[Flow Execution Layer Attacked, Approximately $3.9 Million in Assets Drained]
Flow's official account stated on the X platform that on December 27, 2025, attackers exploited a vulnerability in the Flow execution layer to transfer approximately $3.9 million in assets before the network shutdown. Existing user balances were not accessed, and user deposits remain secure. The funds were primarily drained through bridges such as Celer, Debridge, Relay, and Stargate. The attacker's wallet has been identified and flagged, and their laundering activities via Thorchain and Chainflip are being tracked in real-time. The Flow Foundation has submitted freeze requests to Circle, Tether, and major exchanges. The network has been halted to cut off exit routes, and a fix is in the final stages of validation, with a target restart time of 4 to 6 hours. FindLabs has released forensic data, including transaction hashes and the attacker's Ethereum wallet address.