Flow Foundation: $3.9 Million Assets Outflow Due to Exploited Vulnerability, Network Rolled Back and Restart Postponed

In a recent update, Flow Foundation confirmed that on December 27, 2025, attackers exploited a vulnerability in the Flow protocol to transfer approximately $3.9 million assets off-chain before validators coordinated a shutdown. The foundation emphasized that this incident did not affect any user balances, and all user deposits remain intact. The outflow funds were primarily transferred through a cross-chain bridge, with the attacker's address identified and flagged. Money laundering paths are being actively tracked, and freeze requests have been submitted to Circle, Tether, and major exchanges.

The foundation stated that the network has been isolated, a fix for the vulnerability has been released and is in the verification and deployment phase. To remove unauthorized transactions, the network will roll back to a checkpoint before the attack occurred, and legitimate transactions made during this period will need to be resubmitted after the restart. Due to feedback from validators and ecosystem partners, the foundation has decided to extend the coordination time to ensure network consensus and long-term security, and will not rush to restart until full consensus is reached. User funds remain secure throughout the process, and updates will continue to be released according to the established timeline.

Previous report: deBridge Co-founder: Hasty Rollback of Flow May Pose Greater Systemic Risks

Related Articles