V1 — Recovery Update

20 October 2026

The recovery transaction for the affected legacy V1 infrastructure and ZROWRNT token contract has been successfully executed on Ethereum. We have verified the resulting contract permissions, token balances, and dividend records on-chain.

The recovery was completed on 20 October 2026 at 18:10:35 UTC. View the recovery transaction on Etherscan.

The completed actions include:

• Revoking the attacker’s administrative and operational roles in the affected Service contract, and removing the additional unauthorized manager assignments. The team’s multisignature wallet is now the sole administrator of that contract.
• Burning all 2,995,629 ZROWRNT tokens originating from the unauthorized issuance: 2,720,629 from the primary attacker address and 275,000 from the secondary recipient address. Both addresses now have a zero ZROWRNT balance.
• Restoring the original token implementation and the selected contract settings covered by the recovery.
• Preserving the ZROWRNT balances of the three original holders, together with the existing dividend records and historical balance snapshots.

Checks against the resulting on-chain state confirmed that ZROWRNT transfers and dividend claims remain available. Certain legacy infrastructure functions remain disabled as part of the containment measures.

For context, this incident affected the legacy V1 token infrastructure, including the ZROWRNT contract deployed in 2024.

The company responsible for developing and supporting V1 has ceased operations. Development, maintenance, and technical support for V1 ended long before this incident. The deployed smart contracts have continued to operate on-chain and process scheduled distributions.

Based on our investigation to date, the attacker gained unauthorized access to one of the administrative keys used for the legacy infrastructure. This access was used to authorize malicious transactions that changed contract permissions and configuration. How that access was obtained remains under investigation. We currently suspect a compromise involving a hardware wallet, but the exact mechanism has not been confirmed.

The primary address used by the attacker was 0x5934FCD599EE6c38D8C80f4cC6ce303478098A04.

We have reported the incident to law enforcement and notified the relevant company.

The affected token had a configured maximum supply of 3 million tokens, with most of that issuance capacity still unused. Using the compromised administrative permissions, the attacker changed the address recognized by the system as an authorized vesting and minting source. This allowed them to mint 2,995,629 additional ZROWRNT tokens to their address within the existing supply cap.

The newly issued tokens were then included in the balance snapshots used to calculate subsequent dividend allocations. This gave those tokens a disproportionate share of distributions intended for legitimate holders. Two distribution cycles were affected. On-chain records confirm approximately 8,728.49 ZRO was paid out against balances originating from the unauthorized issuance, across claims made on 16 and 20 October.

On 17 October, 275,000 of the newly issued ZROWRNT tokens were transferred from the attacker’s address to a second address, 0x0304fb2dd0a0134684dd1ebee4f43eacbc96836a. That address subsequently claimed part of the second distribution. Its ownership has not been independently established.

The confirmed claim transactions are listed below. Dates and times are UTC; payout amounts are rounded to six decimal places.

• 16 October 2026, 00:26:23 — 4,364.242590 ZRO, paid to the primary attacker address, 0x5934…8A04.
• 20 October 2026, 03:43:11 — 3,963.603288 ZRO, paid to the same address, 0x5934…8A04.
• 20 October 2026, 03:43:35 — 400.639302 ZRO, paid to the secondary token recipient, 0x0304…836a.

These withdrawals took place before the recovery transaction was executed, while wallet access and the required multisignature approvals were being coordinated. Revoking permissions and burning the unauthorized tokens did not reverse those withdrawals or return the ZRO already paid out.

The recovery preserved legitimate holders’ token balances and the existing dividend records. It did not recalculate the historical allocations affected by the unauthorized issuance or compensate holders for the resulting shortfall. We are reconciling the affected distributions and legitimate holder entitlements, and will share a separate update on the verified impact and next steps for affected users.

We are sorry for the impact on holders and for the time the recovery process has taken. Thank you for your patience while the recovery was coordinated and verified.