Privacy-focused blockchain Zano suffered a significant exploit this week after an attacker minted more than a quadrillion units of its fUSD stablecoin and generated millions of unauthorized ZANO tokens, forcing developers to execute a controversial blockchain rollback to contain the damage.
How the Exploit Unfolded
The attacker exploited a vulnerability that allowed the creation of fraudulent coins on an enormous scale. According to reports, the exploiter minted over a quadrillion fUSD tokens and produced roughly 369 million worth of unauthorized ZANO before the team could intervene.
What made the situation especially dangerous was that the fraudulent tokens were cryptographically indistinguishable from legitimately issued ZANO. This meant developers had no straightforward way to isolate and burn the malicious coins without affecting the broader network.
The counterfeit tokens were a perfect match for the real thing, leaving developers with no clean way to separate fraud from legitimate holdings.
Because privacy coins like Zano are engineered to obscure transaction details and token origins, the very features designed to protect user anonymity also complicated efforts to trace and remove the exploiter's holdings.
The Rollback Response
Faced with no way to surgically remove the unauthorized tokens, the Zano team opted to roll back the blockchain to a point before the exploit occurred. Blockchain rollbacks are rare and contentious measures, as they involve reversing confirmed transactions and effectively rewriting recent network history.
The decision underscores a persistent tension in the crypto space between immutability — often touted as a core principle of blockchain technology — and the practical need to respond to security breaches.
Key takeaways from the incident include:
- The exploiter minted more than a quadrillion fUSD stablecoin units
- Millions in unauthorized ZANO tokens were also created
- Fraudulent coins were indistinguishable from legitimate tokens
- A blockchain rollback was deemed the only viable fix
The event adds to a growing list of security incidents affecting smaller and privacy-oriented blockchain projects, highlighting the risks that remain even in protocols built around strong cryptographic guarantees.