Zano has rolled back roughly a month of blockchain history after it identified a vulnerability tied to “Gateway Addresses” that, according to the project’s core team, enabled unauthorized ZANO and Freedom Dollar (fUSD) to enter circulation.

In an update shared Sunday, Zano said the network was restarted at block 3,833,000—immediately before Hard Fork 6, which introduced the affected functionality. The recovery now depends on ecosystem participants, including nodes, miners, stakers, exchanges, and other services, upgrading to the revised software.

Key takeaways

• Zano restarted the chain at block 3,833,000, rolling back about a month of activity tied to an exploit linked to Gateway Addresses.
• The rollback removes both legitimate transactions from that window and the unauthorized ZANO and fUSD that entered circulation.
• Payments already completed on other blockchains cannot be undone, limiting how far the recovery can reverse real-world settlement.
• Zano says it will handle remediation for affected parties through a reimbursement and claims process, though details have not yet been published.
• The fix requires coordinated adoption by infrastructure operators and service providers, including exchanges and other third parties that integrate with Zano.

Hard Fork 6 and the Gateway Address vulnerability

Zano has not published a full post-mortem as of publication, but it has confirmed that the problem originated with Gateway Addresses—a feature designed to simplify how external platforms such as bridges, exchanges, and payment services integrate with the Zano network.

According to the project’s explanation, Gateway Addresses enable these services to manage funds using a single “account-style” balance rather than handling payments as scattered transaction outputs.

Before Gateway Addresses existed, Zano wallets operated using separate transaction outputs (UTXOs). For exchanges and similar services, that meant incoming funds required blockchain scanning to identify which outputs belonged to a platform, followed by selecting specific outputs for withdrawals.

The introduced feature changed that workflow by offering a different way to account for funds—one that, in Zano’s view, became the pathway for the vulnerability that allowed unauthorized tokens to be minted or otherwise introduced into circulation.

What the rollback does—and what it cannot fix

Zano’s rollback invalidates the on-chain record of the affected period. The project states that transactions processed during that time will no longer appear on the restored chain. It also says the unauthorized ZANO and fUSD created or introduced through the exploit will be removed from the recovered ledger.

However, Zano cautioned that the rollback cannot reverse payments already settled on other blockchains. That distinction matters for users and service operators: if cross-chain transfers or off-chain settlements were completed before the restart, those transfers may not be recoverable even if the originating chain history is rewritten.

Zano also indicated that it is working to account for losses and will publish a reimbursement and claims process. The project did not provide the mechanics of how losses will be calculated or what documentation will be required within the material available at the time of writing.

Why Zano chose to restart the network

Zano’s head of marketing and growth, Quinten van Welzen, framed the decision as a trade-off between restoring the integrity of the currency supply and accepting a painful loss of history.

In statements shared alongside the rollback announcement, van Welzen argued that “doing nothing” would have allowed unauthorized ZANO and fUSD to remain in circulation without limits—effectively diluting holders and breaking what he described as the basic promise a currency makes: a fixed supply. He also suggested that allowing the attacker to retain value would set a dangerous precedent.

He acknowledged that restarting the chain from before Hard Fork 6 carries costs, including the disappearance of about a month of transaction history. At the same time, van Welzen said the rollback restores the supply that users expected and leaves a path for rebuilding trust.

Gateway Addresses and the risks of integration features

Zano’s broader context helps explain why the exploit mattered. The project launched in May 2019 as a layer-1 blockchain focused on private payments. Standard private transactions are designed to conceal senders, receivers, transferred amounts, and asset types.

Beyond its native token (ZANO), Zano allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token operating on the Zano blockchain. The vulnerability therefore wasn’t confined to a single token: unauthorized issuance affected both ZANO and an issued asset tied to the same underlying system.

Gateway Addresses were created to make integrations easier—especially for services that need to handle deposits and withdrawals without scanning UTXOs manually. But Zano’s response underscores a central theme in blockchain security: features that simplify custody and balances for third parties can also concentrate risk if they introduce new assumptions or pathways an attacker can abuse.

