Zano Monthly Project Update #24 - September & October 2026

GinoFPM

• 12 min read
Zano Monthly Project Update #24 - September & October 2026

Welcome zAnons to the 24th Zano Project Update!

September and October were defined by one event and the work that followed it. On 25 September the team identified a vulnerability in Gateway Addresses that had allowed unauthorised minting of $ZANO and $fUSD, and two days later an emergency release activated HF7 and restarted the chain from block 3,833,000. October went into making that recovery hold: two maintenance releases, wallet downloads restored one by one, and new versions of Zano Companion, the Lite Wallet and the mobile app. Around it, the ecosystem kept moving, with new places to spend $ZANO, tradable aliases on the way and a route to permissionless access through THORChain. Because the recovery runs across both months, we've covered them together in a single update.

Let's dive in!

Table of contents

The Gateway Address Vulnerability and the HF7 Recovery

Gateway Addresses arrived with Hard Fork 6 in August as the feature that would let exchanges, bridges and DEXs connect to Zano on their own terms. A month later they were the entry point for an attack on the supply of $ZANO and $fUSD, and the response to that attack shaped almost everything else in this update.

On 25 September, the team identified a vulnerability in Gateway Addresses that allowed unauthorised minting of $ZANO and $fUSD, with the illicit minting dating back to around 29 August. The cause was a missing verification: an attacker could craft a special asset ID while still satisfying the balance proofs. No user funds or privacy were compromised, and spend keys were safe. What the attacker created was new, illicit supply.

We released v2.2.3.600 as an emergency update on 27 September, two days after the discovery. It rolled the chain back to block 3,833,000, the height at which Hard Fork 6 activated, which removed the illicit supply completely. The same release activated HF7, temporarily disabled Gateway Addresses, updated the blockchain database and wallet formats, and reset peer discovery so that upgraded nodes would find each other on the restarted network.

Our technical write-up of 1 October sets out the full timeline, how the issue was detected, how we verified that only $ZANO and $fUSD were affected, and why the rollback had to reach back to a point before the exploit began. It also commits to transparency and to making affected parties whole. For specific reimbursement cases, the team built a separate v2.2.2.518 rollback snapshot build and a partial-wallet snapshot tool.

Until an independent audit is complete, Gateway Addresses stay disabled. The fix is in progress. It checks that the asset IDs on gateway outputs reference registered assets, on both the main-chain and the alternative-chain validation paths, and it remains under thorough analysis and testing.

THORChain and @raynalytics followed on 12 October with a detailed recap of the exploit, the recovery and the road to a future THORChain integration, which we shared with thanks.

Stabilising the Network and Bringing Wallets Back

Rolling back the chain fixes the ledger. It doesn't put a working wallet back in everyone's hands, and October was spent on that second half: dependable synchronisation, restored downloads and new app versions.

Two maintenance releases followed in October. v2.2.3.603 on 5 October and v2.2.3.608 on 27 October made wallet synchronisation lighter and dependable again, restored mainnet predownload snapshots and fixed a run of reconnection and startup issues. The full list is under Technical Upgrades.

Downloads came back in stages. The website's Android links were re-enabled on 28 September, a day after the emergency release, with the direct APK updated to v3.4.0. On 29 October the Lite Wallet downloads followed, updated to v3.5.0 for Windows, macOS and Linux, each with x64 and ARM64 builds. Mobile v3.5.0 was submitted to Google Play and the App Store on 30 October; at the time of writing, public availability in the stores had not yet been confirmed.

Companion users got two releases. Companion 1.3.3 reached the Chrome Web Store on 14 October and brings September's confirmation and swap work to everyone:

  • You now have to scroll through a request before you can confirm it. Transfer confirmations show attached service entries and warn you about unencrypted attachments.
  • Swap confirmations display asset IDs, applicable fees and unlocked balances, and the wallet's identity is checked again at the moment you confirm.
  • The extension moved to the stable zano_web3 10.3.0 SDK.

Version 1.3.4 was published on GitHub and submitted to the Chrome Web Store on 26 October. It fixes wallets incorrectly appearing offline when recent transactions contained multiple payment IDs. History now groups transfers by payment ID, with copy controls and clearer details for fee-only transactions.

