Flow Security Incident Review: Type Confusion Vulnerability in Cadence Identified as Key Factor

By: theblockbeats.news|2026/04/17 05:54:22
0
Share
copy

BlockBeats News, January 7th, Folw released an attack event retrospective report, stating that the attacker exploited a Flow Network vulnerability to mint fake tokens, stealing approximately $3.9 million through a bridging attack. This attack did not access or leak any existing user balances. The attack duplicated assets but did not touch legitimately held assets, with the majority of the fake assets either stored on-chain before liquidation or frozen by exchange partners. Network validators have approved a decentralized governance action authorizing the permanent destruction of all fake assets. The network resumed operation on December 29th, is currently running smoothly, and all transaction history has been preserved.

The attacker sequentially deployed over 40 malicious smart contracts, leveraging a three-stage attack chain: 1) bypassing attachment import verification; 2) circumventing defense checks of built-in types; 3) exploiting a contract initializer semantic vulnerability. The root cause was a type confusion vulnerability in the Cadence runtime (v1.8.8), which has now been patched (v1.8.9 and higher versions). This vulnerability allowed the attacker to disguise protected assets (which should not be duplicable) as standard data structures (which are duplicable), bypassing runtime security checks and enabling token minting.

In addition to moving assets out of Flow, the attacker also attempted to deposit fake FLOW on several centralized exchanges, but due to the abnormal transaction volume and internal anti-money laundering protocols, multiple exchanges froze the deposit upon receipt. Approximately 50% of the fake FLOW deposits have been returned and destroyed by cooperating exchanges (such as OKX, Gate, MEXC), while the foundation continues to actively coordinate with other exchange platforms.

-- Price

--

You may also like

Morning Report | Samsung announces a 265.5 trillion won investment plan, focusing on semiconductor and AI computing power data centers; Vitalik publishes an article detailing the entire technology tree behind the confusion protocol (iO) mainline

Overview of Important Market Events on June 29

What you bought on CEX is really not US stocks: Analyzing the 94% liquidation monopoly and the evaporation of equity under a five-layer pipeline

Peeling back its smooth trading interface to examine the underlying legal relationships and settlement processes, you will find that this is far from a simple "RWA asset revolution," but rather a complex game of interests involving spot pricing, rights ownership, and the monopoly of underlying custo...

In such a crowded cross-border payment arena, where is the next stop for the future?

Only by stepping into the mud can one have the chance to touch gold.

Why Is Bitcoin Down in 2026? What We Can Learn From 2022

Why is Bitcoin down in 2026? Bitcoin has just recorded its worst first half since 2022, with back-to-back quarterly losses, record ETF outflows, and extreme fear. Here's what history says, how 2026 differs from the last bear market, and the three signals traders should wat

The large models in the United States are moving towards closure in the name of security

The government successfully inserted itself as an approver between commercial AI models and their users for the first time.

From the white-haired stock god to the billionaire fund mogul, the smart people shorting Nvidia are all getting rich using the same framework

Give up on heavily investing in Nvidia's "nine major bottlenecks"! This article analyzes the underlying logic behind top AI investors making billions: physical infrastructure such as electricity, HBM, and optical interconnects are the true keys to wealth in AI hardware.

Contents

Popular coins

Latest Crypto News

Read more
iconiconiconiconiconiconicon
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:[email protected]
VIP Program:[email protected]