Audit log

Every state-changing event for Zano (ZANO): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-03 23:03:47Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 453,075,872

   sig

   pCg3h15dHvU7…oo72oSXzcopyexplorer ↗

   hash

   7tWA5xLLJf77…F77sPfLMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (19671 B) ▸

   {"actor":"system:backfill","investigation_id":"0e544160-e680-4c40-8e05-75c44969fd10","kind":"publish","page_slug":"zano-zano","published_at":"2026-10-03T23:03:47.151Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Zano (ZANO)","sections":[{"content":"Zano is an open-source Layer 1 blockchain designed for transactional privacy and programmability. The project traces its origins to 2014 via Boolberry, a privacy coin that transitioned to Zano in 2019. Co-founders include Andrey Sabelnikov, who was a lead developer of the CryptoNote protocol — the foundational technology underlying Monero and other privacy cryptocurrencies — and Pavel Nikienkov. The protocol employs d/v-CLSAG Ring Signatures and Stealth Addresses to obfuscate senders and receivers, and uses a hybrid Proof-of-Work/Proof-of-Stake consensus mechanism. In March 2024, Zano implemented the Zarcanum hard fork at block height 2,555,000, introducing Confidential Assets that allow the creation of privacy-preserving tokens, stablecoins, NFTs, and decentralized applications on the network. As of October 2026, ZANO traded near $5.59 with a market capitalization of approximately $86 million.","heading":"Project Overview","severity":"low","sources":[{"credibility":2,"name":"CoinGecko: What Is Zano?","type":"research","url":"https://www.coingecko.com/learn/what-is-zano-privacy-blockchain-platform"},{"credibility":2,"name":"Wikipedia: Zano (blockchain platform)","type":"other","url":"https://en.wikipedia.org/wiki/Zano_(blockchain_platform)"}]},{"content":"In late August 2026, an attacker exploited a validation deficiency introduced in Hard Fork 6 (activated at block 3,833,000 on August 26, 2026) to mint large quantities of unauthorized ZANO tokens and Freedom Dollar (fUSD) stablecoins. The exploit was enabled by the new Gateway Address feature, which allows exchanges and payment services to interact with the Zano network. By paying 100 ZANO (approximately $553 at the time) on August 28 to register a Gateway Address, the attacker gained the ability to construct specially calculated asset identifiers that concealed arbitrary token quantities in confidential outputs while passing consensus validation rules.\n\nAccording to reporting by CoinTelegraph and CoinCodex, the attacker executed two minting events: approximately 18.4 million ZANO on August 29, and an additional 18.4 million ZANO plus approximately 1.8 quadrillion fUSD base units on September 25. The total unauthorized ZANO supply created was approximately 36.9 million tokens. The Zano team confirmed the minted tokens 'functioned as authentic ZANO and could be spent normally,' and were cryptographically indistinguishable from legitimate supply — a direct consequence of the protocol's privacy design. The team stated: 'The major limitation was the traceability of the exploited ZANO and fUSD coins. Once created, they were indistinguishable from any other private ZANO output. That is privacy working as intended.'\n\nThe initial August 29 minting went undetected for nearly one month. Internal monitoring systems flagged the suspicious on-chain activity only after the second minting event on September 25. The team acknowledged that AI-assisted testing, internal audits, and its bug bounty program all failed to identify the vulnerability before exploitation occurred. CoinCodex reported the exploit affected approximately 65,301 transactions containing roughly 117,941 outputs, representing approximately 71% of network activity during the affected period.","heading":"August–September 2026 Gateway Address Exploit","severity":"critical","sources":[{"credibility":1,"name":"CoinTelegraph: Zano Exploiter Created 