Zano has rolled back roughly one month of blockchain history after an exploit of its Gateway Addresses feature allowed unauthorized $ZANO and Freedom Dollar (fUSD) to enter circulation, the project's core team confirmed Sunday.

The privacy-focused layer-1 blockchain restarted at block 3,833,000, the height immediately preceding Hard Fork 6 — the upgrade that introduced the affected feature. The recovery requires participating nodes, miners, stakers, exchanges and other service providers to adopt the updated software, the team said.

The rollback invalidates a month of legitimate transactions alongside the unauthorized tokens. Transactions confirmed during that window will no longer appear on the recovered chain, and the operation cannot reverse payments already settled on other blockchains. Zano said it is working to account for losses and will publish a reimbursement and claims process, though it has not released a technical post-mortem at the time of publication.

Why the exploit happened

The vulnerability traces back to Gateway Addresses, a feature Zano developed to make integration easier for bridges, exchanges and payment services by letting them manage funds through a single account-style balance, similar to account-based blockchains. Before the feature, Zano's default wallets tracked funds as separate transaction outputs (UTXOs). That model forced exchanges and other services to scan the chain for incoming payments, track individual outputs and select which ones to spend when processing withdrawals.

Zano launched in May 2019 as a layer-1 blockchain focused on private payments. Its standard private transactions conceal senders, receivers, transferred amounts and asset types. Beyond the native $ZANO token, the chain allows users to deploy and mint custom digital assets; Freedom Dollar is one such token operating on Zano.

The project's blockchain explorer confirms the rollback took place Sunday.

The supply-integrity argument

Zano framed the decision as a choice between two damaging outcomes: accept unbounded unauthorized minting or sacrifice a month of chain history.

"Doing nothing meant unauthorized $ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply," said Zano's head of marketing and growth, Quinten van Welzen. "It would also tell every future attacker that exploited coins get to keep their value. No project survives that."

Van Welzen acknowledged the operational and reputational cost of the restart. "Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we'll have to earn back," he said. "But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more."

Operational consequences

The recovery places significant coordination burdens on the ecosystem. Exchanges, bridges, custodians and staking infrastructure connected to Zano must adopt the updated client before normal service resumes, and any service that fails to resync from the restored height risks operating on a divergent chain. Businesses that processed Zano deposits or withdrawals during the invalidated month now face reconciliation work: settled withdrawals that left the chain cannot be clawed back on other networks, and deposits recorded on the discarded segment will need to be re-verified against the recovered chain.

For a chain whose private-by-default transactions obscure senders, receivers and amounts, verifying what was and was not legitimate during the affected period adds further complexity to the planned claims process. The team has not yet specified the size of the unauthorized issuance, the timeline for reimbursements or the mechanics of the claims procedure.

The incident also raises questions about the Hard Fork 6 audit trail — how a feature designed for institutional-grade integration tooling introduced an issuance vulnerability, and whether the re-introduced Gateway Address functionality will return in modified form. Those details will presumably appear in the post-mortem Zano has promised but not yet published.

The reimbursement and claims process, along with coordinated re-adoption of the update by exchanges and node operators, will determine how quickly the network returns to full operational status.