TLDR
- The Flow network resumes block production and estimates EVM functionality restoration within 24 hours.
- The Flow Foundation ruled out a massive rollback following criticism, opting instead for a targeted cleanup of illicit tokens.
- An unidentified exchange allowed the withdrawal of $5 million in BTC linked to the attacker before the network halt.
The Flow Foundation has announced progress in its response strategy following the security incident suffered in late 2025. Currently, the Flow network recovery has entered its second stage, focusing on restoring Ethereum Virtual Machine (EVM) functionality and the surgical cleanup of fraudulent assets.
The exploit occurred on December 27, when a hacker exploited a vulnerability in the execution layer to mint illicit tokens, moving approximately $3.9 million across various bridges.
Although a “rollback” (chain reversion) was initially proposed, strong opposition from bridge operators led the foundation to opt for a solution that preserves the integrity of legitimate transactions while removing fraudulent balances on-chain.
Security Failures and Negligence in Centralized Platforms
A critical point in this Flow network recovery process is the performance of centralized exchanges. The foundation reported that an unidentified platform allowed a single account to deposit 150 million FLOW (10% of the total supply) to convert it into Bitcoin and withdraw more than $5 million before the network was halted.
This event has been labeled a serious failure in Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols.
While block production has resumed, Flow’s DeFi ecosystem has suffered a significant impact. The Total Value Locked (TVL) fell 12% in the last 24 hours, standing at $72.1 million—far from the $102 million recorded before the attack.
In summary, the Flow network recovery also faces a complex market landscape. The native FLOW token is currently trading at $0.081, representing a drop of over 53% in the last week.
The community remains watchful for the full restoration of the Cadence environment and the revocation of temporary software upgrade permissions once the remediation is successfully completed.