36.9M Unauthorized ZANO Before Blockchain Rollback","type":"news_article","url":"https://cointelegraph.com/news/zano-exploiter-created-369m-unauthorized-zano-before-blockchain-rollback"},{"credibility":2,"name":"CoinCodex: Zano Exploiter Minted 1.8 Quadrillion fUSD Before Blockchain Rollback","type":"news_article","url":"https://coincodex.com/article/93027/zano-exploiter-minted-18-quadrillion-fusd-before-blockchain-rollback"},{"credibility":2,"name":"AMBCrypto: Zano Details 1-Month Rollback After $250M Exploit","type":"news_article","url":"https://ambcrypto.com/privacy-working-as-intended-zano-details-1-month-rollback-after-250m-exploit/"},{"credibility":2,"name":"Blockonomi: Zano Executes Blockchain Rollback Following Massive Token Minting Exploit","type":"news_article","url":"https://blockonomi.com/zano-executes-blockchain-rollback-following-massive-token-minting-exploit"},{"credibility":2,"name":"SpendNode: Zano Exploit — 36.9M Unauthorized Tokens, Blockchain Rollback","type":"news_article","url":"https://www.spendnode.io/blog/zano-exploit-36-9m-unauthorized-tokens-blockchain-rollback-october-2026/"}]},{"content":"On approximately September 27–28, 2026, the Zano development team released emergency software version 2.2.3.600 and requested that all network participants — miners, exchanges, node operators, and wallet providers — voluntarily adopt it. The update restarted the canonical chain from block 3,833,000, the last block before Hard Fork 6 activation, effectively erasing approximately one month of network history. This rollback eliminated the fraudulent supply but also invalidated all legitimate transactions, staking rewards, and mined blocks recorded during the affected window.\n\nThe resulting protocol change was designated Hard Fork 7. It disables Gateway Addresses pending a fresh security audit and code review. Quinten van Welzen, Zano's head of marketing and growth, noted that the development team cannot unilaterally roll back the chain and can only release software and request voluntary adoption from network participants.\n\nMEXC suspended ZANO and fUSD trading during the migration period. No new ZANO tokens would be issued for reimbursement purposes, preserving the network's existing supply and emission schedule.","heading":"Blockchain Rollback and Hard Fork 7","severity":"critical","sources":[{"credibility":2,"name":"Crypto.news: Zano Restarts Chain at Block 3,833,000 After Exploit","type":"news_article","url":"https://crypto.news/zano-restarts-chain-at-block-3833000-after-exploit/"},{"credibility":2,"name":"CryptoSlate: Zano Rollback Removes Month of Transactions, Personal Funds Recovery","type":"news_article","url":"https://cryptoslate.com/zano-rollback-removes-month-of-transactions-personal-funds-recovery/"},{"credibility":2,"name":"Crypto Economy: Zano Rolls Back One Month After Token Mint Exploit","type":"news_article","url":"https://crypto-economy.com/zano-rolls-back-one-month-after-exploit/"},{"credibility":2,"name":"Cryptonomist: Zano Blockchain Rollback Halts Unauthorized Token Minting","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/28/zano-blockchain-rollback/"}]},{"content":"The Zano team committed to restoring affected user balances in full without altering the network's supply or emission schedule. Recovery funding is drawn from three sources: the project's developer fund reserves, personal contributions from team members, and committed external contributions. No specific total funding amount was disclosed publicly as of early October 2026.\n\nRecovery is structured primarily through exchanges and payment services. Participating exchanges are replaying reversed withdrawal transactions and manually crediting affected deposit balances. Users who transacted exclusively through tracked exchange and payment venues are expected to be recoverable through this log-replay mechanism. However, users who transacted on-chain outside of tracked venues during the affected period face uncertain recoverability, as the rollback erased all Zano network transactions from the window and no on-chain record exists.