What happened
On December 27, 2025, Flow reported that an attacker exploited a type-confusion vulnerability in its Cadence runtime to counterfeit fungible-token resources. Flow says approximately 3.9 million dollars in value was successfully bridged off-network before validators halted transaction ingestion; legitimate user balances were not accessed.
How it happened
- The attacker deployed malicious contracts and crafted malformed transaction arguments to bypass Cadence runtime validation.
- The exploit made a protected move-only resource appear statically as a copyable value while it executed as a resource.
- This bypassed resource-linearity checks and duplicated fungible-token resources without using ordinary mint logic.
- Counterfeit assets were transferred to exchanges and bridged through Celer, deBridge, and Stargate before validators halted ingestion.
- Flow patched the runtime and used a governance-authorized recovery plan to isolate and destroy counterfeit assets.
Protocol details
Classification
Other / Protocol Logic / Token & Share Accounting
Protocol Type
Chain
Implementation language
Solidity
Protocol links
Website
@flow_blockchain
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
