{"id":5192,"date":"2026-01-02T06:58:57","date_gmt":"2026-01-02T06:58:57","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=5192"},"modified":"2026-01-02T06:58:57","modified_gmt":"2026-01-02T06:58:57","slug":"flow-enters-phase-two-of-recovery-after-3-9m-exploit-flags-exchange-token-movements","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=5192","title":{"rendered":"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements"},"content":{"rendered":"

<\/p>\n

\n
\n
\n
    \n
  • The Flow Foundation has entered \u201cphase two\u201d of its recovery following a $3.9 million exploit on Saturday, December 27, 2025.<\/span><\/li>\n
  • Developers scrapped an initial plan to roll back the blockchain due to community concerns over decentralisation, opting instead for a \u201ctwo-stage\u201d recovery.<\/span><\/li>\n
  • Flow accused an unnamed exchange of AML\/KYC failures after a single account deposited the stolen 150 million FLOW, swapped it for BTC, and withdrew over $5 million shortly before the network was halted.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n

    Flow is rebuilding its network after a US$3.9 million (AU$5.9 million) exploit on Saturday, and says it is investigating suspicious exchange activity tied to a large FLOW token deposit and rapid withdrawals.<\/p>\n

    In an update on X, the Flow Foundation said its recovery effort has moved into \u201cphase two,\u201d which it expects to take several days. It said engineers have found a way to bring back Ethereum Virtual Machine (EVM) support while remediation continues on Cadence, Flow\u2019s non-EVM chain. Both tracks will now be worked on at the same time.<\/p>\n

    Moreover, Flow said the Community Governance Council is carrying out \u201ccleanup\u201d transactions within limits approved by validators, and that the actions can be independently checked on-chain using block explorers.<\/p>\n

    \n
    \n

    This is a complex process requiring individual account assessment and verification. The Foundation is working with external forensic firms to accelerate remediation while maintaining the precision required for secure restoration.<\/em><\/p>\n<\/div>\n

    \n Flow Foundation. <\/div>\n<\/div>\n

    Related:<\/strong> Australia\u2019s $60m Crypto Retirement Scheme Leaves Investors Short, Just $6.7m Found<\/p>\n

    Flow Steps Back From Early Proposal<\/h2>\n

    The foundation has also stepped back from an earlier proposal that would have rolled back the blockchain. That idea drew pushback from users who said a rollback would undermine decentralisation and introduce new security concerns.<\/p>\n

    In its post-incident report, Flow said it was alarmed by how one centralised exchange handled token movements during the incident and claimed the exchange did not respond to its outreach about trading patterns. Flow did not name the venue, though some users speculated it could be Binance.\u00a0<\/p>\n

    Flow said a single account deposited 150 million FLOW, about 10% of total supply, swapped a large amount into Bitcoin, and withdrew more than US$5 million (AU$7.6 million) within a few hours before the network was halted.\u00a0<\/p>\n

    Flow said the pattern indicated an AML\/KYC breakdown and pushed losses onto users who may have bought tokens created through the exploit.<\/p>\n

    Read more:<\/strong> Grayscale Targets Decentralised AI With First-Ever Bittensor (TAO) ETP Filing<\/p>\n<\/p><\/div>\n

    Blockchain,Flow#Flow #Enters #Phase #Recovery #3.9M #Exploit #Flags #Exchange #Token #Movements1767337137<\/p>\n","protected":false},"excerpt":{"rendered":"

    The Flow Foundation has entered \u201cphase two\u201d of its recovery following a $3.9 million exploit on Saturday, December 27, 2025. Developers scrapped an initial plan to roll back the blockchain due to community concerns over decentralisation, opting instead for a \u201ctwo-stage\u201d recovery. Flow accused an unnamed exchange of AML\/KYC failures after a single account deposited<\/p>\n","protected":false},"author":1,"featured_media":5193,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[663,241,89,664,498,660,666,661,662,665],"class_list":{"0":"post-5192","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-bitcoin","8":"tag-3-9m","9":"tag-enters","10":"tag-exchange","11":"tag-exploit","12":"tag-flags","13":"tag-flow","14":"tag-movements","15":"tag-phase","16":"tag-recovery","17":"tag-token"},"yoast_head":"\nFlow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=5192\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements\" \/>\n<meta property=\"og:description\" content=\"The Flow Foundation has entered \u201cphase two\u201d of its recovery following a $3.9 million exploit on Saturday, December 27, 2025. Developers scrapped an initial plan to roll back the blockchain due to community concerns over decentralisation, opting instead for a \u201ctwo-stage\u201d recovery. Flow accused an unnamed exchange of AML\/KYC failures after a single account deposited\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=5192\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-02T06:58:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.cryptonews.com.au\/2026\/01\/02145245\/Flow-Foundation.png\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=5192\",\"name\":\"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg\",\"datePublished\":\"2026-01-02T06:58:57+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=5192\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg\",\"width\":1920,\"height\":1072},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=5192#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=5192","og_locale":"en_US","og_type":"article","og_title":"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements","og_description":"The Flow Foundation has entered \u201cphase two\u201d of its recovery following a $3.9 million exploit on Saturday, December 27, 2025. Developers scrapped an initial plan to roll back the blockchain due to community concerns over decentralisation, opting instead for a \u201ctwo-stage\u201d recovery. Flow accused an unnamed exchange of AML\/KYC failures after a single account deposited","og_url":"https:\/\/cryptonews.uk.com\/?p=5192","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-01-02T06:58:57+00:00","og_image":[{"url":"https:\/\/cdn.cryptonews.com.au\/2026\/01\/02145245\/Flow-Foundation.png","type":"","width":"","height":""}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=5192","url":"https:\/\/cryptonews.uk.com\/?p=5192","name":"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg","datePublished":"2026-01-02T06:58:57+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=5192#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=5192"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=5192#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/01\/crypto-exploit-flow-foundation-recovery.jpeg","width":1920,"height":1072},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=5192#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Flow Enters Phase Two of Recovery After $3.9M Exploit, Flags Exchange Token Movements"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/5192","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5192"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/5192\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/5193"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5192"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5192"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5192"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}