Zano’s core team has restarted the Zano blockchain to undo roughly a month of activity after it identified a vulnerability tied to “Gateway Addresses” that allowed unauthorized ZANO and Freedom Dollar (fUSD) tokens to enter circulation. The restart reverts the chain to block 3,833,000—immediately before Hard Fork 6 introduced the affected feature.

According to the project’s leadership, the recovery will only take full effect once participating nodes, miners, stakers, exchanges, and other services adopt the updated software. The team says transactions and token activity that occurred during the compromised period will no longer appear on the recovered chain. However, it also warns that the rollback cannot reverse payments that were already settled on other blockchains.

Key takeaways

• Zano restarted the chain at block 3,833,000, rolling back about a month of history linked to an exploit affecting Gateway Addresses.
• The reset targets activity after the Hard Fork 6 feature deployment, meaning compromised transactions won’t show on the restored chain.
• Participating nodes, miners, stakers, exchanges, and other infrastructure providers must upgrade to complete the recovery.
• Zano says it will publish a reimbursement and claims process to address losses, though cross-chain settlements cannot be undone.

Rollback mechanics: what changed and what can’t be reversed

The project says the vulnerability’s impact is limited to the period after Hard Fork 6, when Gateway Addresses were introduced. By restarting the network from block 3,833,000, Zano invalidates both legitimate transactions included after that block and any unauthorized ZANO and fUSD that the exploit minted or introduced.

That matters for users and service operators because it effectively resets the on-chain record for that interval. Anyone who relied on transactions during the rolled-back window—whether for balances, accounting, or automated workflows—will need to reprocess those events against the restored chain state.

At the same time, the team draws a clear boundary around what is feasible. While the rollback can change what is recognized on Zano itself, it cannot undo transactions already finalized elsewhere. For users who moved value through cross-chain transfers or other external systems, the project’s update implies that losses tied to already-settled external payments may not be recoverable via the chain restart alone.

What are “Gateway Addresses,” and why they became a target

Zano says it has not published a full post-mortem yet, but it confirmed the exploit originated with Gateway Addresses. The feature was created to make integrations easier for bridges, exchanges, and payment services by allowing them to manage funds through a single account-style balance model.

Before Gateway Addresses, Zano wallets tracked funds as separate transaction outputs (UTXOs), rather than as one consolidated account balance. That difference influences how exchanges and payment processors work: services had to scan the blockchain to identify incoming payments, track which outputs corresponded to customer deposits, and select appropriate outputs when users requested withdrawals.

By contrast, an account-style abstraction can streamline integration logic—especially for services that want a unified view of balances. The Zano team’s decision to revert the network “immediately before Hard Fork 6,” however, suggests the abstraction layer introduced new attack surface that was not sufficiently contained.

Zano’s public explorer shows the rollback taking place on Sunday, reflecting the chain reset and the shift back to the pre–Hard Fork 6 state. The project did not provide additional technical details in the excerpted information, but the explicit identification of Gateway Addresses helps narrow the likely root cause to the feature rather than to core transaction privacy itself.

Token supply, trust, and the case for restarting

The Zano leadership framed the restart as a tradeoff between immediate disruption and long-term credibility. Quinten van Welzen, head of marketing and growth, argued that “doing nothing” would have meant unauthorized ZANO and fUSD remaining in circulation indefinitely—diluting holders and undermining the idea of a fixed supply.

Van Welzen also suggested that allowing the compromised supply to stand would signal to future attackers that they could retain value after an exploit. In that view, the most damaging outcome would not just be the technical breach, but the precedent it sets for adversaries.

Restarting from an earlier block, he said, comes with real costs: it eliminates about a month of blockchain history and requires the community to rebuild trust. Still, the team’s position is that restoring the intended supply and restarting from a clean state offers a path back that justifies the disruption.

Why exchanges and validators are central to the fix

Zano’s recovery depends on adoption. The team said participating nodes, miners, stakers, exchanges, and other services must adopt the update so the network stabilizes on the recovered chain state. This requirement is especially important for institutional and high-throughput operators, where delayed upgrades can lead to inconsistent balances, duplicate processing, or mismatched transaction histories.

For traders and users, the implication is straightforward: infrastructure readiness will determine how quickly services converge on the restored ledger. For exchanges in particular, the rollback also affects deposit and withdrawal accounting—so operators may need to re-sync transaction histories and ensure customer records match the post-recovery state.

