Сеть Flow подверглась атаке с использованием уязвимости виртуальной машины Cadence: 87,9 миллиарда FLOW были подделаны, 98,7% незаконных активов уже заморожены

【BitTui】Flow network experienced a serious security incident on December 27, 2025. Attackers exploited a type confusion vulnerability in the Cadence virtual machine, constructing a complex “three-part vulnerability chain” to breach the resource linearity guarantee mechanism, ultimately achieving illegal duplication by disguising resource objects as structs. The impact scope of this attack was considerable — attackers generated a total of 87.96 billion FLOW tokens along with various other assets.

How severe was the economic damage? Approximately 3.9 million dollars directly evaporated, with funds flowing to other networks through cross-chain bridges like Celer and deBridge. Among these, 1.094 billion FLOW tokens were transferred to centralized exchanges, which should have been the highest-risk component. Fortunately, Flow’s validator team responded swiftly and immediately halted operations. They also collaborated closely with leading exchanges including OKX, Gate.io, and MEXC to freeze illegal assets on-chain and on exchanges. The final result: 98.7% of illegal assets were successfully frozen, with approximately 484 million FLOW tokens destroyed.

The network restarted on December 29 through an “isolation recovery plan,” comprehensively deploying patches including parameter validation, runtime checks, and contract deployment logic. This incident serves as yet another reminder that even well-known public chains need to continuously strengthen their security defenses.