Flow Releases Technical Review Report on Security Incident

The Flow network suffered an attack targeting a Cadence virtual machine type confusion vulnerability, resulting in the illegal minting of tokens. The attacker exploited a complex "three-part vulnerability chain" to bypass resource linearity guarantees, disguising resource objects as structs for duplication. The incident caused an actual economic loss of approximately $3.9 million, with funds having been transferred out via cross-chain bridges such as Celer and deBridge.

According to Flow monitoring, the attacker created a total of 8.796 billion FLOW and multiple other tokens, among which 1.094 billion FLOW were transferred to centralized exchanges. Thanks to validators shutting down in time and cooperating with certain exchanges, about 98.7% of the illicit assets have been frozen on-chain or at exchanges, and approximately 484 million FLOW have been destroyed. The network was restored on December 29 through an "isolation recovery plan," and a comprehensive patch covering parameter validation, runtime checks, and contract deployment logic has now been deployed.