Find Labs

We are an experienced developer team designing custom web3 solutions | Products: @FindonFlow & @flowscanIO | Clients: @doodles, @aera_football and more.

[Find Labs @findlabs]

FLOW NETWORK INCIDENT: Forensic Fund Tracking Report

FindLabs is publishing the following analysis in collaboration with the
Flow Foundation's security and engineering teams, who conducted the
primary forensic investigation.

• INCIDENT CONFIRMATION

On December 27, 2025, an attacker exploited a vulnerability in Flow's
execution layer. The attacker then moved assets off-network — primarily
through bridges to Ethereum — before validators executed a coordinated
network halt.

Confirmed funds exited to date total approximately $3.9M, with forensic
analysis ongoing.

Critically, this exploit did not access or affect existing user balances.
All user deposits remain intact.

The vulnerability has been identified and isolated. A full technical
post-mortem will be published within 72 hours.

• ATTACKER WALLET (ETHEREUM)

0x2e7C4b71397f10c93dC0C2ba6f8f179a47F994e1

All confirmed exit transactions route through this address. Freeze requests
have been submitted to exchanges and stablecoin issuers.

• CONFIRMED EXIT TRANSACTIONS

The following exit paths have been identified and verified. Confirmed
funds exited to date: ~$3.9M USD equivalent. Forensic analysis is ongoing
and this report will be updated as additional transactions are identified.

CELER BRIDGE — 297.69 ETH
- 74.422 ETH — https://t.co/PScCjlFszD
- 74.422 ETH — https://t.co/H6qYtBEl4N
- 74.422 ETH — https://t.co/G8vzuBpHaO
- 74.422 ETH — https://t.co/vHJR2vuHL0

DEBRIDGE — 479.35 ETH (includes USDC conversions)
- 49.359 ETH — https://t.co/LYMAjoJMo0
- 151.781 ETH — https://t.co/lGkdKmkZEs
- 123.30 ETH — https://t.co/iDpz44nvJi
- 14.932 ETH — https://t.co/vHJR2vuHL0
- [+ 10 additional transactions ranging 11-17 ETH each]

DIRECT WITHDRAWALS — 109.19 ETH
- 90.299 ETH (Binance) — https://t.co/N99h2w4snl
- 18.89 ETH (Binance) — https://t.co/9coyRI8p28

RELAY BRIDGE — 39.44 ETH
- 39.44 ETH — https://t.co/ODAzGdx5Kq

STARGATE — 9.98 ETH
- 4.99 ETH — https://t.co/UJAdsb5OVl
- 4.99 ETH — https://t.co/EQsTH4Jpjg

WBTC — 9.8 WBTC (~$930K)
- 4.9 WBTC — https://t.co/diXWNYFF9d
- 4.9 WBTC — https://t.co/mZToW68sPD

PYUSD — 339K PYUSD (converted to ~261 ETH)
- 279K PYUSD — https://t.co/3iosE4wl8j
- 60K PYUSD — https://t.co/jZvs9pXuwF

• ACTIVE LAUNDERING DETECTED

The attacker is actively attempting to launder funds through
privacy-preserving protocols:

THORCHAIN (ETH → BTC conversion)
- 250 ETH — https://t.co/RigjQh0uVE
- 248 ETH — https://t.co/03dPn5ASux
- 287 ETH — https://t.co/TC5yIQQEyq

CHAINFLIP (ETH → BTC conversion)
- 50.6 ETH — https://t.co/LU5zAe2n8f
- 258.14 ETH — https://t.co/5CvzfGKyjk
- 258.82 ETH — https://t.co/fZoQUzRz2j

• CONTAINMENT STATUS
✅ Flow network halted — no further unauthorized activity possible
✅ Exit transactions identified to date mapped above
✅ Freeze requests submitted to Circle, Tether, Binance, Coinbase, Kraken
✅ Forensic partners and law enforcement engaged
✅ User funds unaffected — exploit did not access existing balances

• NEXT STEPS

The protocol fix has been developed and is entering final validation.

