Find Labs

FLOW NETWORK INCIDENT: Forensic Fund Tracking Report FindLabs is publishing the following analysis in collaboration with the Flow Foundation's security and engineering teams, who conducted the primary forensic investigation. • INCIDENT CONFIRMATION On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer. The attacker then moved assets off-network — primarily through bridges to Ethereum — before validators executed a coordinated network halt. Confirmed funds exited to date total approximately $3.9M, with forensic analysis ongoing. Critically, this exploit did not access or affect existing user balances. All user deposits remain intact. The vulnerability has been identified and isolated. A full technical post-mortem will be published within 72 hours. • ATTACKER WALLET (ETHEREUM) 0x2e7C4b71397f10c93dC0C2ba6f8f179a47F994e1 All confirmed exit transactions route through this address. Freeze requests have been submitted to exchanges and stablecoin issuers. • CONFIRMED EXIT TRANSACTIONS The following exit paths have been identified and verified. Confirmed funds exited to date: ~$3.9M USD equivalent. Forensic analysis is ongoing and this report will be updated as additional transactions are identified. CELER BRIDGE — 297.69 ETH - 74.422 ETH — etherscan.io/tx/0xbf3f95b0f… - 74.422 ETH — etherscan.io/tx/0xe6f55f204… - 74.422 ETH — etherscan.io/tx/0x106b8db43… - 74.422 ETH — etherscan.io/tx/0x9d6684f6f… DEBRIDGE — 479.35 ETH (includes USDC conversions) - 49.359 ETH — etherscan.io/tx/0x2d347295a… - 151.781 ETH — etherscan.io/tx/0x1eae85eed… - 123.30 ETH — etherscan.io/tx/0x3b5671861… - 14.932 ETH — etherscan.io/tx/0x9d6684f6f… - [+ 10 additional transactions ranging 11-17 ETH each] DIRECT WITHDRAWALS — 109.19 ETH - 90.299 ETH (Binance) — etherscan.io/tx/0xcf20b2c7f… - 18.89 ETH (Binance) — etherscan.io/tx/0x6e5b6fb95… RELAY BRIDGE — 39.44 ETH - 39.44 ETH — etherscan.io/tx/0x6bc988300… STARGATE — 9.98 ETH - 4.99 ETH — etherscan.io/tx/0x22a55360d… - 4.99 ETH — etherscan.io/tx/0x4378c6988… WBTC — 9.8 WBTC (~$930K) - 4.9 WBTC — etherscan.io/tx/0xe00dee9da… - 4.9 WBTC — #tokentxns" target="_blank" rel="nofollow noopener">etherscan.io/address/0x2e7c… PYUSD — 339K PYUSD (converted to ~261 ETH) - 279K PYUSD — etherscan.io/tx/0x52580ac81… - 60K PYUSD — etherscan.io/tx/0xeb3f5cf06… • ACTIVE LAUNDERING DETECTED The attacker is actively attempting to launder funds through privacy-preserving protocols: THORCHAIN (ETH → BTC conversion) - 250 ETH — etherscan.io/txs?a=0x2e7c4b… - 248 ETH — etherscan.io/tx/0x83099b48a… - 287 ETH — etherscan.io/tx/0x82276037a… CHAINFLIP (ETH → BTC conversion) - 50.6 ETH — etherscan.io/tx/0x74330ac39… - 258.14 ETH — etherscan.io/tx/0x6d250dc07… - 258.82 ETH — etherscan.io/tx/0x3c18a6daf… • CONTAINMENT STATUS ✅ Flow network halted — no further unauthorized activity possible ✅ Exit transactions identified to date mapped above ✅ Freeze requests submitted to Circle, Tether, Binance, Coinbase, Kraken ✅ Forensic partners and law enforcement engaged ✅ User funds unaffected — exploit did not access existing balances • NEXT STEPS The protocol fix has been developed and is entering final validation. → Target restart: Within 4-6 hours, pending successful testnet validation → Next status update from Flow Foundation: Within 2 hours → Full technical post-mortem: Within 72 hours This report will be updated as fund movement continues.

@SAPNFTBULL @JcyzJeffrey @flow_blockchain This is a great question, one that we are just as keen to have answered. Currently, our role has been to assist in the investigation and ensure the continued operation of vital infrastructure. No doubt that will be dealt with in tandem with this.