In parallel, Zano says it is working to account for losses. The team indicated that it will publish a reimbursement and claims process, which should become a key reference for affected parties once the details are released. Until then, the only fully reliable takeaway for users is that transactions from the compromised period are expected to disappear from the restored chain, while any already-settled activity outside Zano may not be reversible through the rollback.

Going forward, readers should watch for the promised reimbursement/claims instructions and any technical follow-up that clarifies exactly how Gateway Addresses were exploited, because those details will likely determine how integrators adjust their systems and how quickly confidence can be rebuilt after the Hard Fork 6 rollback.

At the United Nations General Assembly, Iran proposed an agreement to reopen the Strait of Hormuz, a major oil chokepoint disrupted by the war, for a seven-day period and pause fighting, followed by broader negotiations on issues.

Trump, however, rejected the proposal, saying that Iran is looking for a deal because it was under heavy pressure. Trump also stressed on Truth Social that Iran “cannot have a nuclear weapon.”

This lingering geopolitical uncertainty has stoked inflation fears since the war began in early March, lifting Treasury yields. The 10-year yield has risen by 127 basis points to 5.20%, the highest since 2007, amid inflation fears, Fed rate-hike bets and debt concerns.

Bitcoin fell early this year, but has bounced back strongly in the third quarter, shrugging off these uncertainties. Prices are up 42% in three months, outperforming every major asset, including Nasdaq and gold.

Analysts are now watching incoming data for cues about the next move in the cryptocurrency.

“For investors, the 83,800-84,000 zone is an important near-term support. The 85,000-85,800 area is the immediate resistance zone. It would be prudent to avoid chasing the rally at current levels,” Vikram Subburaj, CEO of India-based Giottus exchange, said in an email.

Zano has rolled back approximately a month of blockchain history after a vulnerability involving Gateway Addresses allowed unauthorized ZANO and Freedom Dollar to enter circulation, according to its core team. 

The Zano blockchain has been restarted at block 3,833,000, immediately before Hard Fork 6, which introduced the affected feature. The recovery requires participating nodes, miners, stakers, exchanges and other services to adopt the update, the team said Sunday. 

The rollback invalidates a month of legitimate transactions along with the unauthorized tokens, meaning transactions made during that period will no longer appear on the recovered chain and may need to be reconciled. It also cannot reverse payments already settled on other blockchains. The team said it is working to account for any losses and will publish a reimbursement and claims process. 

“Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” said Zano’s head of marketing and growth Quinten van Welzen. “It would also tell every future attacker that exploited coins get to keep their value. No project survives that.” 

Zano identifies Gateway Address exploit 

Zano has not released a post-mortem at the time of publication, but confirmed the issue came from Gateway Addresses, a feature developed to make it easier for bridges, exchanges and payment services to integrate with Zano by letting them manage funds through a single account-style balance (similar to other blockchains). 

Before Gateway Addresses, Zano’s ordinary wallets tracked funds as separate transaction outputs (UTXOs), rather than a single account balance. Exchanges and other services had to scan the blockchain to identify incoming payments, track those outputs and select which ones to spend when processing withdrawals.

Zano launched in May 2019 as a layer-1 blockchain focused on private payments. Its standard private transactions conceal senders, receivers, transferred amounts and asset types. While it has a native token, ZANO, the blockchain also allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token that operates on the Zano blockchain. 

Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues 

“Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back,” said van Welzen. 

“But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”

Magazine: THORChain under fire over Bitget, ETH evolves beyond blockchain: Hodler’s Digest

Cross-chain custody and censorship resistance collided with a high-profile breach narrative this week after Bitget publicly urged the decentralized liquidity protocol THORChain to block addresses allegedly tied to stolen funds. The dispute has reignited questions about what “decentralization” requires—and what it does not—when theft victims point to on-chain activity they believe is known to be malicious.

The push began after Bitget reported unauthorized transfers that it later revised upward, with the exchange attributing the suspected actor to North Korea based on preliminary investigative signals. In response, THORChain’s stance—whether it can meaningfully blacklist the relevant addresses, and whether it should—has become the center of an argument that is now spilling beyond technical governance and into the broader ethics of permissionless networks.

