Flow Network Recovery Plan

Flow Network Recovery: Technical Implementation Plan

Executive Summary

This document details the technical implementation of the Flow Network recovery following the December 27, 2025 security incident. The recovery approach does not involve a network rollback. Instead, the network will resume from the most recent pre-halt state, with targeted remediation actions to neutralize fraudulent assets while preserving all legitimate transaction history.

This approach was developed in response to feedback from ecosystem partners who identified significant operational risks associated with a full state rollback, including multi-day reconciliation requirements for bridge operators and potential replay vulnerabilities.

The recovery proceeds in four phases:

1. Containment — Network resumes with EVM environment temporarily restricted and approximately 1,500 affected Cadence accounts isolated (Update: list of impacted wallets)
2. Cadence Remediation — Fraudulent tokens destroyed, affected accounts restored, DEX pools rebalanced
3. EVM Remediation — EVM environment re-enabled, fraudulent tokens destroyed, DEX pools rebalanced
4. Resumption — Bridges and exchanges re-enable integrations following a period of verified stability

Foundational Principle: No Rollback

The network will relaunch using the state from the last sealed block before transaction processing was halted (Block Height: 137390145 at 13:22:16 UTC). This state should match the off-chain records maintained by all integrating parties, including bridges, centralized exchanges, and applications.

There will be no chain reorganization. All legitimate transactions that occurred prior to the halt remain valid and will not require resubmission or reconciliation.

Phase 1: Containment of Incident-Affected State

When the network resumes, two containment mechanisms will be active to prevent movement of fraudulent assets during the remediation process.

1.1 EVM Environment Restriction

The Flow EVM environment will be temporarily restricted to read-only mode. This restriction is necessary because remediation of the EVM environment requires additional preparation time beyond the Cadence environment.

Rather than delay the entire network recovery, this approach enables Cadence-based applications and users to resume normal operations while EVM remediation is finalized. The EVM environment is expected to return to full read/write functionality approximately 48 hours after the network resumes, subject to completion of the remediation steps described in Phase 3.

1.2 Cadence Account Restrictions

During the exploit, the attacker executed a distribution attack, transferring fraudulent tokens to a large number of unrelated accounts. Approximately 1,500 Cadence accounts have been identified as recipients of these fraudulent token transfers.

These accounts will be temporarily restricted to read-only mode until the fraudulent tokens can be identified and destroyed. As each account is analyzed and remediated, it will be restored to full read/write status.

Based on preliminary analysis, the majority of these accounts have no transaction history other than the receipt of fraudulent tokens. These accounts are expected to be remediated and restored within hours of network resumption. Accounts with more complex states will be analyzed and remediated as expeditiously as practical.

All Cadence accounts not on the restricted list—representing over 99% of network accounts—will be fully operational when the network resumes.

Phase 2: Cadence Environment Remediation

Once the network is live, a series of transparent, auditable transactions will be executed to remediate the Cadence environment.

2.1 Governance Authorization

The remediation actions require elevated permissions that do not exist under normal network operation. The Flow core protocol team has proposed a temporary software upgrade that grants the Service Account the capability to withdraw and destroy tokens from affected accounts.

This upgrade requires opt-in adoption by network validators. Only after validators reach consensus on the upgrade can remediation actions proceed. Upon completion of all remediation activities, a subsequent software version will be provided that revokes these elevated permissions. Validators adopting that version will return the network to standard operational parameters.

2.2 Destruction of Fraudulent Tokens

The Service Account will execute transactions to withdraw fraudulent tokens from each affected account and permanently destroy them. Each such transaction will:

• Withdraw the fraudulent tokens from the affected account
• Destroy those tokens permanently
• Emit an on-chain event indicating the account address and quantity of tokens destroyed
• Remove the account from the restricted list, restoring full access to the original owner

All remediation actions will be signed by the Service Account and will be fully auditable via block explorers or direct chain queries. The transaction source code will be published for independent verification.

2.3 DEX Pool Rebalancing

The exploit resulted in price dislocations across Cadence-based DEX pools. To restore accurate pricing, the Flow Foundation intends to contribute tokens from its reserves to rebalance affected pools such that on-chain prices to closely align with consensus prices observed on external chains and centralized exchanges.

The specific quantities and methodology will be published for independent analysis prior to execution.