@JcyzJeffrey @findlabs @flow_blockchain Still crickets on this

Very pleased to see this. A remarkably expeditious feat pulled together by a whole community of people. Very hard to take positives from things like this, but we can certainly take heart from the Herculean effort put in by many people during what should be a time of peace and enjoyment with friends and families. Well done to everyone involved for an excellent response to a horrendous act. I can finally go get a beer!....at least after monitoring for a bit

UPDATE: FLOW NETWORK FULLY OPERATIONAL - CADENCE AND EVM ENVIRONMENTS LIVE This milestone marks the completion of one of the most complex recovery operations in blockchain history. What was initially projected as a sequential, multi-day process has been executed in parallel, restoring both Cadence and EVM functionality while maintaining surgical precision in removing fraudulent assets and preserving legitimate transaction history. NETWORK STATUS: BOTH EXECUTION ENVIRONMENTS OPERATIONAL ✅ Cadence VM: LIVE ✅ Flow EVM: LIVE ✅ Phase 2 cleanup: Continuing in parallel with full network operation 🔄 Account restoration: Ongoing as individual verification completes 🔄 Fraudulent token remediation: In progress via transparent on-chain transactions Over 99.9% of accounts have full operational access across both Cadence and EVM environments. ECOSYSTEM RESTORATION IN PROGRESS DeFi ecosystem on Flow is resuming operations: Live: @KittyPunch_xyz and @IncrementFi DEXs are operational and processing transactions Resuming: Bridge partners are actively working on restoration protocols and expect to resume operations following final verification TECHNICAL POST-MORTEM A comprehensive technical post-mortem detailing the complete attack vector, forensic analysis and remediation approach will be published within 48 hours. NEXT STEPS → Cadence & EVM: Both environments operational, final account remediation ongoing → DeFi Protocols: Continuing staged resumption as verification completes → Bridge/exchange resumption at operator discretion → Phase 4: Complete ecosystem restoration expected this week The network is secure, operational, and processing transactions across both execution environments. Technical implementation details available in the Flow Network Recovery: Technical Implementation Plan ↓ #heading=h.8szyuuswu0vc" target="_blank" rel="nofollow noopener">docs.google.com/document/d/1Up…

@intangible_eth appreciate that a lot. We have been here a while, always looking out for people.

This is one of the clearest and most credible explanations of what happened. @findlabs is one of the best teams in the Flow ecosystem, and their perspective carries weight. The key takeaway for me: "This weekend reinforced why we remain committed to this platform."

As the team behind Flowscan, the Flow block explorer, we were well positioned to see, monitor and engage in events that unfolded. What we witnessed was remarkable coordination under pressure. The Foundation proposed an initial approach. Bridge operators and ecosystem builders raised technical constraints. The plan was revised based on that feedback. Validators evaluated the new proposal and reached consensus. The response required genuine collaboration between parties under high stress. It takes serious stewardship to be responsive to ecosystem feedback, yet be ready to make the hard choices at the right time. Flowscan continues to provide transparent visibility into the ongoing remediation. Every cleanup transaction to remove the fraudulent tokens is publicly auditable on-chain. Every affected account restoration is verifiable in real time. This incident tested Flow's infrastructure in ways no one wanted. What remains is a secure network, with no user funds directly touched. This was something unlike anything we have witnessed before. Find Labs has been building on Flow for five years. We've watched this ecosystem mature through multiple upgrade cycles and network milestones. This weekend reinforced why we remain committed to this platform. We feel proud to be working with some of the best minds in crypto. To us Flow represents something larger than any single incident. Its vision of taking crypto mainstream is what we deeply believe in and it has a track record to prove why they can do it again. Its infrastructure built on solid technical foundations and supported by partners who show up when it matters. We're more committed than ever to building here and contributing to this ecosystem's continued development and we hope you will join us in supporting this next phase.

@Prof_math99 Unknown at this stage

@findlabs Done by insiders or outsiders?

