Incident case file

Zano — Gateway Address flaw mints unauthorized ZANO/fUSD, chain rolled back

Incident date Aug 28, 2026Last updated Oct 8, 2026

0 views

RecoveringZano L1Protocol bug (unauthorized issuance via Gateway Address)Cluster: ZANO-GATEWAY-2026-09

Estimated loss

Affected users

Group joining is coming soon.

Investigation

75%

Facts and investigation

Ledger

Attacker

MISSING — no address or transaction hash was published, not even in the Oct 1, 2026 post-mortem. Manual recovery: ask the Zano team (official Discord/Telegram) for the mint transaction identifiers; note that the rollback to block 3,833,000 removed the exploit transactions from the new chain, so the public explorer will not show them.

Funds moved to

MISSING — not published. The unauthorized ZANO and fUSD were erased by the chain rollback; no confirmed USD loss. The 'over $200M' figures in some outlets value the fake issuance and are not a loss.

Linked

No wallets published. Mechanism per the Oct 1 post-mortem: a Gateway Address was registered on Aug 28, 2026 (100 ZANO, about $553) and tested with a constructed asset. First unauthorized mint on Aug 29: 2^64 base units (about 18.4M ZANO) in one transaction, unnoticed for nearly a month. Two 0.05 ZANO deposits on Sep 24. Second mint on Sep 25: another 18.4M ZANO plus about 1.8 quadrillion fUSD (36.9M ZANO in total). The internal audit, AI-assisted tests and the bug bounty missed it. Gateway Addresses were introduced in client 2.2.0.486; emergency release 2.2.3.600 disables them and restarts the chain at block 3,833,000 (timestamp 2026-08-26 15:50 UTC, the last block before Hard Fork 6). MEXC suspended ZANO/FUSD deposits and withdrawals.

Chronology

1 beat

Aug 28, 2026: an attacker registers a Zano Gateway Address (100 ZANO, about $553) and tests it with a constructed asset ID. Aug 29: the first unauthorized mint, about 18.4M ZANO in one transaction, passes unnoticed because outflows looked normal. Sep 24: two deposits of 0.05 ZANO. Sep 25: a second mint of about 18.4M ZANO and roughly 1.8 quadrillion fUSD. On Sep 27, 2026 the @zano_project account disclosed the vulnerability and the team rolled the chain back to block 3,833,000, erasing about a month of history; an emergency 'HF7' in client 2.2.3.600 disables Gateway Addresses. Exchanges including MEXC paused ZANO and FUSD deposits and withdrawals. On Oct 1 (Thursday) the team published a post-mortem describing the mechanism; it states that internal audit, AI-assisted testing and the bug bounty did not catch the flaw. No attacker address, transaction hash or confirmed USD loss has been published. Recovery is in progress; the rollback itself erased the unauthorized supply.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)