Flow Network Hack

On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer and moved approximately $3.9 million in assets off-network through various bridges to Ethereum before validators executed a coordinated network halt. Critically, the exploit did not access or affect existing user balances, with all user deposits remaining intact, and the attacker is actively laundering funds through Thorchain and Chainflip privacy protocols while freeze requests have been submitted to major exchanges and stablecoin issuers.

The attacker exploited a vulnerability in Flow's execution layer and systematically moved assets off-network through multiple bridge protocols including Celer Bridge (297.69 ETH), Debridge (479.35 ETH including USDC conversions), direct withdrawals to Binance (109.19 ETH), Relay Bridge (39.44 ETH), and Stargate (9.98 ETH), along with 9.8 WBTC (~$930K) and 339K PYUSD (converted to ~261 ETH). All exit transactions were routed through the attacker's Ethereum wallet (0x2e7C4b71…F994e1) before validators executed a coordinated network halt that severed all exit paths and prevented further unauthorized activity. The attacker immediately began laundering the stolen funds by converting ETH to BTC through Thorchain (approximately 785 ETH across multiple transactions) and Chainflip (approximately 567.56 ETH), while the Flow Foundation's security team engaged forensic partners, law enforcement, and submitted freeze requests to Circle, Tether, Binance, Coinbase, and Kraken.

Exploiter:

0x2e7C4b71…F994e1