Block Nexus 90

Isolated Recovery Complete – Counterfeit FLOW Recovered This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council. As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus. With the recovery complete, the Foundation has scheduled for tomorrow, Jan 13th, 2026 the removal of elevated access used by the Community Governance Council for recovery operations. This temporary emergency measure, deployed for the first time in Flow’s five-year history, was critical for this surgical recovery. It is important to remind everyone that any power given to and action taken by the Governance Council is fully transparent and auditable onchain. Furthermore, any changes to node software must be approved by a majority of network validators in order to proceed. Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026. In the interim, external legal counsel and forensic partners are coordinating with exchanges to assess user exposure. The Foundation is fully committed to cooperate with exchange partners to facilitate a prompt return to full functionality across every trading venue. Coinbase, Kraken, and Gate have already resumed their deposit and withdrawal services. We want to thank our community of believers, ecosystem partners, infrastructure providers, and the cooperative exchange teams who made this targeted and orderly recovery feasible. The surgical removal of the threat is complete, the network is restored, and Flow is ready to move forward stronger than before.

Flow Network Exploit Post-mortem
 On December 27, 2025, an attacker exploited a vulnerability in the Flow network to counterfeit tokens, extracting approximately $3.9 million USD across bridges. No existing user balances were accessed or compromised. The attack duplicated assets but did not touch legitimate holdings, with the vast majority of counterfeit assets being contained onchain or frozen by exchange partners before they could be liquidated. Network validators have ratified a decentralized governance action authorizing the permanent destruction of 100% of counterfeit assets. The network resumed operations on December 29th and is operating as expected​ with full transaction history preserved. Attack Vector The attack demonstrated significant technical sophistication. The attacker deployed over 40 malicious smart contracts in a coordinated sequence, exploiting a three-part attack chain:  1) Attachment import validation bypass 2) Circumvention of defensive checks on built-in types 3) Exploitation of contract initializer semantics.  The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), now patched (v1.8.9 and later). The flaw allowed the attacker to disguise a protected asset (which should be non-copyable) as a standard data structure (which can be copied), bypassing the runtime's safety checks and enabling token counterfeiting. Remediation Beyond bridging assets out of Flow, the attacker attempted to deposit counterfeit FLOW across several CEX, with many exchange partners freezing the deposits upon receipt due to the abnormal size and internal AML protocols. Approximately 50% of those counterfeit FLOW deposits have already been returned by cooperative exchange partners (OKX, Gate, MEXC) and destroyed, and the Foundation is actively coordinating with remaining exchanges. The network was restored on December 29, 2025, via an Isolated Recovery Plan that preserves all legitimate transaction history. This approach was selected following ecosystem-wide consultation with exchanges, bridge operators, and infrastructure partners. The Isolated Recovery Plan was chosen specifically to avoid reconciliation risk for off-chain custodial systems and cross-chain protocols maintaining independent state. The Foundation is cooperating with blockchain forensic partners including zeroShadow and Find Labs and relevant law-enforcement authorities to support ongoing investigations. Full technical details of the vulnerability, exploit mechanism, forensic analysis, and remediation architecture are linked in the comment.

Isolated Recovery Complete – Counterfeit FLOW Recovered This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council. As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus. With the recovery complete, the Foundation has scheduled for tomorrow, Jan 13th, 2026 the removal of elevated access used by the Community Governance Council for recovery operations. This temporary emergency measure, deployed for the first time in Flow’s five-year history, was critical for this surgical recovery. It is important to remind everyone that any power given to and action taken by the Governance Council is fully transparent and auditable onchain. Furthermore, any changes to node software must be approved by a majority of network validators in order to proceed. Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026. In the interim, external legal counsel and forensic partners are coordinating with exchanges to assess user exposure. The Foundation is fully committed to cooperate with exchange partners to facilitate a prompt return to full functionality across every trading venue. Coinbase, Kraken, and Gate have already resumed their deposit and withdrawal services. We want to thank our community of believers, ecosystem partners, infrastructure providers, and the cooperative exchange teams who made this targeted and orderly recovery feasible. The surgical removal of the threat is complete, the network is restored, and Flow is ready to move forward stronger than before.

Isolated Recovery Complete – Counterfeit FLOW Recovered This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council. As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus. With the recovery complete, the Foundation has scheduled for tomorrow, Jan 13th, 2026 the removal of elevated access used by the Community Governance Council for recovery operations. This temporary emergency measure, deployed for the first time in Flow’s five-year history, was critical for this surgical recovery. It is important to remind everyone that any power given to and action taken by the Governance Council is fully transparent and auditable onchain. Furthermore, any changes to node software must be approved by a majority of network validators in order to proceed. Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026. In the interim, external legal counsel and forensic partners are coordinating with exchanges to assess user exposure. The Foundation is fully committed to cooperate with exchange partners to facilitate a prompt return to full functionality across every trading venue. Coinbase, Kraken, and Gate have already resumed their deposit and withdrawal services. We want to thank our community of believers, ecosystem partners, infrastructure providers, and the cooperative exchange teams who made this targeted and orderly recovery feasible. The surgical removal of the threat is complete, the network is restored, and Flow is ready to move forward stronger than before.

