Original | Odaily Planet Daily (@OdailyChina)
Last Saturday afternoon, a sudden hacker attack threw the Flow network into chaos. This Layer 1 network built by the Dapper Labs team was originally tailored for the next generation of applications, games, and digital assets, but it watched helplessly as $3.9 million in assets were transferred off-chain due to an exploited vulnerability in the execution layer. Following the attack, its token FLOW was halved in a short time, plummeting from $0.173 to $0.079, and the current price has slightly rebounded to around $0.107.
Below, Odaily Planet Daily summarizes the Flow theft incident, the official response, and why it has sparked strong doubts from Flow partners and the community.
Flow's official emergency response: isolating the network and announcing a rollback plan
After the attack, the Flow Foundation quickly responded and confirmed the details of the incident. The attacker exploited a vulnerability in the execution layer to transfer approximately $3.9 million in assets, and the incident did not affect users' existing balances; user deposits remain safe. The relevant attack addresses have been marked, and the money laundering paths are being continuously tracked. The foundation has submitted asset freeze requests to Circle, Tether, and several major exchanges.
To clean up illegal on-chain transactions and fix the vulnerabilities, the Flow Foundation isolated the network and released the mainnet vulnerability fix version Mainnet 28. The foundation's initial disposal plan is to roll back the network state to a checkpoint before the attack, specifically at Cadence block height 137363395, thereby deleting all transaction records generated within approximately 6 hours. Regardless of whether the transactions were legal, they will all be cleared, and users will need to resubmit transactions after the nodes restart. The foundation believes this plan is the safest path to restore the integrity of the network and repeatedly emphasizes that user funds will not be affected throughout the process, while promising to update the progress of the incident every two hours.
This rollback decision seems decisive but quickly ignited a fuse within the ecosystem—because the hacker's funds had already been bridged off-chain, the rollback would have no impact on the attacker and would only affect honest users and partners.
Cross-chain bridge partners and community users strongly opposed the rollback plan
After the rollback plan was announced, cross-chain bridge partners and community users within the Flow ecosystem quickly raised collective doubts. Alex Smirnov, co-founder of Flow's main cross-chain bridge partner deBridge, publicly criticized the decision on the X platform as being too hasty and lacking any prior communication with key bridging partners. As an important asset channel in the Flow ecosystem, deBridge did not receive any advance notice regarding the rollback.
Smirnov pointed out that the potential damage caused by the rollback could far exceed the initial hacker attack itself. Since cross-chain assets have circulated among multiple systems, a forced rollback would lead to serious issues such as asset duplication and inconsistent custody states, ultimately harming the bridges, users, and counterparties that operated normally during the window period. He disclosed that approximately $200,000 and $50,000 in deposits on deBridge fell within the rollback time window, and executing the rollback could result in one side's funds disappearing or extreme cases of assets being minted multiple times.
Based on the above risks, Smirnov called for Flow validators to pause block production and validation until compensation plans, partner coordination mechanisms, and independent security team intervention plans are all clarified. Similar issues are not isolated. As the main cross-chain custodian of USDC on the Flow network, LayerZero also faces cross-chain transaction risks of about $220,000 and $180,000 falling within the rollback window.
In addition to cross-chain bridge partners within the Flow ecosystem, users on the X platform began to express concerns about the safety of their funds, developers questioned the reliability and governance mechanisms of the network in extreme situations, and investor sentiment turned cautious, leading to increased selling pressure. Many voices pointed out that the rollback itself exposed the reality of centralized control on-chain, and the original technical incident quickly evolved into a trust crisis.
Some community opinions further targeted the core principles of blockchain. Some believe that the rollback directly undermined transaction finality and immutability, making Flow appear more like a consortium chain that could be administratively intervened at a critical moment. Others compared historical security incidents of other public chains, pointing out that similar situations are usually handled by isolating the attacker's address and freezing the flow of funds, rather than performing a global rollback of the entire network state.
Crypto KOL Wazz (@WazzCrypto) bluntly stated on the X platform that Flow's rollback decision is one of the worst handling methods he has ever seen. In his view, the attacker had already transferred approximately $4 million in assets off-chain and would hardly be substantively affected by the rollback; the real cost would be borne by those innocent users who were using the network normally through cross-chain bridges.
Flow's official change of attitude: abandoning the rollback and adopting a new isolation recovery plan
In the face of strong opposition from partners and the community, Flow officials ultimately decided to abandon the network rollback and shift to an "isolation recovery plan." This plan was directly negotiated with cross-chain bridges, exchanges, and infrastructure partners, and key points include:
- No rollback/reorganization, retaining all legitimate user activities;
- No need for partners to replay transactions;
- Over 99.9% of accounts are unaffected, and normal operations will resume upon restart;
- At restart, temporary restrictions will be placed on accounts receiving illegally minted tokens;
Additionally, the network will be restored in phases:
- Phase one: Cadence environment goes live, EVM temporarily restricted;
- Phase two: Cadence fix (approximately 24 to 48 hours);
- Phase three: EVM fix and restart;
- Phase four: Cross-chain bridges/exchanges resume access, with specific recovery times determined by the operators based on actual conditions after confirming stability.
Furthermore, the team behind Flow, Dapper Labs, expressed support for this plan on the X platform, stating, "Retain legitimate activities and provide a clear recovery path."
This "abandoning the rollback" attitude has temporarily alleviated the tense atmosphere within the ecosystem and avoided the systemic risk spread that a rollback could trigger. As of now, the network is still in the process of phased coordination and recovery, and the officials state that user funds remain safe.
In an environment of high uncertainty in the crypto market, this crisis may become an important watershed in Flow's development path, and its long-term impact remains to be seen.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
