Zano exploiter minted quadrillions of fUSD before blockchain rollback
-
Written by
Simonas Brazionis - Updated 2026-10-03 06:36:40
Zano has disclosed that an attacker exploited a Gateway Address vulnerability over the past month, and the Zano exploiter minted 36.9 million Zano (ZANO) and 1.8 quadrillion Freedom Dollar (fUSD) tokens. This unauthorized minting prompted the decision to roll back the blockchain by one month.
The attacker first leveraged the vulnerability on August 29, minting approximately 18.4 million ZANO. The exploit was repeated on September 25 for another 18.4 million ZANO, followed by the creation of about 1.8 quadrillion fUSD using the same method. These unauthorized coins functioned as authentic and were spendable.
Details of the Exploit and Rollback Justification
The Zano exploiter minted these tokens after paying 100 ZANO, valued at approximately $553, to set up the exploit. The attacker registered a Gateway Address on August 28, paid the required fee, and tested a fabricated asset before the initial unauthorized mint the following day. The first 18.4 million ZANO mint went undetected for nearly a month, as the unauthorized coins appeared as ordinary outputs.
The scale of the unauthorized minting clarified the Zano team's rationale for a blockchain rollback of approximately one month, which included legitimate transactions. The team acknowledged that this action would impact trust but asserted its necessity to remove the unauthorized supply, as it was indistinguishable from legitimate coins. Internal teams identified the activity only after the second mint.
Recovery Efforts and Unidentified Vulnerability
Zano announced on Wednesday its efforts to restore affected balances using its developer fund, personal funds from team members, and committed contributions. The recovery process will primarily involve exchanges and payment services, with exchanges replaying withdrawals that were reversed by the rollback and the team crediting affected deposits.
Despite AI-assisted testing, internal audits, and bug bounties, the vulnerability remained undetected. A Zano spokesperson indicated that only a small portion of these tokens reached the market due to limited exchange liquidity, which helped mitigate the immediate impact.
