Zano rolls back a month of blockchain history after Gateway Address exploit

Key points

• Zano restarted the blockchain at block 3,833,000, just before Hard Fork 6 introduced Gateway Addresses.
• The team says a Gateway Address vulnerability allowed unauthorised ZANO and Freedom Dollar (fUSD) into circulation.
• Nodes, miners, stakers, exchanges and other services must adopt the update for the recovery to work.
• A month of legitimate transactions is invalidated and may need reconciling; payments settled on other chains cannot be reversed.
• Zano says it will publish a reimbursement and claims process, and no post-mortem had been released at publication.

Zano has rolled its blockchain back by roughly a month after a vulnerability tied to Gateway Addresses let unauthorised ZANO and Freedom Dollar enter circulation, according to the project's core team. The chain was restarted at block 3,833,000, the height immediately before Hard Fork 6, which introduced the affected feature. The team said on Sunday that the recovery depends on participating nodes, miners, stakers, exchanges and other services adopting the update.

The rollback removes the unauthorised tokens, but it also invalidates a month of legitimate transactions. Transactions made during that period will no longer appear on the recovered chain and may need to be reconciled by users and services. The team also noted that the rollback cannot reverse payments already settled on other blockchains, and said it is working to account for any losses and will publish a reimbursement and claims process.

Zano has not released a post-mortem at the time of publication, but confirmed the problem came from Gateway Addresses. That feature was developed to make it easier for bridges, exchanges and payment services to integrate with Zano by letting them manage funds through a single account-style balance, similar to other blockchains. Before it, ordinary Zano wallets tracked funds as separate transaction outputs, or UTXOs, rather than one account balance.

Chain restarted before fork

That earlier design meant exchanges and other services had to scan the blockchain to identify incoming payments, track those outputs and choose which ones to spend when processing withdrawals. Gateway Addresses were intended to simplify that work. Zano launched in May 2019 as a layer-1 blockchain focused on private payments, with standard private transactions that conceal senders, receivers, transferred amounts and asset types. It has a native token, ZANO, and also lets users deploy and mint custom digital assets.

Freedom Dollar, or fUSD, is one such token that operates on the Zano blockchain. Quinten van Welzen, Zano's head of marketing and growth, said doing nothing would have meant unauthorised ZANO and fUSD in circulation without limit, diluting every holder and breaking what he described as a currency's most basic promise of a fixed supply. He added that inaction would also signal to future attackers that exploited coins keep their value.

Van Welzen acknowledged the cost of the decision, saying restarting the chain from before Hard Fork 6 costs a month of history and costs trust that the project will have to earn back. He said it restores the supply everyone signed up for and leaves a path to rebuild, which he argued is better than letting seven years of work die. He added that the team knows the move hurts, but that not doing it would have hurt more.

Gateway Address flaw

The episode highlights a difficult trade-off for smaller layer-1 networks: undoing an exploit can protect supply and holders, but it also rewrites recent history and depends on third parties such as exchanges to follow the new chain. Zano's next steps will centre on the claims and reimbursement process, and on whether the services that support the network adopt the restarted chain.

Read the full story on Cointelegraph →