In that light, the coordination requirements for the restart carry practical weight. Zano said the recovery requires participating nodes, miners, stakers, exchanges, and other services to adopt the update. Without broad adoption, the network could split between versions, complicating settlement and increasing operational risk for trading venues and custodial providers.

For users, the rollback also highlights a limitation that extends beyond Zano itself: even if the originating chain is corrected, downstream effects—especially those involving cross-chain transfers or already-completed settlement—may remain permanent.

Looking ahead, attention should focus on the reimbursement and claims process Zano said it will publish, as well as how quickly exchanges and infrastructure operators finalize adoption of the restart. The project’s next security communications—whether it eventually releases a deeper technical post-mortem—will also be important for assessing whether Gateway Addresses will be reworked to prevent similar failures.

Zano has rolled back approximately a month of blockchain history after a vulnerability involving Gateway Addresses allowed unauthorized ZANO and Freedom Dollar to enter circulation, according to its core team. 

The Zano blockchain has been restarted at block 3,833,000, immediately before Hard Fork 6, which introduced the affected feature. The recovery requires participating nodes, miners, stakers, exchanges and other services to adopt the update, the team said Sunday. 

The rollback invalidates a month of legitimate transactions along with the unauthorized tokens, meaning transactions made during that period will no longer appear on the recovered chain and may need to be reconciled. It also cannot reverse payments already settled on other blockchains. The team said it is working to account for any losses and will publish a reimbursement and claims process. 

“Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” said Zano’s head of marketing and growth Quinten van Welzen. “It would also tell every future attacker that exploited coins get to keep their value. No project survives that.” 

Zano identifies Gateway Address exploit 

Zano has not released a post-mortem at the time of publication, but confirmed the issue came from Gateway Addresses, a feature developed to make it easier for bridges, exchanges and payment services to integrate with Zano by letting them manage funds through a single account-style balance (similar to other blockchains). 

Before Gateway Addresses, Zano’s ordinary wallets tracked funds as separate transaction outputs (UTXOs), rather than a single account balance. Exchanges and other services had to scan the blockchain to identify incoming payments, track those outputs and select which ones to spend when processing withdrawals.

Zano launched in May 2019 as a layer-1 blockchain focused on private payments. Its standard private transactions conceal senders, receivers, transferred amounts and asset types. While it has a native token, ZANO, the blockchain also allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token that operates on the Zano blockchain. 

Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues 

“Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back,” said van Welzen. 

“But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”

Magazine: THORChain under fire over Bitget, ETH evolves beyond blockchain: Hodler’s Digest

Cross-chain custody and censorship resistance collided with a high-profile breach narrative this week after Bitget publicly urged the decentralized liquidity protocol THORChain to block addresses allegedly tied to stolen funds. The dispute has reignited questions about what “decentralization” requires—and what it does not—when theft victims point to on-chain activity they believe is known to be malicious.

The push began after Bitget reported unauthorized transfers that it later revised upward, with the exchange attributing the suspected actor to North Korea based on preliminary investigative signals. In response, THORChain’s stance—whether it can meaningfully blacklist the relevant addresses, and whether it should—has become the center of an argument that is now spilling beyond technical governance and into the broader ethics of permissionless networks.

Key takeaways

• Bitget said unauthorized transfers rose from $351.6 million to $387.5 million, and later pointed to IP clues it believes link the activity to VPN infrastructure used by a North Korean hacking group.
• Bitget CEO Gracy Chen publicly asked THORChain to block addresses tied to the alleged theft connected to the Bybit-linked flow on THORChain.
• THORChain’s compliance position is unclear in practice because its ability to blacklist specific addresses has been questioned, including references to earlier admin-key changes.
• The debate is also exposing an asymmetry: decentralized funds may still be traceable after swaps, but protocols differ in whether they can or should exert address-level controls.
• While governance and security principles are at stake, THORChain has also faced criticism of its operational decentralization compared with networks like Bitcoin and Ethereum.

Bitget’s breach claims and the “block the addresses” demand

Bitget disclosed that it had detected “unauthorized transfers” tied to a security incident on September 25. According to Cointelegraph reporting, the exchange initially put the figure at $351.6 million, before updating it to $387.5 million. Bitget also stated that a preliminary investigation had linked IP addresses involved in the incident to VPN services associated with North Korean hacking operations, though the evidence was described as suggestive rather than definitive.