Zano Fact: Did you know Zano's treasury is publicly auditable? The foundation fund sits in an auditable wallet, and anyone can import its tracking seed to check the books for themselves.

The Road to Permissionless Access

Buying $ZANO today still means going through a centralised exchange. Some of those require KYC, and all of them are custodial. That route has been narrowing all year, and on 15 September it narrowed again when CoinEx announced it was ceasing operations and beginning an orderly wind-down.

CoinEx had been a long-time, reliable exchange for Zano. Trading stopped on 29 September and the withdrawal deadline is 22 December. If you still hold anything there, move it to self-custody as soon as you can.

In The Path to Better Accessibility and Liquidity for Zano, published on 22 September, Quinten van Welzen set out the wider picture: mid-tier exchanges closing, swap platforms delisting $ZANO, and decentralised exchanges such as THORChain unable to verify balances that Zano keeps hidden. Gateway Addresses were a large part of the answer, because they give a service an address whose balance can be read and checked on-chain while standard Zano addresses stay fully private.

That post went out three days before the vulnerability was identified. The path it describes still stands, but it now runs through the audit: Gateway Addresses return only once an independent audit is complete, and that same route is what enables permissionless access to $ZANO. On 23 October, @Mr_Kwibs explained in a short video why THORChain is a good fit: no account, no KYC, and no dependence on where you happen to live.

Ecosystem Growth and Integrations

Across the two months, the numbers trace the shape of the recovery. Confirmed transactions fell from 108,308 in August to 10,364 in September, then climbed back to 81,797 in October, still about 24% below August. Average transactions per block followed the same curve: 2.43, 1.65, then 1.84. September's figures are low for a structural reason: with the chain restarted from block 3,833,000 on 27 September, the month's activity on the canonical chain sits in its final few days [VERIFY: confirm with devs that this is the right reading of the September figures]. Total $ZANO burned rose 6.4% over the two months to 15,809, and October alone added 817.97 $ZANO to it, exactly 0.01 for each of its 81,797 confirmed transactions. Measured against August, aliases grew by 456 to 16,136 and Confidential Assets by 11 to 940. Total value locked in active projects fell 19.4%, from $24.08M to $19.40M, a dollar figure that also moves with price.

Both months also added new ways to use $ZANO and your alias:

  • ZanoNames. Zano aliases are about to become tradable. Through @ZanoNames you'll be able to buy an alias, bid on one at auction or make an offer in $ZANO or $fUSD, with escrow holding the payment until the on-chain transfer is confirmed. The launch was announced on 29 October as coming soon.
  • Freedom Wallet. Since 12 October you can claim a Zano alias directly in Freedom Wallet. The in-app flow registers a name from as little as 0.11 $ZANO [VERIFY: source shows "0.11 zano:native"], so you can swap a long address for a readable one without leaving the wallet.
  • CardsRelay. Gift cards from more than 1,600 brands, including ChatGPT, Amazon and Netflix, can now be paid for with $ZANO via CardsRelay. Codes arrive by email, no account is needed and the payment stays private.
  • AEON Pay. In September, AEON Pay shared a video of someone paying for Dunkin' in the Philippines with $ZANO, simply by scanning a QR code at the counter. On 30 October we reminded holders that $ZANO and $fUSD can be loaded into AEON Pay and spent at more than 50 million local merchants in Nigeria, Vietnam, the Philippines, Bangladesh, Brazil and beyond, with a step-by-step top-up video guide from Zano Africa.

Smaller additions round things out. Since 18 September, the Zano newsletter has delivered development news, partnerships, integrations and ecosystem updates straight to your inbox; you can sign up at the bottom of zano.org. A new Telegram bot also posts Forum topic alerts in the Zano group, so new discussions on forum.zano.org reach the chat as they open.

Zano Fact: Did you know every Zano transaction makes $ZANO scarcer? The network fee is a flat 0.01 $ZANO, and all of it is burned: not redistributed, not paid to a treasury, destroyed.