\n\nAs of early October 2026, CryptoSlate reported that no formal claims process, eligibility criteria, payment amounts, or submission timeline had been published. The team advised affected users to preserve transaction IDs and exchange records but cautioned against preapproval attempts, noting that no claims process was live. Payments already settled in external assets such as USDT or DAI on separate blockchains were unaffected by the rollback.","heading":"Recovery Plan and User Impact","severity":"high","sources":[{"credibility":2,"name":"CryptoSlate: Zano Rollback Removes Month of Transactions, Personal Funds Recovery","type":"news_article","url":"https://cryptoslate.com/zano-rollback-removes-month-of-transactions-personal-funds-recovery/"},{"credibility":2,"name":"Bitcoin.com News: Zano Over $200M in Illicit Tokens, 30-Day Blockchain Rewind","type":"news_article","url":"https://news.bitcoin.com/crypto-news/zano-over-200m-illicit-tokens-30-day-blockchain-rewind"},{"credibility":2,"name":"Blockonomi: Zano Executes Blockchain Rollback Following Massive Token Minting Exploit","type":"news_article","url":"https://blockonomi.com/zano-executes-blockchain-rollback-following-massive-token-minting-exploit"}]},{"content":"The Zano team acknowledged publicly that multiple security measures failed to detect the Gateway Address vulnerability before it was exploited. AI-assisted testing, internal code audits, and the project's bug bounty program all passed without identifying the defect. The vulnerability existed in code introduced as part of Hard Fork 6, a significant protocol upgrade activating new functionality for exchange and payment-service integration.\n\nThe exploit exposes a structural tension in privacy coin design: the same cryptographic properties that prevent external parties from tracing transactions also prevented Zano's own developers and monitoring systems from detecting a supply inflation event for nearly four weeks. The team's statement that the fake tokens were indistinguishable because 'that is privacy working as intended' illustrates this tension explicitly.\n\nHard Fork 7 disables Gateway Addresses entirely pending fresh review and audit. The Currency Analytics reported the exploit's notional value exceeded $200 million based on the ZANO price at time of minting.","heading":"Security Audit Failures and Protocol Risk","severity":"high","sources":[{"credibility":2,"name":"The Currency Analytics: Zano's 30-Day Blockchain Rollback Erases $200 Million Exploit After Hard Fork 6 Bug","type":"news_article","url":"https://thecurrencyanalytics.com/altcoins/zanos-30-day-blockchain-rollback-erases-200-million-exploit-after-hard-fork-6-bug-299336"},{"credibility":2,"name":"CrowdFund Insider: Privacy-Focused L1 Network Zano Plans Chain Rollback After Gateway Address Inflation Bug","type":"news_article","url":"https://www.crowdfundinsider.com/2026/09/313189-privacy-focused-l1-network-zano-plans-24-hour-chain-rollback-after-gateway-address-inflation-bug/"},{"credibility":2,"name":"Cryptonomist: Zano Gateway Vulnerability Sparks Network Recovery Effort","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/29/zano-gateway-vulnerability/"},{"credibility":2,"name":"Cryptopolitan: Zano Faces 24-Hour Rollback After Asset Issuance Flaw","type":"news_article","url":"https://www.cryptopolitan.com/zano-faces-24-hour-rollback-issuance-flaw/"}]},{"content":"ZANO's price declined sharply following detection of the exploit. From a price of approximately $8.12 on September 21, 2026, it fell to approximately $6.26 on September 25 — the day the second minting was detected — and further to approximately $5.53–$5.59 by early October 2026, representing a decline of roughly 32% over the period. The circulating supply as of early October 2026 was reported at approximately 15.4 million ZANO with a market capitalization of approximately $86 million. For