Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingZano disclosed that attackers used Gateway address vulnerability to mince nearly 37 million tokens.
The Zano team recently disclosed that in the past month, an attacker used its "Gateway Address" vulnerability to illegally minted approximately 36.9 million ZANO tokens and a large number of Freedom Dollar (fUSD) tokens. Subsequently, the team decided to roll back the blockchain for a month to eliminate these illegal assets.
In an incident review report released on Thursday, Zano pointed out that attackers first exploited the vulnerability on August 29 and forged approximately 18.4 million ZANOs in a single transaction. On September 25, the attacker again used the same method to mince another 18.4 million ZANOs and continued to use this method to create fUSD tokens. The report stated that some illegal tokens have entered the Zano ecosystem.
"These tokens appear as legal ZANOs in the system and can be circulated and spent normally." The team wrote in the review.
Why did you choose to roll back the entire blockchain history?
The above data reveals why the Zano team called for a roll back of blockchain history for about a month, even including some legal transaction records. The team acknowledged that the move could undermine user trust, but believed it was necessary because illegally minted tokens could not be distinguished from legal tokens and would pose an ongoing threat to network security if not completely eliminated.
The attack cost was only 100 ZANO, and the vulnerability was not found in the testing process.
Zano's accident review showed that the attacker paid 100 ZANO to set up the exploit program, which was worth approximately US$553 at the time.
According to reports, the attackers registered a Gateway address on August 28, paid a registration fee, and tested it with counterfeit assets before the first illegal minting the next day. The 18.4 million ZANOs cast for the first time have not been discovered in nearly a month. The team stated that the appearance of these illegal tokens was no different from ordinary exports, and the internal team did not flag the abnormal activity until after the second minting occurred.
Zano admitted that the Bug was not found in previous AI-assisted testing, internal audits and vulnerability bounty plans.
Recovery measures: Use funds and personal funds to compensate affected users
At the same time, the Zano team announced on Wednesday that it is working to restore the balance of affected users through developer funds, team members 'personal funds and committed contributions. Recovery will be done mainly through exchanges and payment services: the exchange will replay withdrawals revoked by the rollback operation, and the team will make credit compensation for the affected deposit accounts.
