Flow Foundation Advances Phase Two Recovery Following $3.9 Million December Exploit with Exchange Risks Highlighted
Flow Foundation has moved into Phase Two of its recovery efforts following a $3.9 million exploit that occurred in late December 2025. The remediation in this phase is expected to take several days as the team works to resolve the aftermath of the incident.
The Foundation is accelerating the restoration of Ethereum Virtual Machine (EVM) functionality by identifying a parallel path that allows EVM restoration to proceed alongside Cadence fixes. A return of EVM functionality is anticipated within 24 hours of the latest announcement.
Network block production has resumed with the latest block timestamp recorded at 09:30:50 UTC on January 2, 2026. Cadence-based transactions are currently processing, and wallets are undergoing on-chain verification to address affected accounts.
The remediation efforts are focused on removing illicit tokens from the blockchain. Approximately 1,500 Cadence accounts that received fraudulent tokens were temporarily restricted, and remediation transactions are underway. Validators have been granted elevated permissions to facilitate cleanup, which will be revoked after the process completes. The Foundation expects that over 99.9% of accounts will retain full access once EVM functionality is restored.
Concerns have been raised regarding an unnamed centralized exchange that exhibited suspicious activity shortly after the exploit. Within hours, around 150 million FLOW tokens, representing roughly 10% of the total supply, were deposited into BTC, and more than $5 million was withdrawn. The exchange has not responded to anti-money laundering (AML) or know-your-customer (KYC) requests. While Binance has been speculated as the exchange involved, this has not been confirmed.
The exploit on December 27 took advantage of a vulnerability in Flow's execution layer to mint and distribute fraudulent tokens across various bridges. This prompted validators to halt the chain initially and consider a rollback, before pivoting to targeted token cleanup.
The incident has had a notable market impact, with Flow's total value locked (TVL) dropping 12% to about $72.1 million from approximately $102 million on December 31. The FLOW token price declined by 53.3% over the last seven days, trading at $0.081 amid exchange pause notices and ongoing uncertainty in the market.
