Zano rolls back blockchain after Gateway Address exploit

Zano restarted its blockchain at block 3,833,000, removing roughly a month of ledger history after a vulnerability tied to Gateway Addresses let unauthorized ZANO and Freedom Dollar (fUSD) tokens enter circulation.

The core team reverted the chain to a point immediately before Hard Fork 6, which introduced Gateway Addresses. The rollback removes the unauthorized tokens and also invalidates legitimate transactions recorded during the affected period. Network operators, including node operators, miners, stakers and exchanges, must upgrade and adopt the recovered chain for the restart to take effect across the network.

Gateway Addresses were created to let exchanges, bridges and payment services manage funds using a single account-style balance instead of Zano’s original model of separate unspent transaction outputs (UTXOs). Zano said the feature simplified integrations but opened a vulnerability that allowed attackers to mint tokens beyond the intended supply limits.

The restart does not affect payments that were settled on other blockchains or in off-chain systems. Transfers or trades completed on external platforms, or on services that do not switch to the recovered ledger, will remain recorded on those separate ledgers. The team is reviewing losses and plans to publish a reimbursement and claims process for affected users and services.

Quinten van Welzen, head of marketing and growth, wrote that allowing the unauthorized tokens to remain would have broken the chain’s fixed-supply guarantee and diluted holders. He added that restarting the chain costs a month of history and will require the project to rebuild trust, but restores the supply parameters the community expects.

Zano has not released a full technical report on the vulnerability at the time of the restart announcement. The team indicated additional technical details will follow after an internal review. The restart was visible on the Zano blockchain explorer.

Launched in May 2019, Zano is a layer-1 blockchain focused on private payments. Its standard private transactions conceal sender, receiver, amount and asset type, and the platform supports custom assets such as fUSD, the token involved in the breach.