Flow Security Incident Review: Type Confusion Vulnerability in Cadence Identified as Key Factor

By: theblockbeats.news|2026/01/07 17:16:11
0
Share
copy

BlockBeats News, January 7th, Folw released an attack event retrospective report, stating that the attacker exploited a Flow Network vulnerability to mint fake tokens, stealing approximately $3.9 million through a bridging attack. This attack did not access or leak any existing user balances. The attack duplicated assets but did not touch legitimately held assets, with the majority of the fake assets either stored on-chain before liquidation or frozen by exchange partners. Network validators have approved a decentralized governance action authorizing the permanent destruction of all fake assets. The network resumed operation on December 29th, is currently running smoothly, and all transaction history has been preserved.

The attacker sequentially deployed over 40 malicious smart contracts, leveraging a three-stage attack chain: 1) bypassing attachment import verification; 2) circumventing defense checks of built-in types; 3) exploiting a contract initializer semantic vulnerability. The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), which has now been patched (v1.8.9 and higher versions). This vulnerability allowed the attacker to disguise protected assets (which should not be duplicable) as standard data structures (which are duplicable), bypassing runtime security checks and enabling token minting.

In addition to moving assets out of Flow, the attacker also attempted to deposit fake FLOW on several centralized exchanges, but due to the abnormal transaction volume and internal anti-money laundering protocols, multiple exchanges froze the deposit upon receipt. Approximately 50% of the fake FLOW deposits have been returned and destroyed by cooperating exchanges (such as OKX, Gate, MEXC), while the foundation continues to actively coordinate with other exchange platforms.

You may also like

The Trader's Playbook: 7 Market Cycle Lessons From LALIGA’s 90 Minutes

What do LALIGA matches teach about crypto markets? Learn how consolidation, breakouts, and late-cycle volatility shape disciplined trading decisions.

How Smart Money Tracker Survived Live AI Trading at WEEX AI Hackathon

Discover how WEEX AI Trading Hackathon tested strategies with real capital—no simulations. See how Smart Money Tracker survived flash crashes and leveraged 18x in live markets.

80% Win Rate to 40% Drawdown: An AI Trader's Brutal Recalibration at WEEX AI Wars

Dive into the technical blueprint of an AI trading system built on LLaMA reasoning and multi-agent execution. See how Quantum Quaser uses confidence thresholds & volatility filters at WEEX AI Wars, and learn the key to unlocking 95% win rate trades.

AI Trading Strategy Explained: How a Beginner Tiana Reached the WEEX AI Trading Hackathon Finals

Can AI trading really outperform human emotion? In this exclusive WEEX Hackathon finalist interview, discover how behavioral signal strategies, SOL trend setups, and disciplined AI execution secured a spot in the finals.

When AI Takes Over the 'Shopping Journey,' How Much Time Does PayPal Have Left?

Stripe and PayPal are shifting from payment tools to AI business infrastructure, competing to become the default engine for AI transactions.

Bloomberg: Aid Turkey Freeze $1 Billion Assets, Tether Remakes Compliance Boundary

By the end of 2025, Tether and its competitor Circle had blacklisted around 5700 wallets, involving assets of around $2.5 billion.

Popular coins

Latest Crypto News

Read more