Flow vs Monad TPS Showdown
https://x.com/DiamondNFL/status/1998464015585128592?s=20

This is the verified update from the Flow Foundation.

INCIDENT CONFIRMED

On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer and moved approximately $3.9M in assets off-network before validators executed a coordinated halt.

Critically, this exploit did not access existing user balances. All user deposits remain intact.

The Foundation's security team has mapped the exit path. Current status:

CONFIRMED FUNDS EXITED TO DATE: ~$3.9M
→ Primarily routed through bridges (Celer, Debridge, Relay, Stargate)
→ Attacker wallet identified and flagged
→ Active laundering via Thorchain/Chainflip being tracked in real-time
→ Freeze requests submitted to Circle, Tether, and major exchanges
→ Forensic analysis ongoing

CONTAINMENT: Complete
→ Network halt severed all exit paths
→ No further unauthorized activity possible
→ Remediation in progress

The confirmed funds exited represent a manageable amount that does not
threaten network solvency or user funds. The immediate priority is
remediation and safe restart.

RESTART TIMELINE

The protocol fix has been developed and is entering final validation.

→ Target restart: Within 4-6 hours, pending successful testnet validation
→ Next status update: Within 2 hours
→ Full technical post-mortem: Within 72 hours

The network will not be restarted until the fix has been fully validated.
The Foundation will provide updates every 2 hours until restart is complete.

Find Labs is publishing the Foundation's forensic data below, including transaction hashes and the attacker's Ethereum wallet.

The Foundation thanks the community for its patience during the investigation.
https://x.com/findlabs/status/2005021008156078274?s=20

UPDATE: FLOW NETWORK IS LIVE

CURRENT STATUS:

✅ Cadence environment: Operational
✅ Network producing blocks and processing transactions
✅ Over 99.9% of accounts: Full functionality restored
🔄 EVM environment: Temporarily restricted (read-only mode)
🔄 Suspected impacted accounts: Temporarily restricted pending remediation

Please see the full announcement here:

https://x.com/flow_blockchain/status/2005655108558991606?s=20

UPDATE: CADENCE CLEANUP INITIATED

Flow Foundation has begun to unrestrict affected accounts and will begin fraudulent token remediation today.

CURRENT STATUS:
✅ Cadence environment: Operational and processing transactions
✅ Phase 2 cleanup: In progress
✅ Account restoration: Temporarily restricted accounts have begun to be unrestricted, with more coming throughout the day
🔄 Fraudulent token remediation: Commencing today via transparent and auditable on-chain transactions
⏳ EVM environment: Temporarily restricted (read-only mode, Forensic analysis ongoing)

Read the full update here:

https://x.com/flow_blockchain/status/2006024885727093009?s=20

Flow Network Update: Flow EVM Back Online

Flow is now fully operational. 

The network is secure and processing transactions across both the Cadence and EVM execution environments.

This milestone marks the completion of one of the most complex recovery operations in blockchain history. What was initially projected as a sequential, multi-day process has been executed in parallel, restoring both Cadence and EVM functionality while maintaining surgical precision in removing fraudulent assets and preserving legitimate transaction history.

- Bridges and DEXes (KittyPunch, IncrementFi) are resuming normal operations today.

- Kraken has already returned to normal operations, and other cooperative centralized exchanges will be resuming services soon

A comprehensive technical post-mortem detailing the complete attack vector, forensic analysis, and remediation approach, will be published within 48 hours.

Thank you to the entire Flow community for your patience, support, and understanding.

Read the official update: https://x.com/flow_blockchain/status/2007125204603150660?s=46&t=t9o3dswTynPR1dy0Xsb-7Q

Flow Network Exploit Post-mortem

On December 27, 2025, an attacker exploited a vulnerability in the Flow network to counterfeit tokens, extracting approximately $3.9 million USD across bridges. No existing user balances were accessed or compromised. The attack duplicated assets but did not touch legitimate holdings, with the vast majority of counterfeit assets being contained onchain or frozen by exchange partners before they could be liquidated. Network validators have ratified a decentralized governance action authorizing the permanent destruction of 100% of counterfeit assets. The network resumed operations on December 29th and is operating as expected​ with full transaction history preserved.

The attack demonstrated significant technical sophistication. The attacker deployed over 40 malicious smart contracts in a coordinated sequence, exploiting a three-part attack chain. The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), now patched (v1.8.9 and later). The flaw allowed the attacker to disguise a protected asset (which should be non-copyable) as a standard data structure (which can be copied), bypassing the runtime's safety checks and enabling token counterfeiting.

Full technical details of the vulnerability, exploit mechanism, forensic analysis, and remediation architecture are found on the latest Flow post in the below link:
🔗 https://x.com/flow_blockchain/status/2008612688755130840

All Remaining Counterfeit FLOW Has Been Recovered

This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council.
As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus.

Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026.

See the official post on X for more details: https://x.com/flow_blockchain/status/2010815968352878996