Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

On September 25, 2026, Zano saw an anomalous transaction on their project. After reviewing logs, they realized that an exploit had occurred several months ago but had gone undetected. Because this is a ZK project that intentionally shields addresses and amounts, detection is very difficult. They identified the vulnerability the same day.

The system added a new type: gateway addresses in a recent change. This change allowed for plaintext amounts and asset IDs, unlike confidential inputs/outptus. The. output's asset ID is an elliptic curve point that must correspond to an asset already registered within the network. The new code didn't validate custom asset IDs being used.

In practice, this missing check allowed for a major violation in the math. Going backward, you could craft an arbitrary balance point with the invalid elliptic curve point. By doing this, you could trick the proof into evaluating as true while adding an unauthorized plaintext mint.

The attacker exploited this on August 29th for 18.4 million ZANO tokens. After this wasn't detected, they decided to do it twice more for the same amount of ZANO, and some fUSD. After discovering this, the network did a full-month reorg to undo the illegitimate funds being created. To my knowledge, this is the deepest (in terms of time) reorg that I've ever seen. Much of the attackers' funds got seeped into other users, so it would be hard to separate it now. Exchanges likely got F-ed hard by this.

Internal testing didn't find this bug. From the bug bounty, team review, AI auditing, and professional cryptographers, it was just missed. Most of the effort was spent on the spicy consensus proofs because it had much more complexity. The bug was in some code they assumed was secure but never verified as such.

The hacker got greedy, and the project rolled back everything. A crazy response to a crazy bug. If you don't know there's a vulnerability because it's ZK, how do you know you didn't get hacked? This worries me greatly!