Zano core team
We have completed our part of the reconciliation, including covering deposits made during the affected period.
We expect MEXC to process balance updates and resume services at their earliest convenience.
We will share another update as soon as MEXC has processed the reconciliation process.
Yes, that's right. Since HF7 was used for the network recovery, Zenith is moving to HF8. The numbering change shouldn't affect the work already done, and we hope progress continues as planned.
It's still too early to give an ETA. After what happened, we won't rush anything. Gateway Addresses will stay disabled until we've fully reassessed and audited that code without time pressure, and we're applying the same standard to Zenith and ZEL. The goal is to have everything fully audited, including by third parties, so it's as solid as we can make it before anything goes live.
You've laid out the sequencing trade-off well: Gateway v2 built against the long-term PoS consensus versus the delay that could mean for ZEL and the integrations that depend on it. We're not in a position to commit to an order yet. We'll share how that plays out, and what it means for the roadmap, in an official update rather than guessing here.
The Gateway Address Vulnerability: What Happened and What Comes Next
We've published a full post-mortem on the Gateway Address vulnerability identified on 25 September. It explains what the vulnerability was, how it was used, how it went undetected and what comes next.
Read the full post-mortem here:
https://blog.zano.org/p/19b37565-1cd0-44dc-bf2a-8e231f9395e7/
Thanks for keeping all the TXIDs and records, that's exactly what's needed.
The team is in direct contact with the exchanges and working closely with them as they move to the recovered chain, and cases like yours are part of those conversations. I can't speak for NonKYC or CoinEx on their side, but the team intends for the community to be made whole throughout this process.
BTW, nobody from the team will DM you first about this. If anyone messages you offering to help recover your balance, it's a scam.
The team is working on a process to recover affected balances in full. ZANO supply and emission will remain unchanged. Funding comes from the dev fund, team members' personal funds, and contributors who have committed support.
Most affected balances sit with exchanges and services, so recovery runs through them:
Withdrawals from an exchange during the affected period (August 26 to September 27). These coins are back in the exchange's wallet on the updated chain. The exchange replays these withdrawals once it reopens.
Deposits to an exchange during the affected period. The team is working directly with each exchange to cover these, so your exchange balance can be credited.
Frozen MEXC accounts. We are working with MEXC to release accounts with no link to invalid transactions as quickly as possible.
Card top-ups and payment services. These are settled directly between the service and the team.
Payments between individuals. These are back with the sender on the updated chain. For cases that cannot be resolved this way, a process for individual users will follow.
What to expect
Each exchange and service checks a month of activity, transaction by transaction, before it reopens. This takes time, and doing it carefully is what prevents balances from being credited to the wrong people or twice. Each exchange announces on its own channels when it is ready.
No action is needed right now. Keep your transaction IDs and records. The team will never DM you first or ask for your seed phrase.
The hotfix has been pushed and the network is stable on the updated chain.
Where things are at right now:
The updated mobile wallet is now live for both Android and iOS. Desktop users can download the updated wallet from http://zano.org/wallets or the official GitHub releases page. If you haven't updated yet, please do. Seed phrases are not required.
Third-party wallets, exchanges and payment services all need to update their own nodes to the updated chain before they can safely process transactions again. For exchanges, these updates will determine when ZANO deposits and withdrawals reopen. We are in direct contact with them to support that work, and each of them announces on their own channels when they are ready. Please wait for each service to confirm through its official channels that it has resumed operations before sending funds.
For anyone who was affected, the recovery process is being prepared. No action is needed from you at this stage, and we will publish the details once they are finalized.
Thanks for your patience and support over the past days; it has meant a lot to the team.
Questions are welcome on http://forum.zano.org and in our official Telegram, where you're always talking to the actual team.
The network is stable. The team is working on a process to recover affected balances. ZANO supply and emission will remain unchanged. Funding will come from the dev fund, team membersβ personal funds, and contributors who have committed support.
Current priorities for the Zano core team:
Recovery for affected users. We are working with partners and counterparties to verify affected activity and finalize how recoveries will be handled. No action is needed from affected users right now, and we will share clear instructions as soon as possible.
Supporting exchanges and service operators. Every exchange, wallet and payment service implements the update on their own side, and we are supporting them by answering technical questions, walking through what they need and confirming their setup before they go live again. Several are already well on their way, and each one will announce when they are ready.
