rollback after exploit

Highlights

An attacker exploited a Gateway Address flaw to mint 36.9 million unauthorized ZANO tokens on Aug. 29 and Sept. 25, injecting them into the ecosystem.
Zano rolled back its blockchain by about a month, sacrificing valid transactions due to inability to distinguish unauthorized tokens from legitimate supply.
Zano is restoring user balances with its developer fund, team contributions, and exchange coordination, emphasizing critical operational risk for crypto networks.

Exploit timeline and rollback rationale

As reported by Cointelegraph, citing Zano in a post-mortem published Thursday, the attacker first exploited the Gateway Address flaw on Aug. 29 and created about 18.4 million ZANO in a single transaction. The same method was used again on Sept. 25 to mint another 18.4 million ZANO, before the attacker also created fUSD tokens, with the team saying some of the unauthorized assets entered the ecosystem.

Zano said the coins functioned like authentic ZANO and could be spent normally, making them hard to distinguish from legitimate supply. The project said that risk drove its decision to roll back the blockchain by about a month, despite acknowledging the move would damage trust and remove valid transactions as well.

The attacker paid 100 ZANO to register the Gateway Address used in the exploit, an amount Zano said was worth about $553 at the time of publication. The team said the attacker registered the address on Aug. 28, tested a fabricated asset, and then carried out the first unauthorized mint the following day.

Zano added that the initial 18.4 million ZANO mint went unnoticed for nearly a month because the outputs appeared ordinary. Internal teams flagged the activity only after the second mint, while AI-assisted testing, internal audits and bug bounty efforts had failed to detect the bug earlier.

Recovery efforts and wider crypto impact

Zano said Wednesday it is working to restore affected balances using its developer fund, personal contributions from team members and other committed support. The recovery process is set to run mainly through exchanges and payment services, with exchanges replaying withdrawals reversed by the rollback and the team crediting affected deposits.

The episode underscores the operational risks facing crypto networks when unauthorized tokens cannot be separated from legitimate ones after entering circulation. For token projects and service providers, the case highlights how a technical flaw can quickly become a market integrity problem, forcing trade-offs between preserving transaction history and protecting asset supply.

Our earlier report on Africa Bitcoin Corp covered a wave of leadership exits after South Africa’s Financial Sector Conduct Authority issued findings linked to alleged coordinated trading in the company’s former listed entity. It outlined the regulator’s debarments and fines against key individuals, and noted that appeals are continuing before the Financial Services Tribunal as the company reshapes its management.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.