context, ZANO reached an all-time high of $17.93 in January 2025.","heading":"Market Impact","severity":"medium","sources":[{"credibility":2,"name":"CoinMarketCap: Zano Price","type":"other","url":"https://coinmarketcap.com/currencies/zano/"},{"credibility":2,"name":"Crypto.news: Zano Restarts Chain at Block 3,833,000 After Exploit","type":"news_article","url":"https://crypto.news/zano-restarts-chain-at-block-3833000-after-exploit/"}]}],"sources_used":[{"credibility":1,"name":"CoinTelegraph: Zano Exploiter Created 36.9M Unauthorized ZANO Before Blockchain Rollback","type":"news_article","url":"https://cointelegraph.com/news/zano-exploiter-created-369m-unauthorized-zano-before-blockchain-rollback"},{"credibility":2,"name":"CoinCodex: Zano Exploiter Minted 1.8 Quadrillion fUSD Before Blockchain Rollback","type":"news_article","url":"https://coincodex.com/article/93027/zano-exploiter-minted-18-quadrillion-fusd-before-blockchain-rollback"},{"credibility":2,"name":"CryptoSlate: Zano Rollback Removes Month of Transactions, Personal Funds Recovery","type":"news_article","url":"https://cryptoslate.com/zano-rollback-removes-month-of-transactions-personal-funds-recovery/"},{"credibility":2,"name":"AMBCrypto: Zano Details 1-Month Rollback After $250M Exploit","type":"news_article","url":"https://ambcrypto.com/privacy-working-as-intended-zano-details-1-month-rollback-after-250m-exploit/"},{"credibility":2,"name":"Crypto.news: Zano Restarts Chain at Block 3,833,000 After Exploit","type":"news_article","url":"https://crypto.news/zano-restarts-chain-at-block-3833000-after-exploit/"},{"credibility":2,"name":"Blockonomi: Zano Executes Blockchain Rollback Following Massive Token Minting Exploit","type":"news_article","url":"https://blockonomi.com/zano-executes-blockchain-rollback-following-massive-token-minting-exploit"},{"credibility":2,"name":"SpendNode: Zano Exploit — 36.9M Unauthorized Tokens, Blockchain Rollback October 2026","type":"news_article","url":"https://www.spendnode.io/blog/zano-exploit-36-9m-unauthorized-tokens-blockchain-rollback-october-2026/"},{"credibility":2,"name":"Cryptonomist: Zano Blockchain Rollback Halts Unauthorized Token Minting","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/28/zano-blockchain-rollback/"},{"credibility":2,"name":"Cryptonomist: Zano Gateway Vulnerability Sparks Network Recovery Effort","type":"news_article","url":"https://en.cryptonomist.ch/2026/09/29/zano-gateway-vulnerability/"},{"credibility":2,"name":"The Currency Analytics: Zano's 30-Day Blockchain Rollback Erases $200 Million Exploit After Hard Fork 6 Bug","type":"news_article","url":"https://thecurrencyanalytics.com/altcoins/zanos-30-day-blockchain-rollback-erases-200-million-exploit-after-hard-fork-6-bug-299336"},{"credibility":2,"name":"Bitcoin.com News: Zano Over $200M in Illicit Tokens, 30-Day Blockchain Rewind","type":"news_article","url":"https://news.bitcoin.com/crypto-news/zano-over-200m-illicit-tokens-30-day-blockchain-rewind"},{"credibility":2,"name":"CrowdFund Insider: Zano Plans Chain Rollback After Gateway Address Inflation Bug","type":"news_article","url":"https://www.crowdfundinsider.com/2026/09/313189-privacy-focused-l1-network-zano-plans-24-hour-chain-rollback-after-gateway-address-inflation-bug/"},{"credibility":2,"name":"Crypto Economy: Zano Rolls Back One Month After Token Mint Exploit","type":"news_article","url":"https://crypto-economy.com/zano-rolls-back-one-month-after-exploit/"},{"credibility":2,"name":"Cryptopolitan: Zano Faces 24-Hour Rollback After Asset Issuance Flaw","type":"news_article","url":"https://www.cryptopolitan.com/zano-faces-24-hour-rollback-issuance-flaw/"},{"credibility":2,"name":"CoinCentral: Zano Rolls Back Blockchain After Attacker Mints Quadrillions of Unauthorized Tokens","type":"news_article","url":"https://coincentral.com/zano-rolls-back-blockchain-after-attacker-mints-quadrillions-of-unauthorized-tokens"},{"credibility":2,"name":"CoinGecko: What Is