Overview
- An attacker used a flaw in Zano’s Gateway Address feature to mint about 36.9 million ZANO and roughly 1.8 quadrillion fUSD, with the first mint on August 29 and further activity on September 25.
- Zano rebooted the mainnet and rolled the chain back roughly 30 days to a recovery block to eliminate the forged tokens and released an emergency client for miners and nodes to follow the recovered chain.
- The counterfeit tokens were protocol‑level identical to real ZANO and could be spent normally, so Zano said a rollback was the only practical way to remove them.
- Zano says reimbursements will come from its developer fund plus personal contributions from the team and that exchanges will need to replay any reversed withdrawals, but no formal claims process or schedule has been published.
- The incident exposed gaps in pre‑release testing, audits and bug bounties, cost the attacker only a small setup fee, and risks long‑term trust and operational strain as exchanges and users reconcile erased legitimate transactions.