→ Target restart: Within 4-6 hours, pending successful testnet validation
→ Next status update from Flow Foundation: Within 2 hours
→ Full technical post-mortem: Within 72 hours

This report will be updated as fund movement continues.

[Find Labs @findlabs]

@SAPNFTBULL @JcyzJeffrey @flow_blockchain This is a great question, one that we are just as keen to have answered. Currently, our role has been to assist in the investigation and ensure the continued operation of vital infrastructure. No doubt that will be dealt with in tandem with this.

[Find Labs @findlabs]

Very pleased to see this. A remarkably expeditious feat pulled together by a whole community of people. Very hard to take positives from things like this, but we can certainly take heart from the Herculean effort put in by many people during what should be a time of peace and enjoyment with friends and families.

Well done to everyone involved for an excellent response to a horrendous act.

I can finally go get a beer!....at least after monitoring for a bit

[Flow.com @flow_blockchain]

UPDATE: FLOW NETWORK FULLY OPERATIONAL - CADENCE AND EVM ENVIRONMENTS LIVE

This milestone marks the completion of one of the most complex recovery operations in blockchain history. What was initially projected as a sequential, multi-day process has been executed in parallel, restoring both Cadence and EVM functionality while maintaining surgical precision in removing fraudulent assets and preserving legitimate transaction history.

NETWORK STATUS: BOTH EXECUTION ENVIRONMENTS OPERATIONAL
✅ Cadence VM: LIVE
✅ Flow EVM: LIVE
✅ Phase 2 cleanup: Continuing in parallel with full network operation
🔄 Account restoration: Ongoing as individual verification completes
🔄 Fraudulent token remediation: In progress via transparent on-chain transactions

Over 99.9% of accounts have full operational access across both Cadence and EVM environments.

ECOSYSTEM RESTORATION IN PROGRESS

DeFi ecosystem on Flow is resuming operations:
Live: @KittyPunch_xyz and @IncrementFi DEXs are operational and processing transactions

Resuming: Bridge partners are actively working on restoration protocols and expect to resume operations following final verification

TECHNICAL POST-MORTEM

A comprehensive technical post-mortem detailing the complete attack vector, forensic analysis and remediation approach will be published within 48 hours.

NEXT STEPS
→ Cadence & EVM: Both environments operational, final account remediation ongoing
→ DeFi Protocols: Continuing staged resumption as verification completes
→ Bridge/exchange resumption at operator discretion
→ Phase 4: Complete ecosystem restoration expected this week

The network is secure, operational, and processing transactions across both execution environments.

Technical implementation details available in the Flow Network Recovery: Technical Implementation Plan ↓
https://t.co/yqh4FJr9BC

[Flow.com @flow_blockchain]

UPDATE: FLOW NETWORK FULLY OPERATIONAL - CADENCE AND EVM ENVIRONMENTS LIVE

This milestone marks the completion of one of the most complex recovery operations in blockchain history. What was initially projected as a sequential, multi-day process has been executed in parallel, restoring both Cadence and EVM functionality while maintaining surgical precision in removing fraudulent assets and preserving legitimate transaction history.

NETWORK STATUS: BOTH EXECUTION ENVIRONMENTS OPERATIONAL
✅ Cadence VM: LIVE
✅ Flow EVM: LIVE
✅ Phase 2 cleanup: Continuing in parallel with full network operation
🔄 Account restoration: Ongoing as individual verification completes
🔄 Fraudulent token remediation: In progress via transparent on-chain transactions

Over 99.9% of accounts have full operational access across both Cadence and EVM environments.

ECOSYSTEM RESTORATION IN PROGRESS

DeFi ecosystem on Flow is resuming operations:
Live: @KittyPunch_xyz and @IncrementFi DEXs are operational and processing transactions

Resuming: Bridge partners are actively working on restoration protocols and expect to resume operations following final verification

TECHNICAL POST-MORTEM

A comprehensive technical post-mortem detailing the complete attack vector, forensic analysis and remediation approach will be published within 48 hours.

