Zano Rolls Back a Month After Gateway Address Exploit

Zano restarted its blockchain at block 3,833,000, erasing roughly one month of transactions after a vulnerability in Gateway Addresses allowed unauthorized ZANO and fUSD to enter circulation. The restart removes the bad activity, but it also cancels legitimate transactions and cannot recover assets already settled on other networks.

Gateway Addresses went live with Hard Fork 6 at block 3,833,000. Zano chose that same block for the recovery, placing the restarted chain immediately before the upgrade that introduced the affected feature.

What changes for you

Wallet spend keys were not compromised, according to Zano’s investigation. The reported failure was in asset issuance through Gateway Addresses, which could place native ZANO and fUSD into circulation without authority.

The rollback still has a direct cost. Transactions made during the erased month no longer appear on Zano’s recovered chain. A payment sent on another blockchain, including assets represented as USDT or DAI, cannot be reversed by Zano. Users were told to retain transaction IDs and trading records, then check earlier transfers before sending funds again.

MEXC temporarily suspended deposits and withdrawals for ZANO and fUSD at the project’s request. The exchange had not announced a restart time when that notice was published. Its current status is not established in the reporting reviewed for this article.

The new feature became the failure point

Gateway Addresses gave services an account-style balance to manage on-chain. Before the upgrade, exchanges and other service operators had to scan incoming outputs, track transactions and select which outputs were spent during withdrawals. The project said Gateway Addresses were intended to simplify that work while preserving Zano’s transaction privacy.

Registration required a one-time fee of 100 ZANO, which the protocol permanently burned. At least two Gateway Addresses were registered during the feature’s first week on the main network, according to records cited by Crypto.news.

The design change did not prevent the issuance flaw. Zano has not yet published a technical post-mortem explaining how the vulnerability produced unauthorized assets. The exact amount of ZANO and fUSD involved, and the value of funds taken, have not been disclosed in the pages reviewed.

That leaves the most important security question unanswered. The project says its underlying consensus was unaffected, but the rollback shows that participants had to accept a new chain history to remove activity created through the vulnerable upgrade.

The restart depends on network adoption

Zano cannot impose the restart by itself. Quinten van Welzen, the project’s head of marketing and growth, said developers can release software and ask operators to adopt it. Nodes, miners, stakers, pools, exchanges and other services must all move to the recovery version.

The emergency software is version 2.2.3.600. Project participants were urged to install it and verify its published checksums. Ordinary users can install the updated wallet without entering their seed phrases, while Zano said it was restoring its mobile wallet node and wrapping service separately.

This is the second attempt by the project to explain the recovery. Early messages referred to a 24-hour timeline and “no other choice,” but van Welzen acknowledged that the team had not yet understood the incident’s full scope when those statements were made.

He also conceded that a bug entered Hard Fork 6 and went unnoticed for weeks. Major mining pools carry substantial influence over which chain receives support, and van Welzen said Zano needs a larger base of independent operators.

Reimbursement depends on a future claims process

Zano says losses will be reimbursed from its development fund, team holdings and commitments from large holders. The plan does not involve creating additional ZANO, according to van Welzen.

The practical details remain unpublished. Zano is working with affected projects and counterparties to calculate losses, but it has not released a formal claims process. Until that process exists, affected users do not have a stated route for documenting claims or receiving reimbursement.

Zano also plans to publish the technical cause, a review of related Gateway Address code and the conditions for restoring the feature. No date has been announced for reactivating Gateway Addresses.

The rollback protects Zano’s fixed supply, but it does not repair the trust problem. A month of history has been erased, exchanges have paused support and the exploit’s technical details remain incomplete. The next test is whether the network can agree on the recovered chain, document the loss and publish enough evidence to show that the same issuance failure cannot pass unnoticed again.