This is the verified update from the Flow Foundation.

INCIDENT CONFIRMED

On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer and moved approximately $3.9M in assets off-network before validators executed a coordinated halt.

Critically, this exploit did not access existing user balances. All user deposits remain intact.

The Foundation's security team has mapped the exit path. Current status:

CONFIRMED FUNDS EXITED TO DATE: ~$3.9M
→ Primarily routed through bridges (Celer, Debridge, Relay, Stargate)
→ Attacker wallet identified and flagged
→ Active laundering via Thorchain/Chainflip being tracked in real-time
→ Freeze requests submitted to Circle, Tether, and major exchanges
→ Forensic analysis ongoing

CONTAINMENT: Complete
→ Network halt severed all exit paths
→ No further unauthorized activity possible
→ Remediation in progress

The confirmed funds exited represent a manageable amount that does not
threaten network solvency or user funds. The immediate priority is
remediation and safe restart.

RESTART TIMELINE

The protocol fix has been developed and is entering final validation.

→ Target restart: Within 4-6 hours, pending successful testnet validation
→ Next status update: Within 2 hours
→ Full technical post-mortem: Within 72 hours

The network will not be restarted until the fix has been fully validated.
The Foundation will provide updates every 2 hours until restart is complete.

Find Labs is publishing the Foundation's forensic data below, including transaction hashes and the attacker's Ethereum wallet.

The Foundation thanks the community for its patience during the investigation.
https://x.com/findlabs/status/2005021008156078274?s=20