Flow sees deposit and withdrawal halts after Dec. 27 flaw

Temporary suspension of FLOW deposits and withdrawals: why it happened

Several trading venues enacted a temporary suspension of FLOW deposits and withdrawals following the Flow security incident on December 27, 2025. The pauses were framed as a precaution to contain risk while technical teams assessed on‑chain activity and coordinated with centralized platforms.

According to Flow Foundation’s technical post‑mortem, an attacker exploited a type‑confusion vulnerability in the network’s execution layer, prompting the chain to enter a read‑only mode to prevent further malicious state changes while forensics proceeded. During this period, exchanges limited on‑chain transfer functionality for FLOW to reduce propagation risk and align with incident response.

What this means for your FLOW funds and account access

The post‑incident remediation sequence focused on isolating malicious activity, recovering counterfeit balances, and patching the root cause, with the stated objective of preserving unaffected user balances. Dapper Labs said no user balances or assets, including its treasury, were affected under the updated remediation approach.

Service restoration on centralized venues has proceeded in stages. “The full restoration of FLOW trading, deposits, and withdrawals on HTX following the December 27, 2025 security incident” and that “all FLOW assets held by users on HTX remain intact and fully validated,” said HTX in a joint statement.

Availability and processing times can differ by platform, and some venues may phase in deposit and withdrawal channels on their own timelines once validations and reconciliations are complete. Users could see pending or queued transfers clear only after each venue finalizes its post‑incident checks and re‑enables network rails.

Immediate impact and current restoration status

Based on a final remediation update distributed via GlobeNewswire, approximately 87.4 billion counterfeit FLOW tokens created during the exploit were permanently destroyed to neutralize on‑chain inflationary effects. As reported by The Block, the estimated off‑network financial impact was about $3.9 million, a figure that shaped industry debate over whether a full chain rollback would have imposed broader collateral damage than targeted remediation.

Restoration has not been uniform across the market. As reported by Blockonomi, exchanges such as Upbit and Bithumb halted deposits and withdrawals during the investigation window, consistent with standard containment practices, while other venues moved at their own pace to re‑open services after validations.

At the time of this writing, FLOW changes hands around $0.04, based on data from CoinGecko. This price context is descriptive only and may differ across venues during periods of elevated operational or market volatility.

Flow security incident December 27, 2025: vulnerability explained

The root cause was a type‑confusion vulnerability in the execution layer, an error class where the system misinterprets data types, allowing the attacker to generate counterfeit tokens without corresponding economic backing. Entering read‑only mode limited state transitions while investigators traced affected accounts and coordinated destruction of illegitimate balances.

Containment steps emphasized freezing suspect activity, repairing the underlying flaw, and validating account states before resuming normal operations. Most counterfeit tokens did not enter active circulation due to rapid intervention and subsequent burn actions.