Zano exploiter minted 36.9M unauthorized ZANO before month-long chain rollback
In brief
- Zano's post-mortem says an attacker created 36.9 million unauthorized ZANO plus fUSD tokens.
- First mint of 18.4 million ZANO, on Aug. 29, went unnoticed for nearly a month.
- Zano rolled back about a month of chain history, including legitimate transactions.
- Zano plans to restore balances mostly through exchanges and payment services.
Two mints, nearly a month apart
Zano's post-mortem, published Thursday, says the attacker registered a Gateway Address on Aug. 28 and paid the registration fee. It then tested a fabricated asset. The first unauthorized mint came the next day: about 18.4 million ZANO in a single transaction. Setting it up cost 100 ZANO, according to the post-mortem (Cointelegraph put that at roughly $553 at the time of publication).
That first mint went unnoticed for nearly a month.
On Sept. 25 the attacker ran the exploit again, minted another 18.4 million ZANO and then used the same method to create fUSD. The team said the unauthorized coins looked like ordinary outputs, and its internal teams flagged the activity only after the second mint. Zano said neither AI-assisted testing nor internal audits picked up the bug; bug bounties didn't catch it either.
Why Zano rolled back the chain
Part of the unauthorized supply made its way into the Zano ecosystem, the team said. That's where the real problem started, because the minted coins weren't marked in any way that set them apart.
"These coins functioned as authentic ZANO and could be spent normally," the team wrote in its post-mortem.
Since those coins couldn't be told apart from legitimate ZANO, the team called for a rollback of about a month of blockchain history (legitimate transactions included). It acknowledged the move would hurt trust. It also argued it was necessary to remove the unauthorized supply.
Recovery plan
Zano said Wednesday it's working to restore affected balances using its developer fund and team members' personal funds, along with committed contributions. Recovery is set to run mainly through exchanges and payment services. Exchanges are supposed to replay the withdrawals that the rollback reversed. Zano described the effort as underway, not finished.
Cointelegraph reached out to Zano for comment.
Frequently asked questions
How much unauthorized ZANO did the attacker create?
According to Zano's post-mortem, the attacker created 36.9 million ZANO across two mints of about 18.4 million each, on Aug. 29 and Sept. 25. The attacker also used the same method to create Freedom Dollar (fUSD) tokens.
Why did Zano roll back its blockchain?
The team said the unauthorized coins worked like authentic ZANO and couldn't be told apart from legitimate ones, and part of that supply had entered the Zano ecosystem. It called for a rollback of about a month of history, including legitimate transactions, and admitted the move would hurt trust.
How does Zano plan to restore affected balances?
Zano said it's working to restore affected balances with its developer fund, team members' personal funds and committed contributions. Recovery is set to run mainly through exchanges and payment services, with exchanges replaying withdrawals the rollback reversed.
