Zano restarts chain a month back to erase Gateway Address exploit
The Zano blockchain has been restarted from block height 3,833,000, immediately before Hard Fork 6, wiping roughly a month of chain history to remove unauthorized ZANO and Freedom Dollar (fUSD) minted through a Gateway Addresses vulnerability, the core team announced in a network update on September 27.
Gateway Addresses, the feature introduced in Hard Fork 6 to make integration easier for bridges, exchanges and payment services, let a bug go unnoticed for weeks while unauthorized coins entered circulation. Zano head of marketing and growth Quinten van Welzen said in a post on X that the total number of unauthorized assets was considerable, without giving a figure.
The team framed the choice starkly: doing nothing would have left unauthorized ZANO and fUSD circulating without limit, diluting every holder. “Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” van Welzen wrote. He stressed the team cannot roll the chain back itself. It published new source code, and nodes, miners, stakers, pools and services each decided whether to adopt it.
The rollback erases legitimate transactions along with the exploit. Payments already settled in USDT, DAI or other assets on separate networks cannot be recovered, since the restart only touches Zano’s own chain. The team said reimbursement will come from the dev fund, team funds and contributions from large holders, with no additional coins issued, and a claims process is still to be published.
The core team’s investigation found no compromise of wallet spend keys or ordinary transaction privacy, and says core consensus is unaffected. Gateway Addresses are inactive on the recovered chain and will return only after review, audit and testing. Users are told to update wallets only through zano.org/wallets or the official GitHub releases page with verified checksums, to keep transaction IDs and trade records, and not to resend a payment until its status is confirmed on the recovered chain.
