Flow Advances $3.9M Recovery Efforts Amid Exchange Concerns

The Flow Foundation has kicked off the second phase of its recovery process after a $3.9 million exploit that disrupted its network late last month. This development raises new worries about how a centralized exchange managed substantial token movements linked to the incident.

Key Takeaways

Flow Foundation moved into the second phase of a recovery effort after a $3.9 million exploit.
EVM functionality restoration is progressing alongside repairs to the Cadence environment.
Fraudulent tokens affected 1,500 accounts, with a focus on cleanup while preserving legitimate transactions.
Concerns arise regarding a centralized exchange's handling of the exploit-related token movements.
The FLOW token's value dropped significantly amidst ongoing market uncertainty.

In a Thursday update, Flow announced that it has made "significant progress" on its remediation strategy and is now entering the second phase of recovery, which is projected to take several days.

The foundation mentioned that its developers have found a method to restore Ethereum Virtual Machine (EVM) functionality simultaneously with ongoing improvements to Flow’s native Cadence environment.

Flow Resumes Block Production on Path to Full Recovery

Flow indicated that the EVM network could be operational within 24 hours, assuming no unexpected challenges arise.

Block production has already resumed, with the most recent block timestamped at 09:30:50 UTC on January 2, 2026.

Flow Resumes Block Production

Cadence-based transactions are currently being processed, while verification for the wallets affected by the exploit continues.

Flow has stated that fraudulent tokens are being eliminated through on-chain transactions that are independently verifiable. Furthermore, over 99.9% of accounts are anticipated to regain full access once EVM functionality is restored.

The exploit took place on December 27, when a hacker exploited a vulnerability in Flow's execution layer to create and distribute counterfeit tokens, transferring approximately $3.9 million in assets across different bridges before validators halted the network.

Investigators subsequently identified the attacker’s Ethereum wallet and monitored attempts to launder the stolen funds via cross-chain protocols, leading to freeze requests directed at major exchanges and stablecoin providers.

Initially, Flow's developers recommended rolling back the chain to a checkpoint prior to the exploit. However, this suggestion faced significant criticism from bridge operators and ecosystem partners, who cautioned that it could result in accounting inconsistencies and disproportionately impact third parties.

Flow Revises Strategy Following Criticism

In response to the backlash, the foundation launched a new plan aimed at isolating and destroying illicit tokens while safeguarding legitimate transactions.

Under the new plan, the network resumed operations from the last sealed block preceding the halt, without reorganizing the chain. Approximately 1,500 Cadence accounts that received fraudulent tokens were temporarily restricted during the remediation process.

Flow Revises Strategy

Flow reported that most of these accounts have minimal or no previous activity and are expected to be restored quickly once the illegal balances are eliminated. Validators have approved a temporary software upgrade that grants extended permissions to facilitate the cleanup, with these permissions anticipated to be revoked upon completion of the remediation.

In its post-mortem evaluation, Flow also highlighted concerning activities on a centralized exchange whose name hasn’t been disclosed.

The foundation claims that within hours of the exploit, a single account deposited around 150 million FLOW tokens—approximately 10% of the total supply—converted a significant amount into Bitcoin, and withdrew over $5 million before the network was shut down.

Flow criticized the exchange for its lack of response to inquiries regarding the trading activities, describing the incident as an apparent lapse in AML (anti-money laundering) and KYC (know your customer) practices, which shifted risk onto users who inadvertently acquired fraudulent tokens.

While Flow did not explicitly name the exchange, some users have speculated that it could involve Binance.

Market data reflects that the aftermath of the incident continues to impact Flow’s DeFi ecosystem, with the total value locked (TVL) on the network dropping 12% within the last 24 hours to around $72.1 million, down from roughly $102 million on December 31.

Impact on Flow's DeFi Ecosystem

Currently, the FLOW token is trading at $0.081, marking a 53.3% decline over the past week as uncertainty looms, with some exchanges temporarily suspending deposits and withdrawals.