‘Privacy working as intended’: Zano details 1-month rollback after $250M exploit
Investor confidence was not fully back despite the recovery progress.
The Zano exploit led to over $250 million in fake assets being minted by the attacker. According to a post-mortem report by the project team, the attacker minted 36.89 million ZANO tokens and $18.45 million fUSD, the Freedom Dollar stablecoin.
During late August and September, the period when the hack happened and the team noticed the exploit, ZANO’s price averaged between $6.50 and $7.50. Assuming an average price of $7.00, the 38.6 million ZANO tokens and $18.4 million fUSD translated to a total of about $250 million in fake assets.
Earlier in their preliminary investigation, the Freedom Dollar team said that the attacker exchanged “several million dollars” worth of assets for counterfeit fUSD. This has now been verified, as $18.4 million was swapped for fake minted fUSD.
Before the hack, fUSD, an algorithmic stablecoin on the privacy-focused Zano network, had a market supply of $12 million, or 12 million fUSD tokens. With the hacker minting 18.45 million fUSD, the supply increased by 153%, or 2.5x higher than the base circulation.
Similarly, about 15.44 million ZANO were in circulation before the breach. After the 36.89 million fake ZANO tokens were minted, the supply was inflated by 240%.
To address the inflation issue, the team opted to roll back the network by a month.
Zano hack: The mishap, exploit, and recovery
First, the Zano network is privacy-focused, similar to Zcash.
To scale adoption and plug in more exchanges and platforms, it had to allow external venues to track the amounts being transferred and spent. That’s what the Gateway Address feature in Hard Fork 6 was supposed to solve. The upgrade went live in late August.
But there was a code error that led to missing verification for Zano transactions. This allowed the attacker to “hide” extra tokens and mix them with the rest of the legit supply.
The private nature of the transfers made it challenging to trace these fake asset transfers, making the rollback a logical solution, according to the team. While a drawback, the team hailed it as a plus.
The major limitation was the traceability of the exploited ZANO and fUSD coins. Once created, they were indistinguishable from any other private ZANO output. That is privacy working as intended. No one, including the Zano team, can accurately determine which outputs are affected.
The rollback has erased the $250 million exploit, with the team assuring the network recovery is stable and ongoing. They plan to explore the Gateway Address again later to facilitate broader integration with exchanges.
But the ZANO token price was still trading close to $5, a key H2 support level, underscoring that investors were still uncertain about the token after the incident.
Final Summary
- Zano team confirmed that nearly $250 million worth of fake ZANO and fUSD was minted by the hacker,
- The network recovery is stable and ongoing, but investor confidence was still low, per the muted ZANO price,