Bitget CEO Gracy Chen publicly argued that decentralized protocols should not serve as a destination for funds connected to theft. She said decentralization is a design principle, not a shield for facilitating known stolen assets, and urged THORChain to block addresses it believed were tied to the incident.

That framing matters because it reframes a typical “hack victim versus exchange” story into a “hack victim versus liquidity routing” story. If a stolen-flow path crosses a decentralized exchange-like venue, the conversation shifts from incident response alone to the network-level question of whether platforms can limit interaction with suspected addresses.

Why THORChain is at the center of the argument

As Bitget’s criticism spread, the broader context involved a prior major breach attributed to North Korean actors: the Bybit hack, reported by Cointelegraph as a $1.5 billion incident. Cointelegraph coverage also noted that funds from that attack were reportedly swapped on THORChain.

THORChain has often been described as a decentralized liquidity mechanism rather than a privacy mixer, and the general claim in the surrounding debate is that funds are still traceable after being swapped. That traceability is crucial: it gives victims and investigators a basis for arguing that specific on-chain participants should be restricted, even if the destination is a decentralized protocol.

However, what victims want—address-level blocking—may not align with how THORChain is technically or politically structured. The article notes that THORChain previously paused its chain quickly following its own $10.7 million hack in May. That detail highlights that the protocol can react decisively to security events, even as it faces scrutiny over whether it can selectively censor or restrict particular counterparties.

Can THORChain blacklist, and should it?

Whether THORChain can blacklist addresses is described as unclear in the reporting. The text points to a reference from February 2025, when THORChain said it had retired an admin key that would have provided the power to blacklist certain addresses.

This uncertainty is important for readers because it changes the nature of the request from “should a protocol do this?” to “can the protocol do this at all without undermining its own design?” Even if governance messaging supports compliance, protocol capabilities and key management can set hard boundaries on what is feasible.

Meanwhile, critics of address blocking argue that allowing decentralized protocols to respond to coercive demands would create a censorship precedent. The debate also includes an “ethics versus practicality” tension: victims emphasize harm reduction and reducing stolen-fund liquidity, while decentralization advocates emphasize permissionless access as an anti-tyranny safeguard.

At the same time, the article draws attention to concerns about THORChain’s decentralization level compared with Bitcoin or Ethereum. It cites the idea that THORChain does not match the governance model of the most decentralized networks and references past claims around administrative functionality. Those points are used to argue that the protocol’s permissionless claims may be overstated in practice.

For traders and builders, the operational reality is what matters most: if a protocol cannot enforce address-level exclusions, then users may still be exposed to flows they would rather avoid. If it can enforce them, then the network may face governance attacks, reputation risk, and the possibility of politically motivated address targeting. Either way, the outcome affects how participants assess risk and compliance expectations.

Market reaction and what to watch next

The controversy has not only sparked governance debate; it also appears to have attracted market attention. The article states that THORChain’s native token RUNE surged 50% over a week amid the publicity around the dispute.

Looking ahead, the key question is whether THORChain will clarify what address-level controls it can implement—if any—and what governance process would apply if requests from centralized exchanges are escalated. Readers should also watch how the underlying theft narrative evolves: Bitget’s attribution remains tied to preliminary investigation signals, and the strength of the evidence will influence whether future calls for restrictions gain wider traction.

In parallel, this episode underscores a broader industry challenge: even in decentralized systems, “who can stop stolen funds?” will increasingly depend on technical capabilities, governance choices, and the willingness of markets to treat permissionless routing as either a resilience feature or a liability.

ThorChain under fire because it won’t blacklist stolen Bitget funds

Stop me if you’ve heard this before: A centralized exchange with lax security gets hacked by the North Koreans for $387.5 million, and then somehow shifts the blame game onto a decentralized exchange for not blacklisting the addresses.

The drama began on September 25 when the Asian focused exchange Bitget revealed $351.6 million in “unauthorized transfers” but it later upgraded the tally to $387.5 million. It said a preliminary investigation had linked the IP addressees to VPN services used by a North Korean hacking group.