Events

@Mr_Kwibs, our Head of Marketing and Growth, hosted an X Space on 23 September on Zano's latest developments, covering the privacy narrative, Hard Fork 6 and Gateway Addresses.

Early November brought two events. At AIBC World in Rome, from 2 to 5 November, the team ran its own booth, H7-7381, where visitors could see how private payments work, find out what can be built on Zano, get a wallet set up and talk to our business development team about adding private payments.

Exit and Build 6, which Zano is sponsoring, is the summit run by @JohnBLiveFree for people building parallel systems: local food, trade, networks and permissionless tools. It runs from 5 to 8 November at Sovereignty Ranch in Bandera, Texas, where @SallyMayweather represents Zano with a talk on why private, permissionless money belongs on that list.

Technical Upgrades

Behind the releases above sit two months of detailed engineering, much of it pulled towards the recovery.

Core, Protocol & Consensus

Core work centred on fixing the gateway flaw properly and making chain handling more resilient, while preparation for the next fork carried on alongside.

  • Gateway validation fix: checks that gateway-output asset IDs reference registered assets on both main-chain and alternative-chain validation paths. Still under thorough analysis and testing.
  • Chain handling: alternative-chain pruning and chain switching made more resilient, with expanded regression tests. Network idle handlers now survive exceptions.
  • Decoys and staking: decoy-selection and staking-maturity corrections, and in v2.2.3.608 a reworked decoy selection for pre-HF4 outputs.
  • Next fork: HF8 preparation and the hardfork-booster feature, intended to adjust an upcoming fork's activation height, are in development.
  • Testnet: HF7 activation set to height 500,000, with predownload snapshots refreshed to height 216,000.

Wallet & RPC

Wallet work had two aims: making synchronisation dependable after the restart, and tightening how the wallet handles gateway transactions, proofs and encryption.

  • v2.2.2.513: September's maintenance release, bringing together protocol, wallet and security hardening.
  • Synchronisation: v2.2.3.603 completed the compact-block-sync rollout begun in September, reducing wallet synchronisation traffic, and restored unpruned mainnet predownload snapshots at height 3,833,000. v2.2.3.608 restored full-block wallet synchronisation through a compatibility flag.
  • Reliability (v2.2.3.608): reconnection after a daemon disconnect fixed, wallet-manager state corrected during transfer callbacks, and export_history fixed.
  • Gateway and security: gateway transactions validated before signing and relay, local decryption of gateway history, stronger proof-verification guards and wallet-encryption parameter checks.
  • Payments and staking: asset-aware payment RPCs, staking-status improvements and safer handling of payment IDs.

Build & GUI

Desktop users feel this work mostly through builds that are easier to verify and a better-contained GUI.

  • GUI: the WebChannel API is now isolated, password and master-password handling improved, the wallet-creation form updated, and Settings gained controls for reporting and clearing logs.
  • Release pipeline: build infrastructure moved further into GitHub Actions, with signed and notarised macOS builds, Windows and Linux ARM64 release builds and more flexible release workflows. October work improved macOS notarisation validation and Linux testing.
  • Toolchain: Windows builds moved from MSVC 2019 to 2022.
  • Linux: v2.2.3.608 fixed AppImage startup by bundling the complete NSS/NSPR libraries.

Zano Execution Layer

ZEL is a separate EVM chain connected to Zano by a threshold-signature bridge. Its testnet development continued across the core, bridge, signing, observer and relayer services, reaching v12.2.0-rc15 in October. Most of the work made the bridge safer and clearer to use.

  • Bridge controls: deposit and withdrawal limits, transaction-stop controls, gateway deposit handling, recipient information in bridge events and deposit-status APIs.
  • Bridge and swap interfaces: clearer amount and fee displays, address validation, recovery improvements and correct handling of cancelled Companion requests.
  • Staking: a redesigned staking interface for ZEL.

Web & Ecosystem

Explorer, Trade, ZanoStats and the documentation all moved forward, with the Explorer's new Tools section the most visible change.

