[Flow Foundation Confirms Exploitation of Vulnerability, Approximately $3.9 Million in Assets Outflowed]
The Flow Foundation released an update stating that on December 27, 2025, attackers exploited a vulnerability in the Flow execution layer, transferring approximately $3.9 million in assets off-chain before validator coordination shutdown. The foundation emphasized that this incident did not affect user balances, and user deposits remain intact. The outflowed funds were primarily transferred via cross-chain bridges. The attacker’s address has been flagged, the laundering path is being tracked, and freeze requests have been submitted to Circle, Tether, and major exchanges. The network has been isolated, and the vulnerability fix is in the verification and deployment stage. The network will roll back to a checkpoint prior to the attack, and legitimate transactions will need to be resubmitted after the restart. The foundation has decided to extend the coordination period to ensure network-wide consensus and security. The restart time is yet to be determined, and user funds remain unaffected.