Flow Details $3.9M Exploit That Allowed Token Counterfeiting

[johnblockbuster]

The Flow Foundation released a technical post mortem explaining a protocol-level exploit on the Flow network that resulted in roughly $3.9 million in confirmed losses. The attacker abused a flaw in Flow’s Cadence runtime that allowed assets to be duplicated instead of properly minted, bypassing supply controls without draining existing user balances.

Validators halted the network within six hours, placing Flow into a temporary read-only mode to stop further exits. Most counterfeit tokens were frozen by exchange partners before liquidation, and operations resumed two days later under an isolated recovery plan that preserved legitimate transactions and authorized the permanent destruction of fake assets.

[madmax]

read-only mode sounds scary until you realize it’s kinda the only sane move