Flow blockchain recently released a detailed technical analysis report on the security incident from December 27, 2025. According to the report, the attack originated from a type confusion vulnerability in the Cadence VM, which hackers exploited to forge tokens.

The outflow of assets was quite severe. Confirmed data shows that approximately $3.9 million in equivalent assets have flowed out of the Flow network through multiple cross-chain bridges (including Celer, deBridge, Stargate, and Relay). However, based on the current control situation, most of the forged assets have been locked on-chain or taken over by relevant parties, with losses relatively manageable.

The Flow team has published detailed technical documentation that explains the specific principles of the vulnerability and the fix solution, which has important reference significance for the security development of the entire ecosystem.