NEXT STEPS
→ Cadence & EVM: Both environments operational, final account remediation ongoing
→ DeFi Protocols: Continuing staged resumption as verification completes
→ Bridge/exchange resumption at operator discretion
→ Phase 4: Complete ecosystem restoration expected this week

The network is secure, operational, and processing transactions across both execution environments.

Technical implementation details available in the Flow Network Recovery: Technical Implementation Plan ↓
https://t.co/yqh4FJr9BC

[Find Labs @findlabs]

@intangible_eth appreciate that a lot. We have been here a while, always looking out for people.

[Find Labs @findlabs]

As the team behind Flowscan, the Flow block explorer, we were well positioned to see, monitor and engage in events that unfolded.

What we witnessed was remarkable coordination under pressure. The Foundation proposed an initial approach. Bridge operators and ecosystem builders raised technical constraints. The plan was revised based on that feedback. Validators evaluated the new proposal and reached consensus. The response required genuine collaboration between parties under high stress. It takes serious stewardship to be responsive to ecosystem feedback, yet be ready to make the hard choices at the right time.

Flowscan continues to provide transparent visibility into the ongoing remediation. Every cleanup transaction to remove the fraudulent tokens is publicly auditable on-chain. Every affected account restoration is verifiable in real time.

This incident tested Flow's infrastructure in ways no one wanted. What remains is a secure network, with no user funds directly touched. This was something unlike anything we have witnessed before.

Find Labs has been building on Flow for five years. We've watched this ecosystem mature through multiple upgrade cycles and network milestones. This weekend reinforced why we remain committed to this platform. We feel proud to be working with some of the best minds in crypto.

To us Flow represents something larger than any single incident. Its vision of taking crypto mainstream is what we deeply believe in and it has a track record to prove why they can do it again. Its infrastructure built on solid technical foundations and supported by partners who show up when it matters.

We're more committed than ever to building here and contributing to this ecosystem's continued development and we hope you will join us in supporting this next phase.

[Flow.com @flow_blockchain]

UPDATE: FLOW NETWORK IS LIVE - PHASE 1 OPERATIONAL

The Flow network has successfully transitioned to Phase 1 operational status at 6am PT.

CURRENT STATUS: PHASE 1 ACTIVE
✅ Cadence environment: Operational
✅ Network producing blocks and processing transactions
✅ Over 99.9% of accounts: Full functionality restored
🔄 EVM environment: Temporarily restricted (read-only mode)
🔄 Suspected impacted accounts: Temporarily restricted pending remediation

WHAT THIS MEANS

Users can now resume normal activity on the Cadence environment. The network is stable, secure, and processing transactions as expected.

The EVM environment remains in read-only mode during the remediation process and will be restored in Phase 3 following Cadence cleanup verification.

ACKNOWLEDGMENTS

This restoration was made possible through extraordinary collaboration across the Flow ecosystem. The Foundation extends its gratitude to:
→ Node operators and validators for their swift consensus and deployment coordination
→ Bridge operators for their technical consultation and patient coordination during the review process
→ Exchanges for their infrastructure alignment and partnership throughout remediation planning
→ DEXs and ecosystem partners for their feedback that shaped this approach

The unified response from the Flow community has been exceptional. This collaborative effort demonstrates the strength and resilience of decentralized infrastructure when ecosystem participants work together toward a common goal.

NEXT STEPS
→ Phase 2: Cadence remediation ongoing (24-48 hours)
→ Phase 3: EVM restoration following Cadence verification
→ Phase 4: Bridge/exchange resumption at operator discretion
→ Next status update: Within 24 hours on Phase 2 progress

The list of suspected incident impacted wallets is contained in the Flow Network Recovery: Technical Implementation Plan ⤵️
https://t.co/yqh4FJr9BC

[Find Labs @findlabs]

@Prof_math99 Unknown at this stage

[Find Labs @findlabs]

FLOW NETWORK INCIDENT: Forensic Fund Tracking Report

FindLabs is publishing the following analysis in collaboration with the
Flow Foundation's security and engineering teams, who conducted the
primary forensic investigation.