Key takeaways

• Bitget said unauthorized transfers rose from $351.6 million to $387.5 million, and later pointed to IP clues it believes link the activity to VPN infrastructure used by a North Korean hacking group.
• Bitget CEO Gracy Chen publicly asked THORChain to block addresses tied to the alleged theft connected to the Bybit-linked flow on THORChain.
• THORChain’s compliance position is unclear in practice because its ability to blacklist specific addresses has been questioned, including references to earlier admin-key changes.
• The debate is also exposing an asymmetry: decentralized funds may still be traceable after swaps, but protocols differ in whether they can or should exert address-level controls.
• While governance and security principles are at stake, THORChain has also faced criticism of its operational decentralization compared with networks like Bitcoin and Ethereum.

Bitget’s breach claims and the “block the addresses” demand

Bitget disclosed that it had detected “unauthorized transfers” tied to a security incident on September 25. According to Cointelegraph reporting, the exchange initially put the figure at $351.6 million, before updating it to $387.5 million. Bitget also stated that a preliminary investigation had linked IP addresses involved in the incident to VPN services associated with North Korean hacking operations, though the evidence was described as suggestive rather than definitive.

Bitget CEO Gracy Chen publicly argued that decentralized protocols should not serve as a destination for funds connected to theft. She said decentralization is a design principle, not a shield for facilitating known stolen assets, and urged THORChain to block addresses it believed were tied to the incident.

That framing matters because it reframes a typical “hack victim versus exchange” story into a “hack victim versus liquidity routing” story. If a stolen-flow path crosses a decentralized exchange-like venue, the conversation shifts from incident response alone to the network-level question of whether platforms can limit interaction with suspected addresses.

Why THORChain is at the center of the argument

As Bitget’s criticism spread, the broader context involved a prior major breach attributed to North Korean actors: the Bybit hack, reported by Cointelegraph as a $1.5 billion incident. Cointelegraph coverage also noted that funds from that attack were reportedly swapped on THORChain.

THORChain has often been described as a decentralized liquidity mechanism rather than a privacy mixer, and the general claim in the surrounding debate is that funds are still traceable after being swapped. That traceability is crucial: it gives victims and investigators a basis for arguing that specific on-chain participants should be restricted, even if the destination is a decentralized protocol.

However, what victims want—address-level blocking—may not align with how THORChain is technically or politically structured. The article notes that THORChain previously paused its chain quickly following its own $10.7 million hack in May. That detail highlights that the protocol can react decisively to security events, even as it faces scrutiny over whether it can selectively censor or restrict particular counterparties.

Can THORChain blacklist, and should it?

Whether THORChain can blacklist addresses is described as unclear in the reporting. The text points to a reference from February 2025, when THORChain said it had retired an admin key that would have provided the power to blacklist certain addresses.

This uncertainty is important for readers because it changes the nature of the request from “should a protocol do this?” to “can the protocol do this at all without undermining its own design?” Even if governance messaging supports compliance, protocol capabilities and key management can set hard boundaries on what is feasible.

Meanwhile, critics of address blocking argue that allowing decentralized protocols to respond to coercive demands would create a censorship precedent. The debate also includes an “ethics versus practicality” tension: victims emphasize harm reduction and reducing stolen-fund liquidity, while decentralization advocates emphasize permissionless access as an anti-tyranny safeguard.

At the same time, the article draws attention to concerns about THORChain’s decentralization level compared with Bitcoin or Ethereum. It cites the idea that THORChain does not match the governance model of the most decentralized networks and references past claims around administrative functionality. Those points are used to argue that the protocol’s permissionless claims may be overstated in practice.

For traders and builders, the operational reality is what matters most: if a protocol cannot enforce address-level exclusions, then users may still be exposed to flows they would rather avoid. If it can enforce them, then the network may face governance attacks, reputation risk, and the possibility of politically motivated address targeting. Either way, the outcome affects how participants assess risk and compliance expectations.

Market reaction and what to watch next

The controversy has not only sparked governance debate; it also appears to have attracted market attention. The article states that THORChain’s native token RUNE surged 50% over a week amid the publicity around the dispute.

Looking ahead, the key question is whether THORChain will clarify what address-level controls it can implement—if any—and what governance process would apply if requests from centralized exchanges are escalated. Readers should also watch how the underlying theft narrative evolves: Bitget’s attribution remains tied to preliminary investigation signals, and the strength of the evidence will influence whether future calls for restrictions gain wider traction.

In parallel, this episode underscores a broader industry challenge: even in decentralized systems, “who can stop stolen funds?” will increasingly depend on technical capabilities, governance choices, and the willingness of markets to treat permissionless routing as either a resilience feature or a liability.

