Zano fixed the chain. Exchange balances still need answers

Zano patched the bug that let an attacker create 36.9 million unauthorized ZANO.

It also rolled the blockchain back to an earlier point.

The harder problem now sits outside the patched code: exchanges must make their account balances match a chain whose accepted history changed.

Zano says it completed its side of that work with MEXC. We could not find a matching MEXC notice confirming that balances were restored or that ZANO and FUSD withdrawals had resumed.

Why the chain was rolled back

Zano says a bug introduced in its HF6 release allowed an attacker to create unauthorized ZANO and an extreme amount of fUSD.

The network uses privacy technology that can hide which specific outputs are being spent. According to the project, that made the attacker-created outputs impossible to separate cleanly from legitimate private outputs.

Zano chose a blockchain rollback. The updated network continued from block 3,833,000, before the affected activity.

That removed the unauthorized mint from the accepted history. It also removed legitimate transactions, staking rewards and mined blocks that happened after the chosen point.

Zano's postmortem said the HF6 bug created unauthorized ZANO and fUSD. Because private outputs could not be separated, the network continued from an earlier block.

Zano (@zano_project) · October 1, 2026

Why an exchange can show the wrong balance

An exchange keeps its own account database. It credits a customer after observing a deposit and debits the customer after processing a withdrawal.

If the blockchain later discards that deposit or withdrawal, the exchange database does not fix itself.

For example:

1. A user deposits ZANO during the affected period.
2. MEXC credits the user’s exchange balance.
3. The chain rolls back and no longer contains that deposit.
4. MEXC must decide whether to reverse, replace or manually reconcile the credit.

That is why the recovery needs more than a patched contract. It needs a transaction-by-transaction agreement between the project, exchanges and users.

What Zano says is complete

On October 4, Zano said it had completed its part of MEXC reconciliation, including covering deposits made during the affected period.

Zano said it completed its side of the MEXC reconciliation and expected MEXC to update balances and resume service.

Zano (@zano_project) · October 4, 2026

MEXC’s public notice still says ZANO and FUSD deposits and withdrawals were suspended at the project’s request. Our focused search did not find a later MEXC completion notice.

The double-credit concern is not proven

An outside analyst argued that covering rolled-back deposits could leave some users with both an exchange credit and restored coins on the rebuilt chain.

That is a plausible question, not a verified outcome. We did not find account-level evidence showing that a user could withdraw or spend both balances.

The clean way to resolve it is for MEXC or Zano to publish the reconciliation rule with a worked example.

What users should watch

• An official MEXC notice that deposits and withdrawals have resumed.
• A clear rule for deposits, withdrawals and trades during the discarded period.
• Evidence that affected balances were corrected without double credit or double loss.
• A final reimbursement total and completion record.
• Independent confirmation that the patched chain remains stable.

Zano’s code fix closed the original bug. The recovery is not complete until outside account records match the chain and users can move funds normally again.

Sources and reporting notes

Checked October 6, 2026. The exploit, mint amount, privacy constraint and rollback mechanics come from Zano’s postmortem. Zano’s claimed MEXC work comes from its October 4 recovery update. MEXC’s public operations page still showed its ZANO and FUSD suspension notice. Cointelegraph independently reported the exploit and recovery plan. The alleged double-credit edge case remains unverified and is not presented as a completed exploit.