← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, September 28, 2026Published at 1:43 AM EDT · New York
Zano Rewinds Its Blockchain One Month After Gateway Flaw Minted Unauthorized Coins
The privacy network restarted at block 3,833,000, the last block before the August hard fork that activated the broken feature, and says it will compensate users from team and large-holder funds rather than new issuance.
Zano, a privacy-focused chain with its own stablecoin, restarted its blockchain at block 3,833,000 after a defect in its Gateway Address feature allowed an attacker to create ZANO and Freedom Dollar (fUSD) tokens that the protocol never authorized. The chosen block sits immediately before Hard Fork 6, the August upgrade that activated the feature, so the restart erases roughly one month of transaction history.
The root cause was not a stolen key. According to the project, wallet keys were never compromised, and the flaw sat in the supply-creation path opened by the new gateway logic, which is the most serious class of failure for any chain whose value depends on a verifiable cap. Zano has not published a figure for the unauthorized supply created.
The limits of the remedy matter as much as the remedy. A chain restart cannot claw back value that already left the network, so any proceeds converted into Tether (USDT), Dai (DAI) or other assets on other chains stay with whoever holds them. MEXC suspended ZANO and fUSD deposits and withdrawals while it migrates to the recovered chain. Zano says reimbursement will draw on developer, team and large-holder funds, with no additional ZANO issued.
The incident sits alongside the recurring unauthorized-mint failures tracked by Rekt News, where the loss comes from a privileged path working exactly as coded rather than from a reentrancy bug.
Veracity: Corroborated
79/100- If true, who benefits
Zano's team and large holders, who preserve the fixed-supply promise that gives ZANO and fUSD their value, and exchanges that avoid honoring balances created out of nothing, at the cost of users whose legitimate transactions inside the erased month disappeared.
- The nuance
The rollback, the block height and the compensation plan are , but the load-bearing detail is unpublished: no party has stated how much unauthorized ZANO and fUSD was actually created, and , so "attacker" is the project's characterization rather than a verified finding, and the MEXC suspension rests on the project's and the exchange's own notices.
Part of a tracked trend
Bridge and Mint Exploits Sustain Heavy DeFi Losses
Over 3-6 months, recurring bridge proof-validation and unauthorized-mint exploits keep monthly DeFi losses elevated, including drains of deprecated contracts.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Buterin Says Hegotá Will Be Ethereum's Last Familiar Fork Before a Cryptographic Rebuild
- Aztec Discloses a Critical Soundness Flaw in Its Alpha V5 Proving System
- US Prosecutors Seize $84.2 Million From a Tether Payment Conduit, and the Reserve Question Stays Open
- US Crypto Rulemaking Falls Back to States as the Clarity Act Collapses
- Bitcoin Trades Below $84,000 as Brent Passes $106 on the Hormuz Standoff
- Aave Lets Borrowers Post Coinbase Stock Tokens While Equity Markets Are Shut
- Three New Exploit Reproductions Land in the DeFiHackLabs Feed, All From Trusted Inputs
Comments
0No comments yet.