FlawZano, a privacy-focused layer-1 network that hides amounts and transaction details by default, said on September 25, 2026 that a supply-integrity defect in its new Gateway Addresses feature had left developers with little option but to unwind roughly 24 hours of chain history.
The team told users to freeze economic activity in both native ZANO and Confidential Assets while operators prepare a coordinated upgrade.
Gateway Addresses went live with Hard Fork 6 at block 3,833,000 on August 26 after more than a year of work.
The feature was meant to make integration easier for exchanges, bridges, and other services.
Ordinary Zano addresses do not expose a readable balance; a service must scan the chain and reconstruct holdings from private outputs.
Gateway Addresses instead behave more like account-style addresses with a public balance that integrators can query directly, while everyday user wallets remain fully private.
That convenience appears to have been the weak point.
Zano later said the core team had found a vulnerability in public Gateway Addresses that affects asset issuance, including the confidential stablecoin fUSD.
The project stressed that transaction privacy was not broken and that spend keys and wallets were not compromised.
Still, an inflation bug is among the most serious failures a monetary protocol can suffer.
Zano issues a fixed 1 ZANO block reward every minute and burns all transaction fees, a design intended to keep issuance tightly controlled and potentially deflationary if usage is high.
Unauthorized minting undercuts that promise.
Because the defect involved issuance rather than a simple double-spend, developers concluded that rolling the ledger back about a day was the cleanest way to remove illicit supply.
A rollback of that length also discards legitimate transfers from the same window.
Users who sent or received funds during those hours may see those movements vanish from the canonical chain.
Zano pledged to reimburse economic damages and later said user balances were safe and that any Gateway Address discrepancies would be resolved while the team worked with partners. It has not yet published the target height, the exact quantity of extra assets created, or a detailed compensation process.
Security update and coordinated upgrade:
The core team has identified a vulnerability in public Gateway Addresses that affects asset issuance, including fUSD.
Transaction privacy is unaffected, and no spend keys or wallets are compromised.
We will coordinate a network…
— Zano (@zano_project) September 25, 2026
The incident also requires coordination. Zano asked node operators, mining and staking pools, and exchanges to stand by for a patched client. The upgrade needs majority consensus to activate.
Ordinary holders were told they need only update when the new software is released. A full technical write-up is promised after the fix is in place.
Outside observers have speculated that mixed transactions—those that combine gateway outputs with confidential outputs—may have been involved, but the project has not confirmed the precise code path.
Market reaction was swift.
Reports indicated ZANO fell about 20 percent after the announcement, as traders priced in both the supply scare and the unusual decision to rewrite recent history.
For a chain that markets itself on privacy and sound issuance, the episode is a test of communication as much as engineering.
Immutability is one of blockchain’s core selling points; deliberately erasing a day of accepted blocks is rare and costly to trust, even when the alternative is a polluted money supply.
The next steps are operational: ship the patch, gather consensus, resync nodes, restore a consistent ledger, and explain how much unauthorized issuance occurred and how reimbursement will work. Until then, the network is in a holding pattern, with users advised to wait rather than move funds.