Mạng Flow gặp phải cuộc tấn công lỗ hổng của máy ảo Cadence: 87.9 tỷ FLOW bị giả mạo, 98.7% tài sản bất hợp pháp đã bị phong tỏa

【Bitpush】Flow network experienced a serious security incident on December 27, 2025. Attackers exploited a type confusion vulnerability in the Cadence virtual machine, constructing a complex “three-part vulnerability chain” to breach the resource linearity guarantee mechanism, ultimately achieving illegal duplication by disguising resource objects as structs. The scope of this attack was considerable—attackers created a total of 87.96 billion FLOW tokens and various other assets.

How severe was the economic loss? Approximately $3.9 million directly evaporated, with funds flowing to other networks through cross-chain bridges like Celer and deBridge. Among these, 1.094 billion FLOW tokens were transferred to centralized exchanges, which should have been the highest-risk portion. Fortunately, Flow’s validator team responded swiftly and immediately halted operations. They also collaborated closely with leading exchanges including OKX, Gate.io, and MEXC to freeze illegal assets both on-chain and on exchanges. The final result: 98.7% of illegal assets were successfully frozen, and approximately 484 million FLOW tokens were destroyed.

The network restarted on December 29 through an “isolation recovery plan,” comprehensively deploying patches including parameter validation, runtime checks, and contract deployment logic. This incident once again reminds us that even well-known public chains need to continuously strengthen their security defenses.