How much was lost in the Flow hack?

The Flow hack resulted in $3.9M in losses on December 27, 2025.

What attack technique was used in the Flow exploit?

The Flow exploit utilized mint-and-dump Hack. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Flow Hack

TOTAL LOST $3.9M

Medium Dec 27, 2025 mint-and-dump Hack flow

Affected Chain flow Incident surface

Recovered - No recovery reported

All-Time Rank #489 By amount stolen

Protocol Type Chain Target category

Incident Overview

Launch frictionless Web3 apps with low fees and instant transactions

Incident Report

Protocol / Project Flow

Date of Incident December 27, 2025

Affected Chain(s) flow

Attack Technique mint-and-dump Hack

Classification Protocol Logic

Primary Source View Post-Mortem

Protocol Information

Protocol Type Chain

Smart Contract Language Solidity

Official Website flow.com

Protocol Twitter/X @flow_blockchain

Market Context at Time of Hack

Token Price at Hack $0.1725

Market Cap at Hack $281.5M

% of Market Cap Stolen 1.39%

Token Categories

Smart Contract Platform Sports NFT Layer 1 (L1) Animoca Brands Portfolio Alleged SEC Securities Multicoin Capital Portfolio Proof of Stake (PoS)

Protocol Links

GitHub Discord Telegram

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of mint-and-dump hack and Solidity and EVM internals

Capital Required Seed capital to cover gas and initial position setup

On-Chain Access Ability to interact with flow smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Flow's contract logic - root cause: protocol logic

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough mint-and-dump Hack audit checklist and test coverage

If you're auditing a protocol with similar architecture to Flow, these are the critical security checks that could have prevented this incident (December 2025).

Verify all logic paths related to mint-and-dump Hack are guarded by proper access controls and input validation
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Sources & References

01
Source 1 https://x.com/flow_blockchain/status/2005021612714668518

Threat Assessment

Severity Level

MEDIUM

Attack Vector mint-and-dump Hack
Root Cause Protocol Logic
Year 2025

Learn to Prevent the Next Flow

The Flow hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library