ThorChain under fire because it won’t blacklist stolen Bitget funds

Stop me if you’ve heard this before: A centralized exchange with lax security gets hacked by the North Koreans for $387.5 million, and then somehow shifts the blame game onto a decentralized exchange for not blacklisting the addresses.

The drama began on September 25 when the Asian focused exchange Bitget revealed $351.6 million in “unauthorized transfers” but it later upgraded the tally to $387.5 million. It said a preliminary investigation had linked the IP addressees to VPN services used by a North Korean hacking group.

While that isn’t firm proof, CEO Gracy Chen said its investigators had flagged other similarities with previous thefts.

North Korean hackers were believed to be behind the $1.5 billion Bybit exchange hack, and much of the funds from that attack were then swapped on the decentralized exchange THORChain (which is not a mixer and funds can still be traced after being swapped).

Chen then publicly called on THORChain to block the addresses linked to the attack. “Decentralization is a design principle, not a shield for facilitating known stolen funds,” she thundered. Thorchain politely said no chance, which has set off a massive debate over whether they can or should comply with Chen’s request. Decentralization maxis like Joel Valenzuela said doing so would undermine crypto’s cypherpunk ethos. “If we let decentralized protocols to be bullied into setting a censorship precedent, or make it toxic to interact with permissionless protocols, then we lose to tyranny. Full stop,” he said.
But THORChain isn’t as decentralized as Bitcoin or Ethereum, and it coordinated to quickly pause the chain when it got hacked for $10.7 million in May. “Thorchain is like 5 retards in a discord coordinating secret updates in between talking about the stolen funds they’re profiting from and lying about the admin functionality they abuse regularly to rug their users and NO’s,” said cybersecurity expert Tay Vano.

However THORChain’s ability to blacklist particular addresses is unclear. Back in February 2025 it revealed it had retired the admin key which would give it the power to do so.

All publicity is good publicity and THORChain’s native token RUNE has surged 50% in a week.

Where we’re going we won’t NEED blockchain says Vitalik

Ethereum creator Vitalik Buterin has rallied the troops with an inspiring post outlining how Ethereum is being rebuilt from the ground up to integrate zero knowledge proofs, parallel processing, privacy and post quantum technology to genuinely become “the cryptographic world computer.”

“It’s really not just a blockchain anymore. It’s a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties,” he wrote, describing “an architecture that combines blockchains with cryptographic privacy and verification, and powerful decentralized off-chain components.” The Hegota fork, which is planned for next year, would likely Ethereum’s last “normal” fork he said.

Advertisement

Source: Brian Armstrong

Coinbase founder Brian Armstrong — a man who rarely utters the word “Ethereum” — reposted an analysis of the blog from a small account named “Cryptographic” said the analysis was “interesting.” Cryptographic summed up the thrust of Buterin’s post by saying it changed the whole meaning of “onchain” and meant Ethereum really was becoming a “world computer.”

“Instead of every part of an app having to execute inside a smart contract you can push a huge amount of complexity elsewhere and still inherit Ethereum’s guarantees.”

Aave founder Stani Kulechov made a similar point, arguing: “There are countless of use-cases where Ethereum verifiability would be useful beyond smart contact execution environment for finance to expand what we can actually do in DeFi while minimizing trust. Quite excited for the potential here.”

Crypto Mom retires, suggests ZK proofs for KYC

SEC Commissioner Hester Peirce has submitted her formal resignation from the US Securities and Exchange Commission, effective Oct. 2.

Peirce, affectionately known as “Crypto Mom” amid her advocacy of clear, rules-based regulation of the crypto industry, posted a copy of her resignation letter on her X account Friday.

Cointelegraph reported in May that Peirce planned to join the law school of Regent University in Virginia as an associate professor in November.

On her way out the door she criticized excessive KYC data storage, saying that storing IDs online created large numbers of databases vulnerable to hacks without improving enforcement. Instead, she advocated using zero knowledge proofs, which are able to verify eligibility without sending ID documents through.  “One can prove that you qualify without that counterparty knowing your name, income, or address,” she said.

Magazine covered this very subject earlier this month.  

Open AI called for Australian Senate inquiry following rogue AI hack

The CEOs of OpenAI and Anthropic have reportedly been summoned to appear at an Australian Senate inquiry into AI, just days after news broke that a rogue OpenAI bot had hacked the country’s health data.

