Flow network suffers Cadence virtual machine vulnerability attack: 87.9 billion FLOW forged, 98.7% of illegal assets already frozen

【BitPush】The Flow network experienced a serious security incident on December 27, 2025. Attackers exploited a type confusion vulnerability in the Cadence virtual machine to construct a complex “three-part vulnerability chain” to break through the resource linear guarantee mechanism, ultimately achieving illegal copying by disguising resource objects as structures. The scope of this attack was quite broad—the attackers created a total of 87.96 billion FLOW tokens and various other assets.

How severe was the economic loss? Approximately $3.9 million was directly evaporated, and funds flowed to other networks through cross-chain bridges such as Celer and deBridge. Among them, 1.094 billion FLOW tokens were transferred to centralized exchanges, which should have been the riskiest part. Fortunately, Flow’s validator team responded quickly and immediately shut down the network. They also worked closely with leading exchanges like OKX, Gate.io, and MEXC to freeze illegal assets on-chain and on exchanges. The final result was: 98.7% of the illegal assets were successfully frozen, and about 484 million FLOW tokens were destroyed.

The network was restarted on December 29 through an “Isolation Recovery Plan,” deploying patches that included parameter validation, runtime checks, and contract deployment logic. This incident also serves as a reminder that even well-known public chains need to continuously strengthen their security defenses.