Zano Rolls Back Blockchain by a Month to Contain Gateway Exploit

Chain Restarted at Block 3,833,000

The Zano blockchain has been rolled back approximately one month to block 3,833,000 following a security exploit. The decision, announced by the Zano core team on Sunday, reverses all activity occurring after that block height. According to the team, the rollback was necessary to block unauthorized ZANO and Freedom Dollar (fUSD) tokens that entered circulation due to a vulnerability in the network’s Gateway Address feature.

Block 3,833,000 marks the point immediately before Hard Fork 6, the update that introduced Gateway Addresses. By reverting to this specific block, the network effectively removes the codebase change that facilitated the exploit. The team stated that the rollback invalidates both the unauthorized tokens and approximately one month of legitimate transactions that occurred during the affected period.

Gateway Address Vulnerability

Gateway Addresses were developed to assist bridges, exchanges, and payment services in integrating with Zano. The feature allows entities to manage funds through a single account-style balance, rather than the traditional method used by Zano wallets, which track funds as separate transaction outputs known as UTXOs.

Previously, exchanges were required to scan the entire blockchain to identify incoming payments and track specific outputs to select which ones to spend for withdrawals. The shift to Gateway Addresses was intended to streamline these operations. However, the implementation in Hard Fork 6 contained a flaw that allowed for the creation of unauthorized ZANO and fUSD.

Zano is a layer-1 blockchain that launched in May 2019, focusing on private payments. Its standard transactions conceal senders, receivers, amounts, and asset types. ZANO is the native token of the network, which also allows users to deploy and mint custom digital assets, including the Freedom Dollar (fUSD).

Team Rationale and Reimbursement Plans

Quinten van Welzen, head of marketing and growth for Zano, explained the logic behind the drastic measure. “Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” van Welzen said.

The team argued that allowing the exploit to stand would signal to future attackers that compromised coins retain their value. “It would also tell every future attacker that exploited coins get to keep their value. No project survives that,” van Welzen stated. He acknowledged the cost of the decision: “Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back.”

Van Welzen added that the move restores the intended supply and provides a path to rebuild. “Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”

The Zano team is currently working to account for the losses incurred by users during the rolled-back period. A reimbursement and claims process will be published in the coming days. It is important to note that the rollback cannot reverse payments that have already been settled on other blockchains.

Network Adoption Required

The recovery process requires participation from the broader ecosystem. Nodes, miners, stakers, exchanges, and other services must adopt the updated software to validate the new chain state. Zano has not yet released a full post-mortem regarding the technical specifics of the exploit or the timeline of the breach.