The Australian Medicare breach is one of the highest-profile incidents of AI agents accessing external systems outside the US, according to a Sunday Business World report.

Cointelegraph reported last Thursday that the OpenAI research agent had bypassed blocks on the Australian government health data portal and accessed non-public files in June. It somehow didn’t get around telling the Australians until September 10.

Michael Saylor outlines ‘bill of digital rights’

Michael Saylor, co-founder of Strategy, said that an age of digital assets and intelligence needs a “bill of digital rights,” rather than restrictions.

These rights include (1) the freedom to create new digital assets and (2) to issue them to the market to finance business and productivity. They also include (3) the right to hold them or choose a custodian, as well as (4) to transfer them, to move the assets among people, companies, wallets and service providers. Finally, (5) to use them, to spend, invest, earn income and borrow against digital assets.

This week the Strategy board announced it would seek shareholder approval to move its four preferred stocks, including STRC, to daily dividend payments without changing their dividend rates or the total amount paid.

Winners and Losers

At the end of the week, Bitcoin (BTC) is up 3.8% to trade at $84,222, Ethereum (ETH) is up 3.7% to trade at $2,674 and XRP (XRP) is up 7% to $1.50. The total market cap is at $2.88 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Quant (QNT) with a 435% gain, Sei (SEI) on 44%, and Artificial Superintelligence Alliance (FED) on 41%.

The top three altcoin losers of the week are Falcon Finance (FF) which was down 25.3%, MemeCore (M) down 20.3% and Avalanche (AVAX) down 4.5%.

Top Prediction of the Week

Bitwise says NEAR could be headed to $562

Bitwise’s new NEAR ETF is about to launch, and its chief investment officer Matt Houghan has jumped into promotion duties by co-authoring some of the most optimistic predictions you’re likely to see this month. The new fund, called the Bitwise NEAR ETF, is expected to list on NYSE Arca under the ticker NRR.

Bitwise’s 39-page investment report NEAR states the “base case” is a price target of $155 by 2030 while the bull case is $562.  The bearish case suggests a price of $1.63.

Last week Near Protocol’s native token surged 80% to be the top performer in the Top 100. The surge came after Near unveiled private Hyperliquid perps trading.

Top FUD of the Week

Kalshi loses appeal, setting up potential Supreme Court case

Prediction market Kalshi lost on appeal when a court ruled that Ohio and Tennessee can regulate sports-event contracts under their state gambling laws.

The ruling followed a similar finding from the 9th Circuit Court of Appeals last month, which broke from an April decision by the 3rd Circuit Court of Appeals allowing the company to do business in New Jersey as its appeal process proceeds.

The April ruling said Kalshi was likely to succeed with its argument that federal law preempts New Jersey’s regulations, all of which has set up a potential Supreme Court case.

Tether says it had ‘limited’ exposure to bank linked to $84M US seizure

Stablecoin issuer Tether said that it had a very small amount of assets at a bank that had $84 million in assets frozen by US prosecutors.
In response to reports linking Tether and Bitfinex to a Montana-based payments business named in a civil forfeiture complaint, a company spokesperson told Cointelegraph that it had “no knowledge” of any of the alleged conduct. Tether confirmed it was a customer of EQIBank, but the amount held at the bank represented 0.034% of the group’s total assets.

Magic Eden scare puts 3,832 NFTs in whitehat protective custody

A whitehat moved 3,832 non-fungible tokens from hundreds of wallets on Friday amid concerns about a vulnerability involving NFT marketplace Magic Eden. 

NFT community member who goes by Cirrus on X flagged the activity on Friday, saying a single wallet moved 3,832 NFTs from hundreds of wallets. Cirrus said the transactions appeared as sales through Magic Eden and advised NFT holders to revoke permissions as a precaution.

Shortly afterward, Yuga Labs’ pseudonymous vice president of blockchain, 0xQuit, said the transfers were part of a white-hat operation. He said the NFTs held in the receiving wallet are safe and “will be returned once they are no longer at risk.” 

Top Magazine Features of the Week

The SEC has opened a five-year path for tokenized stocks, but only some products and venues fit the model. Will Uniswap, Robinhood, Coinbase or Kraken come out on top?

The IRS can now see your crypto gains, but has no idea about the cost-basis. That’s proving to be a big headache for some cryptocurrency investors.

The APAC region accounts for half of the Global Crypto Adoption Index. Bitget suffers massive $352M loss and OpenAI forgets to mention its agents hacked the Australian Government.