Zano says attacker minted 36.9 million ZANO before rollback decision

Zano said an attacker exploited a Gateway Address vulnerability to create 36.9 million unauthorized ZANO and Freedom Dollar (fUSD) tokens. In a post-mortem published Thursday, Zano said the attacker registered a Gateway Address and paid a 100 ZANO fee on Aug. 28. The fee was worth about $553 at the time of publication. The attacker tested a fabricated asset before the first unauthorized mint, according to Zano. Zano said the attacker created approximately 18.4 million ZANO in a single transaction on Aug. 29. The attacker minted another 18.4 million ZANO on Sept. 25 before using the same method to create fUSD, Zano said. Zano said a portion of the unauthorized assets entered its ecosystem. The first mint went unnoticed for nearly a month because the unauthorized coins appeared to be ordinary outputs, according to Zano. Internal teams flagged the activity after the second mint, Zano said. Zano said its AI-assisted testing, internal audits and bug bounties failed to detect the bug. The unauthorized coins functioned as authentic ZANO and could be spent normally, the team said. The team decided to roll back about a month of blockchain history, including legitimate transactions, because it could not distinguish the unauthorized supply from legitimate coins. Zano acknowledged that the rollback would hurt trust but argued that it was necessary to remove the unauthorized supply. Zano said Wednesday that it is working to restore affected balances using its developer fund, team members' personal funds and committed contributions. Recovery will run primarily through exchanges and payment services, Zano said. Exchanges are to replay withdrawals reversed by the rollback, and Zano said its team credited affected deposits.