FLOW NETWORK INCIDENT: Forensic Fund Tracking Report FindLabs is publishing the following analysis in collaboration with the Flow Foundation's security and engineering teams, who conducted the primary forensic investigation. • INCIDENT CONFIRMATION On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer. The attacker then moved assets off-network — primarily through bridges to Ethereum — before validators executed a coordinated network halt. Confirmed funds exited to date total approximately $3.9M, with forensic analysis ongoing. Critically, this exploit did not access or affect existing user balances. All user deposits remain intact. The vulnerability has been identified and isolated. A full technical post-mortem will be published within 72 hours. • ATTACKER WALLET (ETHEREUM) 0x2e7C4b71397f10c93dC0C2ba6f8f179a47F994e1 All confirmed exit transactions route through this address. Freeze requests have been submitted to exchanges and stablecoin issuers. • CONFIRMED EXIT TRANSACTIONS The following exit paths have been identified and verified. Confirmed funds exited to date: ~$3.9M USD equivalent. Forensic analysis is ongoing and this report will be updated as additional transactions are identified. CELER BRIDGE — 297.69 ETH - 74.422 ETH — etherscan.io/tx/0xbf3f95b0f… - 74.422 ETH — etherscan.io/tx/0xe6f55f204… - 74.422 ETH — etherscan.io/tx/0x106b8db43… - 74.422 ETH — etherscan.io/tx/0x9d6684f6f… DEBRIDGE — 479.35 ETH (includes USDC conversions) - 49.359 ETH — etherscan.io/tx/0x2d347295a… - 151.781 ETH — etherscan.io/tx/0x1eae85eed… - 123.30 ETH — etherscan.io/tx/0x3b5671861… - 14.932 ETH — etherscan.io/tx/0x9d6684f6f… - [+ 10 additional transactions ranging 11-17 ETH each] DIRECT WITHDRAWALS — 109.19 ETH - 90.299 ETH (Binance) — etherscan.io/tx/0xcf20b2c7f… - 18.89 ETH (Binance) — etherscan.io/tx/0x6e5b6fb95… RELAY BRIDGE — 39.44 ETH - 39.44 ETH — etherscan.io/tx/0x6bc988300… STARGATE — 9.98 ETH - 4.99 ETH — etherscan.io/tx/0x22a55360d… - 4.99 ETH — etherscan.io/tx/0x4378c6988… WBTC — 9.8 WBTC (~$930K) - 4.9 WBTC — etherscan.io/tx/0xe00dee9da… - 4.9 WBTC — #tokentxns" target="_blank" rel="nofollow noopener">etherscan.io/address/0x2e7c… PYUSD — 339K PYUSD (converted to ~261 ETH) - 279K PYUSD — etherscan.io/tx/0x52580ac81… - 60K PYUSD — etherscan.io/tx/0xeb3f5cf06… • ACTIVE LAUNDERING DETECTED The attacker is actively attempting to launder funds through privacy-preserving protocols: THORCHAIN (ETH → BTC conversion) - 250 ETH — etherscan.io/txs?a=0x2e7c4b… - 248 ETH — etherscan.io/tx/0x83099b48a… - 287 ETH — etherscan.io/tx/0x82276037a… CHAINFLIP (ETH → BTC conversion) - 50.6 ETH — etherscan.io/tx/0x74330ac39… - 258.14 ETH — etherscan.io/tx/0x6d250dc07… - 258.82 ETH — etherscan.io/tx/0x3c18a6daf… • CONTAINMENT STATUS ✅ Flow network halted — no further unauthorized activity possible ✅ Exit transactions identified to date mapped above ✅ Freeze requests submitted to Circle, Tether, Binance, Coinbase, Kraken ✅ Forensic partners and law enforcement engaged ✅ User funds unaffected — exploit did not access existing balances • NEXT STEPS The protocol fix has been developed and is entering final validation. → Target restart: Within 4-6 hours, pending successful testnet validation → Next status update from Flow Foundation: Within 2 hours → Full technical post-mortem: Within 72 hours This report will be updated as fund movement continues.

@chasefleming Thank you 🙏🙏

@findlabs Love the Dependency Manager install info on the contracts page. Great updates.