Isolated Recovery Complete – Counterfeit FLOW Recovered This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council. As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus. With the recovery complete, the Foundation has scheduled for tomorrow, Jan 13th, 2026 the removal of elevated access used by the Community Governance Council for recovery operations. This temporary emergency measure, deployed for the first time in Flow’s five-year history, was critical for this surgical recovery. It is important to remind everyone that any power given to and action taken by the Governance Council is fully transparent and auditable onchain. Furthermore, any changes to node software must be approved by a majority of network validators in order to proceed. Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026. In the interim, external legal counsel and forensic partners are coordinating with exchanges to assess user exposure. The Foundation is fully committed to cooperate with exchange partners to facilitate a prompt return to full functionality across every trading venue. Coinbase, Kraken, and Gate have already resumed their deposit and withdrawal services. We want to thank our community of believers, ecosystem partners, infrastructure providers, and the cooperative exchange teams who made this targeted and orderly recovery feasible. The surgical removal of the threat is complete, the network is restored, and Flow is ready to move forward stronger than before.

Isolated Recovery Complete – Counterfeit FLOW Recovered This morning, the final recovery of outstanding counterfeit FLOW from remaining centralized exchanges, including Binance and HTX, was executed by the Community Governance Council. As of today, all counterfeit FLOW traced by forensic firms has been successfully recovered and is now isolated and restricted on-chain pending destruction. This marks the conclusion of Phase 4 of the Isolated Recovery Plan, fulfilling the mandate ratified by the validator network via super-majority consensus. With the recovery complete, the Foundation has scheduled for tomorrow, Jan 13th, 2026 the removal of elevated access used by the Community Governance Council for recovery operations. This temporary emergency measure, deployed for the first time in Flow’s five-year history, was critical for this surgical recovery. It is important to remind everyone that any power given to and action taken by the Governance Council is fully transparent and auditable onchain. Furthermore, any changes to node software must be approved by a majority of network validators in order to proceed. Permanent destruction of counterfeit tokens is scheduled for January 30th, 2026. In the interim, external legal counsel and forensic partners are coordinating with exchanges to assess user exposure. The Foundation is fully committed to cooperate with exchange partners to facilitate a prompt return to full functionality across every trading venue. Coinbase, Kraken, and Gate have already resumed their deposit and withdrawal services. We want to thank our community of believers, ecosystem partners, infrastructure providers, and the cooperative exchange teams who made this targeted and orderly recovery feasible. The surgical removal of the threat is complete, the network is restored, and Flow is ready to move forward stronger than before.

Flow Network Exploit Post-mortem
 On December 27, 2025, an attacker exploited a vulnerability in the Flow network to counterfeit tokens, extracting approximately $3.9 million USD across bridges. No existing user balances were accessed or compromised. The attack duplicated assets but did not touch legitimate holdings, with the vast majority of counterfeit assets being contained onchain or frozen by exchange partners before they could be liquidated. Network validators have ratified a decentralized governance action authorizing the permanent destruction of 100% of counterfeit assets. The network resumed operations on December 29th and is operating as expected​ with full transaction history preserved. Attack Vector The attack demonstrated significant technical sophistication. The attacker deployed over 40 malicious smart contracts in a coordinated sequence, exploiting a three-part attack chain:  1) Attachment import validation bypass 2) Circumvention of defensive checks on built-in types 3) Exploitation of contract initializer semantics.  The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), now patched (v1.8.9 and later). The flaw allowed the attacker to disguise a protected asset (which should be non-copyable) as a standard data structure (which can be copied), bypassing the runtime's safety checks and enabling token counterfeiting. Remediation Beyond bridging assets out of Flow, the attacker attempted to deposit counterfeit FLOW across several CEX, with many exchange partners freezing the deposits upon receipt due to the abnormal size and internal AML protocols. Approximately 50% of those counterfeit FLOW deposits have already been returned by cooperative exchange partners (OKX, Gate, MEXC) and destroyed, and the Foundation is actively coordinating with remaining exchanges. The network was restored on December 29, 2025, via an Isolated Recovery Plan that preserves all legitimate transaction history. This approach was selected following ecosystem-wide consultation with exchanges, bridge operators, and infrastructure partners. The Isolated Recovery Plan was chosen specifically to avoid reconciliation risk for off-chain custodial systems and cross-chain protocols maintaining independent state. The Foundation is cooperating with blockchain forensic partners including zeroShadow and Find Labs and relevant law-enforcement authorities to support ongoing investigations. Full technical details of the vulnerability, exploit mechanism, forensic analysis, and remediation architecture are linked in the comment.