  • Explorer Tools: the tools API was merged on 2 October and the frontend followed from 5 to 7 October. The set includes an Address Decoder, a Transaction Decoder that accepts a transaction blob or transaction ID, and a Transaction Output Decryptor.
  • Explorer, elsewhere: redesigned detail, chart and API pages, clearer pagination feedback, search-encoding fixes and corrected alias pagination, plus an fUSD development-fund balance display and fixes to statistics-panel styling and the price API's currency conversion.
  • Zano Trade: fixes for order precision, mobile access to the Order Pool and Recent Trades, proposal validation and transaction-confirmation races. A redesigned trading interface and API v2, covering asset and pair synchronisation, order matching, swap proposals and WebSocket updates, remain in development.
  • ZanoStats: the API now starts even when liquidity synchronisation fails, skipped blocks during synchronisation are fixed, the frontend wallet connection works with the current SDK, and sponsor placements were updated.
  • Integrations: integration-key and rate-limit work across Trade, Explorer, Matrix, Stats and Quest.
  • Docs and website: the documentation site gained a ZEL section, 13 explainer videos and corrected alias-format guidance. The website saw updates to wallet downloads, community links, page-sharing images and campaign measurement, and Bing verification and IndexNow submission were completed.
  • BTCPay plugin: compatibility with BTCPay Server 2.4.5, stricter invoice-amount validation and a replacement ZANO/USD rate provider. Testnet payment checks are done; the public release and directory listing are pending.

Zano Quest

Quest testing in October connected Learn-to-Earn to real actions on-chain and in the community.

  • On-chain tasks: linking a wallet, sending a transaction, minting a Confidential Asset and joining the Forum. Wallet checks keep the linked account and the active Companion wallet consistent.
  • XP-to-ZANO contribution flow: season-status tracking, personal contribution totals, pool-administration controls and payout-review tools.
  • Polish: community-content feeds integrated, with fixes to mobile layouts, XP labels and authentication-error messages.

Mobile

Mobile fixes focused on Send and swap, where precision matters most, while new Lite Wallet features went through QA.

  • Send and swap: fiat conversion and decimal precision corrected in Send, and validated amounts preserved through swap confirmation.
  • Lite Wallet QA builds: late-October prereleases covering backup and recovery navigation, export protection, wallet selection before startup, separate desktop profiles and shared block synchronisation. Further platform testing is required.
  • Wallet redesign: a September Android review build using sample data and simulated operations, for design review only. Native-wallet integration continues separately.

Media Content & Coverage

If you want the incident in one place, start with our 1 October technical article and the THORChain and @raynalytics recap.

Alongside the recovery, the short explainer videos on X carried on, each taking one part of how Zano works:

A recording of the 21 September workshop walks through wallet setup, a first private transaction and a tour of the ecosystem and is a good link to send anyone new.

In a short interview clip, @trspalding talks about finding Zano and what made private PoS stand out. The entire interview is linked down below.

Zano Fact : Did you know escrow is built into the Zano protocol? Both parties lock a deposit and whoever tries to cheat forfeits theirs, with no arbitrator, intermediary or smart contract platform required. It has been part of the chain since mainnet launched in May 2019.

Looking Ahead

The priority for the coming weeks is the gateway validation fix. It remains under analysis and testing, and Gateway Addresses come back only after an independent audit, so we won't put a date on it here. Preparation for HF8 continues in parallel, together with the hardfork-booster feature for adjusting an upcoming fork's activation height.

Several releases are queued. Mobile v3.5.0 is with Google Play and the App Store, Companion 1.3.4 has been submitted to the Chrome Web Store, ZanoNames is launching soon, and the BTCPay plugin's public release and directory listing are pending after successful testnet payment checks.

For your part, three things. Run the latest desktop release, v2.2.3.608. If you still hold funds on CoinEx, withdraw them before 22 December. And if you need help, use forum.zano.org or support.zano.org: the team never DMs first, and wallet support is never given on Telegram or Discord.

These were two hard months. A flaw in a month-old feature was found, contained and rolled back within two days of being identified, and the weeks since went into making the network and its wallets dependable again. The road the team set out in September, towards real integrations and permissionless access, still runs through Gateway Addresses. It now runs through an independent audit first.

Cheers, zAnons!

Sign up for more like this.

Enter your email
Subscribe