Zano?","type":"research","url":"https://www.coingecko.com/learn/what-is-zano-privacy-blockchain-platform"},{"credibility":2,"name":"Wikipedia: Zano (blockchain platform)","type":"other","url":"https://en.wikipedia.org/wiki/Zano_(blockchain_platform)"},{"credibility":2,"name":"CoinMarketCap: Zano Price","type":"other","url":"https://coinmarketcap.com/currencies/zano/"}],"summary":"Zano (ZANO) is a privacy-focused Layer 1 blockchain platform launched in 2019, originating from the Boolberry project and co-founded by Andrey Sabelnikov, a lead developer of the CryptoNote protocol. In late August and September 2026, an attacker exploited a Gateway Address vulnerability introduced in Hard Fork 6 to mint 36.9 million unauthorized ZANO tokens and approximately 1.8 quadrillion fUSD base units, triggering an emergency one-month blockchain rollback that erased all network activity between August 26 and September 27, 2026. Recovery of affected user balances is ongoing, with the team drawing on developer funds and personal contributions, though no formal claims process or completion timeline had been established as of early October 2026.","timeline":[{"date":"2019-01-01","event":"Zano launched as successor to the Boolberry privacy coin project, co-founded by Andrey Sabelnikov and Pavel Nikienkov.","source":"CoinGecko","source_url":"https://www.coingecko.com/learn/what-is-zano-privacy-blockchain-platform"},{"date":"2024-03-01","event":"Zarcanum hard fork activated at block 2,555,000, introducing Confidential Assets and multi-asset capabilities to the network.","source":"CoinGecko","source_url":"https://www.coingecko.com/learn/what-is-zano-privacy-blockchain-platform"},{"date":"2026-08-26","event":"Hard Fork 6 activated at block 3,833,000, introducing Gateway Addresses for exchange and payment-service integration.","source":"Crypto.news","source_url":"https://crypto.news/zano-restarts-chain-at-block-3833000-after-exploit/"},{"date":"2026-08-28","event":"Attacker registered a Gateway Address by paying 100 ZANO (approximately $553), gaining the ability to exploit the minting vulnerability.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zano-exploiter-created-369m-unauthorized-zano-before-blockchain-rollback"},{"date":"2026-08-29","event":"First unauthorized minting event: approximately 18.4 million ZANO created in a single transaction. The minting went undetected.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zano-exploiter-created-369m-unauthorized-zano-before-blockchain-rollback"},{"date":"2026-09-25","event":"Second unauthorized minting event: approximately 18.4 million additional ZANO and approximately 1.8 quadrillion fUSD base units created. Zano's internal monitoring flags suspicious activity; exploit discovered.","source":"CoinCodex","source_url":"https://coincodex.com/article/93027/zano-exploiter-minted-18-quadrillion-fusd-before-blockchain-rollback"},{"date":"2026-09-27","event":"Zano development team releases emergency software version 2.2.3.600, executing Hard Fork 7 and restarting the canonical chain from block 3,833,000. Approximately one month of network history erased. MEXC suspends ZANO and fUSD trading.","source":"CryptoSlate","source_url":"https://cryptoslate.com/zano-rollback-removes-month-of-transactions-personal-funds-recovery/"},{"date":"2026-09-28","event":"Blockchain rollback confirmed complete. Gateway Addresses disabled pending fresh security audit. Team commits to full balance recovery using developer fund, personal funds, and external contributions.","source":"Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/09/28/zano-blockchain-rollback/"},{"date":"2026-10-01","event":"ZANO trading near $5.53. No formal claims process or recovery timeline published. Affected users advised to preserve transaction records.","source":"CryptoSlate","source_url":"https://cryptoslate.com/zano-rollback-removes-month-of-transactions-personal-funds-recovery/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision afe73684-09fa-4e1f-9a36-c06b61ceb78acopy