Attacker Deployed 40 Malicious Contracts to Exploit $3.9M From Flow Network - Unchained

The Flow Network shared a post-mortem of a Dec. 27 exploit that led to $3.9 million in losses from the protocol, but no user balances were compromised.

The attacker used 40 malicious smart contracts to orchestrate a three-part attack chain, extracting counterfeit tokens before Flow validators halted the chain after the exploit was detected.

This story is an excerpt from the Unchained Daily newsletter.

Subscribe here to get these updates in your email for free

“It’s important to also note that these assets were duplicated, not minted, therefore total token supply values for each of the tokens remained unchanged; minting logic was entirely bypassed in the attack,” explained the Flow team.

The Flow Foundation initially floated a full chain rollback to a pre-exploit state, but later pivoted to an “isolated recovery” plan, which involves restarting the chain from the last sealed block.

Flow’s native token FLOW dropped around 40% immediately after the exploit, but has since gained around 6% and was trading at $0.099 as of Tuesday evening.