Incident Overview
On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer and moved approximately $3.9 million in assets off-network through various bridges to Ethereum before validators executed a coordinated network halt. Critically, the exploit did not access or affect existing user balances, with all user deposits remaining intact, and the attacker is actively laundering funds through Thorchain and Chainflip privacy protocols while freeze requests have been submitted to major exchanges and stablecoin issuers.
The attacker exploited a vulnerability in Flow's execution layer and systematically moved assets off-network through multiple bridge protocols including Celer Bridge (297.69 ETH), Debridge (479.35 ETH including USDC conversions), direct withdrawals to Binance (109.19 ETH), Relay Bridge (39.44 ETH), and Stargate (9.98 ETH), along with 9.8 WBTC (~$930K) and 339K PYUSD (converted to ~261 ETH). All exit transactions were routed through the attacker's Ethereum wallet (0x2e7C4b71…F994e1) before validators executed a coordinated network halt that severed all exit paths and prevented further unauthorized activity. The attacker immediately began laundering the stolen funds by converting ETH to BTC through Thorchain (approximately 785 ETH across multiple transactions) and Chainflip (approximately 567.56 ETH), while the Flow Foundation's security team engaged forensic partners, law enforcement, and submitted freeze requests to Circle, Tether, Binance, Coinbase, and Kraken.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Flow Network, these are the critical security checks that could have prevented this incident (December 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Flow Network
The Flow Network hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.