While that isn’t firm proof, CEO Gracy Chen said its investigators had flagged other similarities with previous thefts.

North Korean hackers were believed to be behind the $1.5 billion Bybit exchange hack, and much of the funds from that attack were then swapped on the decentralized exchange THORChain (which is not a mixer and funds can still be traced after being swapped).

Chen then publicly called on THORChain to block the addresses linked to the attack. “Decentralization is a design principle, not a shield for facilitating known stolen funds,” she thundered. Thorchain politely said no chance, which has set off a massive debate over whether they can or should comply with Chen’s request. Decentralization maxis like Joel Valenzuela said doing so would undermine crypto’s cypherpunk ethos. “If we let decentralized protocols to be bullied into setting a censorship precedent, or make it toxic to interact with permissionless protocols, then we lose to tyranny. Full stop,” he said.
But THORChain isn’t as decentralized as Bitcoin or Ethereum, and it coordinated to quickly pause the chain when it got hacked for $10.7 million in May. “Thorchain is like 5 retards in a discord coordinating secret updates in between talking about the stolen funds they’re profiting from and lying about the admin functionality they abuse regularly to rug their users and NO’s,” said cybersecurity expert Tay Vano.

However THORChain’s ability to blacklist particular addresses is unclear. Back in February 2025 it revealed it had retired the admin key which would give it the power to do so.

All publicity is good publicity and THORChain’s native token RUNE has surged 50% in a week.

Where we’re going we won’t NEED blockchain says Vitalik

Ethereum creator Vitalik Buterin has rallied the troops with an inspiring post outlining how Ethereum is being rebuilt from the ground up to integrate zero knowledge proofs, parallel processing, privacy and post quantum technology to genuinely become “the cryptographic world computer.”

“It’s really not just a blockchain anymore. It’s a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties,” he wrote, describing “an architecture that combines blockchains with cryptographic privacy and verification, and powerful decentralized off-chain components.” The Hegota fork, which is planned for next year, would likely Ethereum’s last “normal” fork he said.

Advertisement

Source: Brian Armstrong

Coinbase founder Brian Armstrong — a man who rarely utters the word “Ethereum” — reposted an analysis of the blog from a small account named “Cryptographic” said the analysis was “interesting.” Cryptographic summed up the thrust of Buterin’s post by saying it changed the whole meaning of “onchain” and meant Ethereum really was becoming a “world computer.”

“Instead of every part of an app having to execute inside a smart contract you can push a huge amount of complexity elsewhere and still inherit Ethereum’s guarantees.”

Aave founder Stani Kulechov made a similar point, arguing: “There are countless of use-cases where Ethereum verifiability would be useful beyond smart contact execution environment for finance to expand what we can actually do in DeFi while minimizing trust. Quite excited for the potential here.”

Crypto Mom retires, suggests ZK proofs for KYC

SEC Commissioner Hester Peirce has submitted her formal resignation from the US Securities and Exchange Commission, effective Oct. 2.

Peirce, affectionately known as “Crypto Mom” amid her advocacy of clear, rules-based regulation of the crypto industry, posted a copy of her resignation letter on her X account Friday.

Cointelegraph reported in May that Peirce planned to join the law school of Regent University in Virginia as an associate professor in November.

On her way out the door she criticized excessive KYC data storage, saying that storing IDs online created large numbers of databases vulnerable to hacks without improving enforcement. Instead, she advocated using zero knowledge proofs, which are able to verify eligibility without sending ID documents through.  “One can prove that you qualify without that counterparty knowing your name, income, or address,” she said.

Magazine covered this very subject earlier this month.  

Open AI called for Australian Senate inquiry following rogue AI hack

The CEOs of OpenAI and Anthropic have reportedly been summoned to appear at an Australian Senate inquiry into AI, just days after news broke that a rogue OpenAI bot had hacked the country’s health data.

The Australian Medicare breach is one of the highest-profile incidents of AI agents accessing external systems outside the US, according to a Sunday Business World report.

Cointelegraph reported last Thursday that the OpenAI research agent had bypassed blocks on the Australian government health data portal and accessed non-public files in June. It somehow didn’t get around telling the Australians until September 10.

