Flow details $3.9 million exploit, Cadence type confusion bug, and recovery steps in January 2026 report

On January 6, 2026, Flow released a post‑incident report explaining how a $3.9 million exploit was carried out through a type confusion vulnerability in the Cadence runtime that enabled counterfeit FLOW token creation. The attacker began executing about 40 malicious contracts on December 26, 2025, and network validators halted the chain less than six hours after the initial malicious transaction. Flow stated that existing user balances were not accessed, while exchanges received 1.094 billion fake FLOW and later returned 484,434,923 tokens for destruction, with most of the remaining supply isolated onchain.