An attacker created 36.9 million unauthorized ZANO tokens using a Gateway Address vulnerability before the Zano team decided to roll back the blockchain by one month. According to Zano, the attack began on August 29, when approximately 18.4 million ZANO tokens were created in a single transaction. A second attack occurred on September 25, resulting in another 18.4 million ZANO being generated, as well as Freedom Dollar (fUSD) tokens, some of which entered the Zano ecosystem. "These tokens functioned as real ZANO and could be spent normally," the Zano team stated in their post-mortem.
The rollback was necessitated by the need to eliminate the unauthorized token supply, which could not be distinguished from legitimate ones. The team acknowledged that the rollback would undermine trust, but insisted it was necessary to resolve the issue. The attacker invested 100 ZANO to carry out the attack, which was worth about $553 at the time of publication. They registered the Gateway Address on August 28, paid the registration fee, and then tested the fake asset before the first unauthorized issuance the next day. The first issuance of 18.4 million ZANO went unnoticed for almost a month, and only after the second issuance did internal teams signal a problem.
The Zano team noted that testing with AI, internal audits, and bug bounty programs failed to identify the vulnerability. Zano is currently working on restoring affected balances using developer funds, personal funds from team members, and pre-contributed deposits. The restoration process will primarily occur through exchanges and payment services, where exchanges will replicate the canceled withdrawals, and the team will reimburse affected deposits.
Related articles