The post-mortem. This will cover the incident, the response and the steps that follow from it, including an analysis of the Gateway Address code so that we can say with confidence what was affected and what was not. It will be published once that analysis is complete.
The community's support throughout this process has been remarkable, and weβre incredibly grateful.
A recovery update will follow with where things stand across wallets, services and exchanges.
Zano network update: Recovery solution for Gateway Address vulnerability
The core team has identified a serious issue involving Gateway Addresses, which enabled unauthorized ZANO and fUSD to enter circulation.
Our investigation has found no compromise of wallet spend keys or ordinary transaction privacy. Zano core consensus is unaffected.
The team has developed a solution to eliminate all unauthorized activity with a coordinated network upgrade. To ensure full network integrity, the Zano blockchain has been restarted from block height 3,833,000, immediately prior to Hard Fork 6. This affects approximately one month of chain history. The recovery requires participating nodes, miners, stakers, and services to adopt the update.
We are relaunching services such as the mobile wallet node and the wrap service one by one. It is up to each third-party wallet, exchange, and service to update on their own behalf. Before sending funds to or from any of them, check that they have moved to the recovered chain.
Transactions confirmed during the affected period are not part of the recovered chain. Keep transaction IDs and trade records, and do not resend a payment until you have updated your wallet and checked its final status on the recovered chain.
If you run a full node, mine, stake, operate a pool, or provide exchange, bridge, or payment services, please install the emergency release as soon as possible. Use only zano.org/wallets or the official GitHub releases page, and verify the published checksums. Ordinary wallet users can now download the updated wallet from our website as well. Seed phrases are not required to perform this upgrade.
This update removes all unauthorized activity from Zano's chain. It cannot affect payments already settled in USDT, DAI, or other assets on separate networks. The team is working with affected projects and counterparties to account for any losses and will publish the reimbursement and claims process.
Real people and businesses have been affected. We intend for the community to be made whole throughout this process. Certain community members have already pledged support to ensure that assets are restored.
Pushing innovation carries risk, and this is a clear example. Serious incidents have occurred elsewhere: Bitcoin recovered from an exploited supply bug and chain reorganization in 2010; Zcash recently patched a potential counterfeiting flaw before any known exploitation; and Ethereum made an exceptional state change after the DAO attack. Each case was different, and none diminishes the harm here. We will publish the technical cause, the results of reviewing adjacent Gateway Address code, and the criteria for safely resuming activity. Confidence must be earned through that work, and the team is committed to working with the community to deliver on these efforts.
Security update and coordinated upgrade:
The core team has identified a vulnerability in public Gateway Addresses that affects asset issuance, including fUSD.
Transaction privacy is unaffected, and no spend keys or wallets are compromised.
We will coordinate a network upgrade asap. It requires majority consensus to activate, so we ask node operators, pools, and exchanges to be ready to update. No action is needed from ordinary users beyond upgrading when the release is published.
User balances are safe. We will resolve any discrepancies due to the Gateway Addresses. The core team is currently working with all of our partners.
A full technical write-up will follow after the upgrade is in place.
οΈ SCAM ALERT: Fake Zano wallet site οΈ
A community member has reported a fake site posing as the official Zano wallet: zanowallet[.]io
It is NOT affiliated with Zano.
According to the report, the site offers a Windows installer that looks almost identical to the real wallet, but running it installs a remote access trojan (RAT). This gives attackers control of your computer, including your screen, keystrokes (passwords and seed phrases), microphone, and webcam.
Only download Zano wallets from:
β’ zano.org/wallets
β’ github.com/hyle-team/zano/releases
β’ The official iOS App Store and Google Play listings, or the Android APK linked from zano.org
Stay safe:
β’ Type zano.org directly or use a bookmark. Don't trust search results or ads.
β’ Verify downloads against the SHA256 hashes in our GitHub release notes.
β’ Only whitelist zano.exe in your antivirus if it came from an official source and the hash matches.
β’ Never share your seed phrase or enter it on a website.
If you ran the installer from that site:
Assume your computer is compromised. From a separate, clean device, create a new Zano wallet with a new seed phrase and move your funds immediately. Change your important passwords from that clean device too, and wipe and reinstall your operating system on the infected one.
Spotted another fake site? Report it via [email protected], the Zano forum, or here in Telegram.
Thanks to the user who flagged this. Please share with anyone new to Zano. 