2.4 Bridge Operator Guidance

All Cadence-based bridge operators have been advised to disable bridging functionality until:

• The network has been fully remediated of fraudulent tokens
• DEX prices have stabilized and closely align with external consensus prices
• The network has demonstrated a period of normal operation

Bridge operators will make independent determinations regarding when to resume their integrations. The Foundation will provide ongoing status updates to facilitate this decision-making.

Phase 3: EVM Environment Remediation

Following stabilization of the Cadence environment, the EVM environment will be re-enabled and remediated through a parallel process.

3.1 Re-enabling EVM

The EVM environment will be restored to full read/write functionality via a non-spork network upgrade (Height Coordinated Upgrade). This upgrade does not require a network restart and will be coordinated with node operators in advance.

3.2 Destruction of Fraudulent Tokens

In addition to the Cadence distribution attack, the attacker transferred fraudulent tokens to a number of EVM addresses. The Service Account will execute transactions to:

• Withdraw fraudulent tokens from identified EVM addresses
• Bridge those tokens back to the Cadence environment
• Permanently destroy them

As with Cadence remediation, all actions will be transparent and auditable via transactions signed by the Service Account.

3.3 Recovery of Fraudulent Trade Proceeds

The attacker used fraudulent tokens to execute trades against Flow EVM-based DEX pools. The remediation approach distinguishes between the attacker and innocent counterparties:

• Attacker accounts: The proceeds of trades executed using fraudulent tokens will be recovered from accounts controlled by the attacker.
• Innocent counterparties: Tokens received by liquidity providers or traders who transacted against the attacker in good faith will not be reclaimed.

Proceeds recovered from attacker accounts will be applied toward DEX pool rebalancing.

3.4 DEX Pool Rebalancing

The Flow Foundation intends to contribute tokens to rebalance EVM-based DEX pools, augmented by any proceeds recovered from attacker accounts as described above. The objective is to restore on-chain prices to closely align with consensus prices on external chains and centralized exchanges.

3.5 Addressing Residual Supply Imbalance

As a result of trades executed by the attacker, some fraudulent tokens may have been transferred to innocent parties (liquidity providers, traders) whose tokens are fungible with legitimate supply. Since these tokens cannot be individually identified and reclaimed without harming innocent users, the imbalance will be addressed through supply adjustment rather than direct reclamation.

Following completion of all direct remediation actions, a net-transfer analysis will be conducted to quantify any residual supply imbalance attributable to the exploit. The methodology and findings of this analysis will be published for independent review.

To the extent a supply imbalance is identified, the Foundation may elect to acquire and permanently destroy an equivalent quantity of tokens to restore supply integrity. Any such action will be conducted transparently, with full documentation of the methodology and execution.

Phase 4: Resumption of Normal Operations

4.1 Permission Revocation

Upon completion of all remediation activities, the Flow core protocol team will provide a software version that revokes the elevated permissions granted to the Service Account. Validators adopting this version will return the network to standard operational parameters.

4.2 Bridge and Exchange Re-enablement

As independent operators, bridges and centralized exchanges will make their own determinations regarding when to resume integrations with the Flow network. The Foundation recommends that these parties:

• Maintain restricted operations during the active remediation period
• Observe a period of normal network operation prior to full re-enablement
• Coordinate with the Foundation for status updates and verification of remediation completion

The Foundation will work with all ecosystem partners to provide transparency and predictability throughout this process.

4.3 Post-Mortem Publication

Following full network restoration, a comprehensive post-mortem will be published detailing:

• Root cause analysis of the exploit
• Timeline of incident response
• Technical details of the remediation process
• Preventive measures implemented

Expected Timeline

These estimates are subject to revision based on operational realities. The Foundation will provide regular status updates as the recovery progresses.

Action Items for Partners

Bridge Operators:

• Confirm bridging functionality is disabled
• Prepare for re-enablement upon notification of remediation completion
• Coordinate with Foundation on verification requirements

Centralized Exchanges:

• Maintain deposit/withdrawal restrictions for FLOW and Flow-based assets
• Prepare for re-enablement following verified stability period
• Reach out to the Flow Team if any questions or concerns

Protocol/Application Teams:

• Cadence-based applications may resume normal operations upon network resumption
• EVM-based applications should prepare for re-enablement approximately 48 hours post-resumption
• Review any accounts that may be on the restricted list

Feedback and Questions: This document is being circulated for partner review. Technical questions and feedback should be directed to the Flow Team as soon as you can.