شبكة Flow تتعرض لهجوم من ثغرة في آلة افتراضية Cadence: تم تزوير 879 مليار FLOW، وتم تجميد 98.7% من الأصول غير القانونية

【BitTui】Flow network experienced a serious security incident on December 27, 2025. Attackers exploited a type confusion vulnerability in the Cadence virtual machine to construct a complex “three-part vulnerability chain” that broke through the resource linearity guarantee mechanism, ultimately achieving illegal duplication by disguising resource objects as structs. The scope of this attack was quite extensive—attackers created a total of 87.96 billion FLOW tokens and various other assets.

How severe was the economic damage? Approximately $3.9 million directly evaporated, with funds flowing to other networks through cross-chain bridges including Celer and deBridge. Among them, 1.094 billion FLOW tokens were transferred to centralized exchanges, which should have been the highest-risk portion. Fortunately, Flow’s validator team responded quickly and immediately halted operations in response. They also collaborated closely with leading exchanges including OKX, Gate.io, and MEXC to freeze illegal assets on-chain and on exchanges. The final result was: 98.7% of illegal assets were successfully frozen, with approximately 484 million FLOW tokens destroyed.

The network restarted on December 29 through an “isolated recovery plan,” comprehensively deploying patches including parameter validation, runtime checks, and contract deployment logic. This incident serves as another reminder that even well-known public chains need to continuously strengthen their security defenses.