After FLOW fell over 40% and TVL swung from $107M to $73.8M then $97.2M, Flow dropped the rollback for token burn and a phased restart.
Flow’s plan to unwind a $3.9 million exploit has put governance, not code, at the center of its crisis response. On Dec. 27, an attacker exploited a vulnerability in Flow’s execution layer and moved roughly $3.9 million across multiple cross-chain bridges before validators halted the chain. Flow Foundation and forensic partner FindLabs said existing user balances were not accessed, and that exit routes were mapped with freeze requests sent to major exchanges and stablecoin issuers. Investigators also identified the attacker’s Ethereum wallet. Immutability suddenly became negotiable under stress, reigniting a debate partners thought was settled.
Within hours, developers proposed rolling back to a checkpoint prior to the exploit, erasing transactions in a several-hour window and forcing users and infrastructure providers to resubmit activity. The Foundation framed it as neutralizing unauthorized minting, yet key ecosystem partners said they were blindsided, arguing they were not consulted. deBridge founder Alex Smirnov said he learned of the decision only after it was announced publicly. He warned of doubled balances for users who bridged out and losses for those who bridged in, urging validators to pause until custodians like LayerZero could handle affected USDC transfers.
Operational uncertainty then spilled into market optics. Flowscan showed the network stalled at a fixed block height for an extended period, even as the Foundation said a restart was expected within hours. After the exploit and rollback announcement, the FLOW token fell more than 40%, and some centralized exchanges temporarily suspended transactions. DefiLlama data showed total value locked dropping from $107 million to $73.8 million before rebounding to about $97.2 million, a 31% recovery in 24 hours. Delphi Labs counsel Gabriel Shapiro warned rollbacks could push losses onto bridges and issuers by creating unbacked assets.
Facing pressure, the Foundation shifted course on Dec. 29 with a remediation plan developed with bridge operators, exchanges, and validators. It abandoned a global rollback and instead focused on isolating and destroying fraudulently minted tokens while preserving legitimate user activity. Dapper Labs said it reviewed and supported the revised approach, stressing no user balances or treasury assets were impacted and its platforms would return as operations resumed. Under the phased restart, accounts flagged by forensics were restricted, validators approved the software upgrade, and the network came back in read-only mode, with 99.9% of accounts unaffected.
