{"id":78921,"date":"2026-10-01T16:36:34","date_gmt":"2026-10-01T16:36:34","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/zano-says-over-200m-in-illicit-tokens-led-to-30-day-blockchain-rewind-bitcoin-news\/"},"modified":"2026-10-01T16:36:34","modified_gmt":"2026-10-01T16:36:34","slug":"zano-says-over-200m-in-illicit-tokens-led-to-30-day-blockchain-rewind-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/zano-says-over-200m-in-illicit-tokens-led-to-30-day-blockchain-rewind-bitcoin-news\/","title":{"rendered":"Zano Says Over $200M in Illicit Tokens Led to 30-Day Blockchain Rewind \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Zano disclosed that one exploit transaction created roughly 18.4 million ZANO, with further tokens created thereafter.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Zano traced possible tainted activity across 117,941 outputs and 65,301 transactions.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The Zano team explained that affected balances will be restored without changing ZANO supply.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>One Missing Check, 18.4 Million ZANO<\/h2>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/zano-wipes-1-month-of-history-to-fix-massive-crypto-inflation-bug\/\">Zano\u2019s 30-day blockchain rewind<\/a> already sounded drastic. Now the team has explained what was lurking underneath it, and the mechanics are arguably stranger. A flaw introduced with Hard Fork 6 allowed an attacker to create coins that the network accepted as genuine, beginning Aug. 29.<\/p>\n<p><a href=\"https:\/\/x.com\/zano_project\/status\/2105648653876474358?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">According to the dev team<\/a>, the first real exploit minted 2^64 base units, roughly 18.4 million ZANO, in a single transaction. Nobody caught it for nearly a month. By the time Zano\u2019s internal tools sounded the alarm on Sept. 25, the counterfeit supply had become tangled inside a privacy system deliberately built to make transactions difficult to trace.<\/p>\n<p>The trouble started with Gateway Addresses, a new address type introduced <a href=\"https:\/\/news.bitcoin.com\/press-releases\/zano-activates-hard-fork-6-opening-the-privacy-chain-to-exchanges-bridges-and-dexs\/\">in Hard Fork 6<\/a> to make Zano easier to integrate with centralized exchange (CEX) platforms, bridges, and other services. Gateway outputs expose an amount and asset ID, unlike Zano\u2019s standard confidential outputs, where both are hidden.<\/p>\n<p>The implementation, however, was missing a critical verification. Zano disclosed that an attacker could construct a specially calculated asset identifier that still satisfied the network\u2019s transaction proofs while slipping an arbitrary amount into a hidden output.<\/p>\n<p>\u201cIn short, every Zano transaction must prove that coins were created from consensus rules,\u201d the team explained. \u201cBecause of a missing verification, an attacker could satisfy this proof while \u2018hiding\u2019 extra coins within the transaction.\u201d<\/p>\n<p>Those coins weren\u2019t decorative accounting entries. The team said:<\/p>\n<blockquote>\n<p>\u201cThese coins functioned as authentic ZANO and could be spent normally.\u201d<\/p>\n<\/blockquote>\n<h2>The First Mint Sat Quietly for Nearly a Month<\/h2>\n<p>The attacker registered a Gateway Address on Aug. 28, paying the required 100 ZANO fee, and apparently tested whether Zano would accept a constructed nonexistent asset. The next day, the gloves came off.<\/p>\n<p>One transaction minted roughly 18.4 million ZANO, currently valued around $102 million worth. Nearly a month later, on Sept. 24, the attacker made two legitimate deposits of just 0.05 ZANO each, apparently testing the ordinary deposit route. On Sept. 25, another 18.4 million ZANO was created, followed by the same 2^64-base-unit maneuver using the fUSD stablecoin. All told, that\u2019s more than $200 million worth of illicit crypto tokens.<\/p>\n<p>Here\u2019s the kicker. Zano had conducted <a href=\"https:\/\/news.bitcoin.com\/featured\/ai-is-rereading-cryptos-old-code-and-finding-what-humans-missed\/\">artificial intelligence (AI)<\/a>-assisted testing, team audits, and bug bounty programs before Hard Fork 6. None caught it the vulnerability.<\/p>\n<p>\u201cThe initial exploit went undetected for nearly one month because the increased output appeared like any other private output,\u201d the team said.<\/p>\n<h2>Privacy Did Its Job, and That Became the Problem<\/h2>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/zano-inflation-bug-forces-blockchain-to-wipe-an-entire-day-of-history\/\">Once the phony coins<\/a> entered Zano\u2019s confidential transaction system, identifying exactly where they went became a different proposition. Ring signatures mix spends with other outputs, causing uncertainty to spread every time coins move.<\/p>\n<p>Zano scanned every output potentially connected to the three minting transactions. By block 3,878,388, the trail touched 117,941 outputs created through 65,301 transactions. Roughly 165,700 outputs had subsequently been created from the first mint, representing about 71% of network activity during the period.<\/p>\n<p>\u201cThat is privacy working as intended,\u201d Zano said. \u201cNo one, including the Zano team, can accurately determine which outputs are affected.\u201d<\/p>\n<p>That left the project in a jam. The very privacy properties users expected from Zano prevented developers from surgically separating legitimate coins from unauthorized ones. \u201cThe only way to verify supply integrity is to continue the chain from a point prior to the first exploit,\u201d the team detailed.<\/p>\n<h2>A Month Gets the Ax, and Recovery Begins<\/h2>\n<p>That point was block 3,833,000, before Hard Fork 6. Hard Fork 7 restarted the chain from there and disabled Gateway Addresses, meaning transactions, staking rewards, and mined blocks from the affected period no longer exist on the updated ledger.<\/p>\n<p>Zano further said <a href=\"https:\/\/x.com\/zano_project\/status\/2105045132642791927?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">affected balances will be recovered in full<\/a> without changing ZANO\u2019s supply or emission schedule. Funding will come from the development fund, team members\u2019 personal money, and outside contributors. Exchanges must now comb through a month of activity, transaction by transaction, before reopening access.<\/p>\n<p>\u201cNo action is needed right now,\u201d the team told users on its social media channels.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/zano-over-200m-illicit-tokens-30-day-blockchain-rewind\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Zano disclosed that one exploit transaction created roughly 18.4 million ZANO, with further tokens created thereafter. Zano traced possible tainted activity across 117,941 outputs and 65,301 transactions. The Zano team explained that affected balances will be restored without changing ZANO supply. One Missing Check, 18.4 Million [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78922,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78921"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78921"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78921\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78922"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}