Flow

Union

when

The Flow Foundation on Tuesday published a technical post mortem detailing a protocol-level exploit that occurred on Dec. 27, when an attacker was able to counterfeit tokens on the network, resulting in about $3.9 million in confirmed losses before the exploit was contained.
According to the <a href="https://www.flow.com/post/dec-27-technical-post-mortem" rel="noopener noreferrer nofollow" target="_blank">report</a>, the attacker exploited a flaw in Flow’s Cadence runtime that allowed certain assets to be duplicated rather than minted, bypassing supply controls without accessing or draining existing user balances. Validators coordinated a network halt within six hours of the first malicious transaction, while exchange partners froze most counterfeit assets before they could be sold.
Flow said the temporary halt placed the network into a read-only mode to sever exit paths and prevent further duplication while the issue was investigated. Operations resumed two days later under an “isolated recovery” plan that preserved legitimate transaction history and authorized the recovery and permanent destruction of counterfeit assets through a governance-approved process.
<figure>
 <img alt="Hacks, NFT, Flow" src="https://s3.cointelegraph.com/uploads/2026-01/019b9534-0322-7718-803f-eaf3a672768e.png" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/flow_blockchain/status/2008612688755130840" rel="noopener noreferrer nofollow" target="_blank">Flow Blockchain</a>
 </figcaption>
</figure>
The Flow Foundation, which supports the Flow network, said no existing user balances were compromised, as the exploit duplicated assets rather than removing funds from accounts. A limited number of accounts that interacted with counterfeit tokens were temporarily restricted as a precaution, while more than 99% of accounts retained full access during and after the recovery.
While the attacker generated a large volume of counterfeit tokens onchain, Flow said the vast majority were contained or frozen before liquidation.
The Foundation said it has since patched the underlying vulnerability, added stricter runtime checks and expanded regression testing to prevent similar exploits. It also is working with forensic partners and law enforcement and plans to strengthen monitoring and bug-bounty programs as part of broader security hardening.
Related: <a href="https://cointelegraph.com/news/nfts-utility-culture-price-faded-2025" rel="noopener noreferrer nofollow" target="_self">NFTs shifted to utility and culture as price faded in 2025</a>
<h2 id="flow-s-post-nft-downturn">Flow’s post-NFT downturn</h2>
Dapper Labs, the creators of the non-fungible token project CryptoKitties, <a href="https://www.dapperlabs.com/newsroom/dapper-labs-announces-flow-a-new-blockchain-by-the-creators-of-cryptokitties" rel="noopener noreferrer nofollow" target="_blank">announced</a> the development of Flow in September 2019 as a new layer-1 blockchain designed to address scalability challenges facing consumer applications such as games and digital collectibles.&nbsp;
Early success with <a href="https://cointelegraph.com/news/dapper-labs-settlement-nba-top-shot-nfts-not-securities" rel="noopener noreferrer nofollow" target="_self">NBA Top Shot</a>, an NFT platform for trading officially licensed NBA video highlights, helped bring mainstream attention to the Flow blockchain in 2020 and 2021. Against this backdrop, the network’s FLOW token surged past $40 in 2021, according to <a href="https://www.coingecko.com/en/coins/flow" rel="noopener noreferrer nofollow" target="_blank">data</a> from CoinGecko.
Flow’s momentum carried into 2022, where the project raised about <a href="https://cointelegraph.com/news/top-shot-creator-unveils-725m-fund-to-support-flow-ecosystem" rel="noopener noreferrer nofollow">$725 million from investors</a>, including Andreessen Horowitz (a16z) and Union Square Ventures, to support ecosystem development.
As activity across the <a href="https://cointelegraph.com/news/nfts-utility-culture-price-faded-2025" rel="noopener noreferrer nofollow" target="_self">NFT market cooled</a> in the years that followed, the FLOW token also lost momentum and has since fallen outside the top 300 cryptocurrencies by market capitalization.
The decline accelerated following the Dec. 27 hack, when FLOW plunged by around 40% over five hours.
The token later slid to a low of $0.075 on Friday before beginning to recover. It was trading near $0.10 at the time of writing, up about 16% over the past 24 hours, according to Cointelegraph data.
<figure>
 <img alt="Hacks, NFT, Flow" src="https://s3.cointelegraph.com/uploads/2026-01/019b9536-d241-73e0-b468-265c18a4a0f9.png" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://www.coingecko.com/en/coins/flow" rel="noopener noreferrer nofollow" target="_blank">CoinGecko</a>
 </figcaption>
</figure>
Magazine: <a href="https://cointelegraph.com/magazine/big-questions-will-bitcoin-survive-10-year-power-outage/" rel="noopener noreferrer nofollow" target="_self">Big questions: Would Bitcoin survive a 10-year power outage?</a>

Flow details December exploit that led to $3.9M in losses due to counterfeit tokens

Table of Contents

Cointelegraph

Other articles published on Jan 6, 2026

Join our free newsletter for daily crypto updates!