Privacy-focused blockchain project Zano has confirmed that roughly 36.9 million tokens — ZANO and its Freedom Dollar stablecoin, fUSD — were minted without authorization through an exploit, and says it will roll back approximately one month of chain history to erase the illegitimate supply from circulation.

In a post-mortem report published Oct. 2 and covered by Cointelegraph, Zano said an attacker exploited a vulnerability in a gateway address to mint tokens in two separate incidents, each undetectable by ordinary validation because the fraudulent supply functioned identically to legitimate coins.

The attacker registered the gateway address on Aug. 28, paying the standard 100 ZANO registration fee. After running tests, the attacker executed the first exploit the following day, minting approximately 18.4 million ZANO in a single transaction on Aug. 29. The same method was reused on Sept. 25 to create another 18.4 million ZANO, along with unauthorized fUSD.

The first issuance went undetected for roughly a month. Zano said irregularities surfaced only during an internal investigation triggered after the second minting event.

Because the illicitly created tokens were indistinguishable from valid supply and could be spent in ordinary transactions, Zano concluded that a rollback — restoring the chain to a checkpoint before the Aug. 29 mint — was the only viable way to remove them. The project did not specify the exact block height or timestamp of the restoration point in the disclosed summary.

Zano also conceded that its pre-launch defenses failed. The vulnerability slipped through AI-based testing, internal audits and the project's bug bounty program, a admission that will intensify scrutiny of gateways and bridge-like infrastructure across smaller proof-of-work privacy chains.

The rollback carries significant operational consequences. Any legitimate transaction recorded on-chain after the restoration point will be canceled, including deposits and withdrawals processed at exchanges and payment services. Zano said it will run a separate recovery process for those counterparties, restoring legitimate transaction flows in stages. Funding will come from three sources: the project's developer fund, personal funds contributed by team members, and outside contributions.

The decision reopens one of crypto's oldest fault lines: transaction finality. Rollbacks — last employed at scale during the 2016 Ethereum DAO fork — effectively override settled history, and the operational burden of reconciling canceled exchange deposits, merchant payments and user transfers typically extends well beyond the technical rewinding of the chain. The longer that reconciliation takes, the longer exchanges are likely to keep ZANO deposit and withdrawal channels suspended, constraining liquidity and user access.

Zano has not yet published a full timeline for the rollback execution or the staged restoration of exchange services. Market participants will be watching the recovery process closely: the project must complete the chain restoration, make affected exchange and payment-service users whole, and patch the gateway vulnerability before confidence in the network's supply integrity — and its finality guarantees — can begin to recover.