Michael Saylor outlines ‘bill of digital rights’

Michael Saylor, co-founder of Strategy, said that an age of digital assets and intelligence needs a “bill of digital rights,” rather than restrictions.

These rights include (1) the freedom to create new digital assets and (2) to issue them to the market to finance business and productivity. They also include (3) the right to hold them or choose a custodian, as well as (4) to transfer them, to move the assets among people, companies, wallets and service providers. Finally, (5) to use them, to spend, invest, earn income and borrow against digital assets.

This week the Strategy board announced it would seek shareholder approval to move its four preferred stocks, including STRC, to daily dividend payments without changing their dividend rates or the total amount paid.

Winners and Losers

At the end of the week, Bitcoin (BTC) is up 3.8% to trade at $84,222, Ethereum (ETH) is up 3.7% to trade at $2,674 and XRP (XRP) is up 7% to $1.50. The total market cap is at $2.88 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Quant (QNT) with a 435% gain, Sei (SEI) on 44%, and Artificial Superintelligence Alliance (FED) on 41%.

The top three altcoin losers of the week are Falcon Finance (FF) which was down 25.3%, MemeCore (M) down 20.3% and Avalanche (AVAX) down 4.5%.

Top Prediction of the Week

Bitwise says NEAR could be headed to $562

Bitwise’s new NEAR ETF is about to launch, and its chief investment officer Matt Houghan has jumped into promotion duties by co-authoring some of the most optimistic predictions you’re likely to see this month. The new fund, called the Bitwise NEAR ETF, is expected to list on NYSE Arca under the ticker NRR.

Bitwise’s 39-page investment report NEAR states the “base case” is a price target of $155 by 2030 while the bull case is $562.  The bearish case suggests a price of $1.63.

Last week Near Protocol’s native token surged 80% to be the top performer in the Top 100. The surge came after Near unveiled private Hyperliquid perps trading.

Top FUD of the Week

Kalshi loses appeal, setting up potential Supreme Court case

Prediction market Kalshi lost on appeal when a court ruled that Ohio and Tennessee can regulate sports-event contracts under their state gambling laws.

The ruling followed a similar finding from the 9th Circuit Court of Appeals last month, which broke from an April decision by the 3rd Circuit Court of Appeals allowing the company to do business in New Jersey as its appeal process proceeds.

The April ruling said Kalshi was likely to succeed with its argument that federal law preempts New Jersey’s regulations, all of which has set up a potential Supreme Court case.

Tether says it had ‘limited’ exposure to bank linked to $84M US seizure

Stablecoin issuer Tether said that it had a very small amount of assets at a bank that had $84 million in assets frozen by US prosecutors.
In response to reports linking Tether and Bitfinex to a Montana-based payments business named in a civil forfeiture complaint, a company spokesperson told Cointelegraph that it had “no knowledge” of any of the alleged conduct. Tether confirmed it was a customer of EQIBank, but the amount held at the bank represented 0.034% of the group’s total assets.

Magic Eden scare puts 3,832 NFTs in whitehat protective custody

A whitehat moved 3,832 non-fungible tokens from hundreds of wallets on Friday amid concerns about a vulnerability involving NFT marketplace Magic Eden. 

NFT community member who goes by Cirrus on X flagged the activity on Friday, saying a single wallet moved 3,832 NFTs from hundreds of wallets. Cirrus said the transactions appeared as sales through Magic Eden and advised NFT holders to revoke permissions as a precaution.

Shortly afterward, Yuga Labs’ pseudonymous vice president of blockchain, 0xQuit, said the transfers were part of a white-hat operation. He said the NFTs held in the receiving wallet are safe and “will be returned once they are no longer at risk.” 

Top Magazine Features of the Week

The SEC has opened a five-year path for tokenized stocks, but only some products and venues fit the model. Will Uniswap, Robinhood, Coinbase or Kraken come out on top?

The IRS can now see your crypto gains, but has no idea about the cost-basis. That’s proving to be a big headache for some cryptocurrency investors.

The APAC region accounts for half of the Global Crypto Adoption Index. Bitget suffers massive $352M loss and OpenAI forgets to mention its agents hacked the Australian Government.