End of Year Update 2025 Contract Browser overhaul on Flowscan, Omnisearch NFT upgrades, Prism, API access changes, and a look ahead to 2026 🔥 findonflow.medium.com/1b98f9584702

Introducing Prism 🔍 Inspect the current on-chain state of any @flow_blockchain account and deploy or update Cadence contracts directly. Built for clarity, correctness, and direct chain interaction - all open source. Read the full announcement 👇 findonflow.medium.com/prism-instant-…

@roham 👏Great direction to be going 🔥 and Flow continuing to grow it's powerhouse of unique features

we fucked up. we built apps with the world’s most-loved brands. protocols with millions of users onboarded and billions in volume. but our mistake was simple: not enough of the value flowed to the believers who made it possible. we’re fixing that now. not only have we started updating the economics of our core products, we are also building a new slate of products and protocols with value creation at their core. the moment we need is finally here. $300 billion in stablecoins. $30 billion in tokenized real-world assets. trillions more on the way. the infrastructure and liquidity exist. what doesn't are the right products. defi today is hostile. it demands technical mastery just to survive: slippage, mev, liquidation cascades. the list goes on. every interface is built by experts, for experts. everyone else is forced to stay on the sidelines. that's the gap we're filling. we've proven we can bring the benefits of crypto to mainstream users without asking them to become technical experts first. we've proven we make complex technology feel simple. now we’re applying it to the biggest market: money. @dapperlabs and @Flow_Blockchain are democratizing consumer defi. today, three big moves: first is a new open-source protocol being developed by Flow Foundation: Flow Credit Markets (FCM), a lending protocol that protects you instead of punishing you. traditional defi lending is punishing: it waits until you're underwater, then liquidates you and charges a penalty. FCM is active. it uses the native onchain automation on Flow to monitor every position continuously and rebalance automatically before the position is at risk of liquidation. so far backtesting against every major crash since 2020 see 100% survival rate and 99.9% cost reduction versus lending protocols on other networks. second is a product built on top of the foundation of FCM. peak money: the finance app for a generation that has stopped believing in banks. our generation watched the traditional path to wealth become mathematically out of reach. so we stopped playing by the old rules. turned investing into culture. bet on elections like sports, traded athletes like stocks, turned every opinion into a market. peak money is built to level the playing field. to give everyone access to the same opportunities available to crypto experts and soon, with the tokenization of the entire global finance markets, those used by hedge funds and billionaires too. banks make money from you. peak makes money for you. the product starts simple: deposit cash or crypto. earn more than any bank will pay you. earn and spend without selling. no minimums. no gatekeepers. no seed phrases. no liquidation fear. watch this space: @peakmoney_ last but not least: $FLOW tokenomics. liquidity moves freely between chains. the apps people use every day don't. we believe the most valuable cryptocurrency will be the native token of the network powering products people can't live without. for that to happen, the native token must align the people who build with the people who believe. for years, Flow subsidized growth with near-zero fees. that made sense when the priority was experimentation. now the priority is economic alignment. dapper labs supports FLIP-351 proposed by Flow Foundation, updating transaction fees on Flow to dramatically reduce token inflation and ultimately become deflationary at just 250 tps - all while remaining the lowest-cost network compared to its peers every transaction burns tokens. network activity creates scarcity. scarcity compounds value. believers benefit. infrastructure + application + economics. aligned at last.

Flow is the dark horse of Blockchains. The tech being built is fantastic!

@tradertrader350 Wonderful, congratulations 👏👏

worst 9 months in my trading career, finally caught a win

@BabyBoomWeb3 @flow_blockchain Congratulations 👏👏🔥🔥

Wow, I'm truly humbled. I’m honored to share that my #ForteHacks project, WatcherForte, was recognized with 3 awards. My main goal was simply to learn from @flow_blockchain, so this recognition is truly unexpected. A huge thank you to the Flow team, the partners @findlabs @dapperlabs etc, and the judges for this incredible honor. More committed than ever to mastering Cadence & building on Flow. Big thanks also to @HackQuest_ID @HackQuest_

@flow_blockchain Fantastic work.. Congratulations to the winning teams 👏👏 It's great to see so much innovation happening on Flow

@flow_blockchain Well done to @flow_blockchain for another excellent Hackathon and congratulations to the winning teams 👏👏

$250K in prizes. 24 winning teams. Thousands of builders shaping what’s next. Thank you to everyone who built, supported, and helped make Forte Hacks what it is. The future is taking shape. More coming soon. x.com/i/broadcasts/1…

You can now see the future on Flow thanks to @findlabs Scheduled Transactions are now live on Flowscan Testnet, letting anyone view upcoming and executed onchain automations. A key piece of the Forte upgrade: fully onchain scheduling and automation. link.flow.com/Flowscan-Sched…

We just published the Flowscan Q4 2025 Update with a trove of new features and refinements for @flow_blockchain! - Design Overhaul - Tags & Layouts - Scheduled Transactions - Contract Verification medium.com/p/flowscan-q4-…