• INCIDENT CONFIRMATION

On December 27, 2025, an attacker exploited a vulnerability in Flow's
execution layer. The attacker then moved assets off-network — primarily
through bridges to Ethereum — before validators executed a coordinated
network halt.

Confirmed funds exited to date total approximately $3.9M, with forensic
analysis ongoing.

Critically, this exploit did not access or affect existing user balances.
All user deposits remain intact.

The vulnerability has been identified and isolated. A full technical
post-mortem will be published within 72 hours.

• ATTACKER WALLET (ETHEREUM)

0x2e7C4b71397f10c93dC0C2ba6f8f179a47F994e1

All confirmed exit transactions route through this address. Freeze requests
have been submitted to exchanges and stablecoin issuers.

• CONFIRMED EXIT TRANSACTIONS

The following exit paths have been identified and verified. Confirmed
funds exited to date: ~$3.9M USD equivalent. Forensic analysis is ongoing
and this report will be updated as additional transactions are identified.

CELER BRIDGE — 297.69 ETH
- 74.422 ETH — https://t.co/PScCjlFszD
- 74.422 ETH — https://t.co/H6qYtBEl4N
- 74.422 ETH — https://t.co/G8vzuBpHaO
- 74.422 ETH — https://t.co/vHJR2vuHL0

DEBRIDGE — 479.35 ETH (includes USDC conversions)
- 49.359 ETH — https://t.co/LYMAjoJMo0
- 151.781 ETH — https://t.co/lGkdKmkZEs
- 123.30 ETH — https://t.co/iDpz44nvJi
- 14.932 ETH — https://t.co/vHJR2vuHL0
- [+ 10 additional transactions ranging 11-17 ETH each]

DIRECT WITHDRAWALS — 109.19 ETH
- 90.299 ETH (Binance) — https://t.co/N99h2w4snl
- 18.89 ETH (Binance) — https://t.co/9coyRI8p28

RELAY BRIDGE — 39.44 ETH
- 39.44 ETH — https://t.co/ODAzGdx5Kq

STARGATE — 9.98 ETH
- 4.99 ETH — https://t.co/UJAdsb5OVl
- 4.99 ETH — https://t.co/EQsTH4Jpjg

WBTC — 9.8 WBTC (~$930K)
- 4.9 WBTC — https://t.co/diXWNYFF9d
- 4.9 WBTC — https://t.co/mZToW68sPD

PYUSD — 339K PYUSD (converted to ~261 ETH)
- 279K PYUSD — https://t.co/3iosE4wl8j
- 60K PYUSD — https://t.co/jZvs9pXuwF

• ACTIVE LAUNDERING DETECTED

The attacker is actively attempting to launder funds through
privacy-preserving protocols:

THORCHAIN (ETH → BTC conversion)
- 250 ETH — https://t.co/RigjQh0uVE
- 248 ETH — https://t.co/03dPn5ASux
- 287 ETH — https://t.co/TC5yIQQEyq

CHAINFLIP (ETH → BTC conversion)
- 50.6 ETH — https://t.co/LU5zAe2n8f
- 258.14 ETH — https://t.co/5CvzfGKyjk
- 258.82 ETH — https://t.co/fZoQUzRz2j

• CONTAINMENT STATUS
✅ Flow network halted — no further unauthorized activity possible
✅ Exit transactions identified to date mapped above
✅ Freeze requests submitted to Circle, Tether, Binance, Coinbase, Kraken
✅ Forensic partners and law enforcement engaged
✅ User funds unaffected — exploit did not access existing balances

• NEXT STEPS

The protocol fix has been developed and is entering final validation.

→ Target restart: Within 4-6 hours, pending successful testnet validation
→ Next status update from Flow Foundation: Within 2 hours
→ Full technical post-mortem: Within 72 hours

This report will be updated as fund movement continues.

[Find Labs @findlabs]

@chasefleming Thank you 🙏🙏

[Find Labs @findlabs]

End of Year Update 2025
Contract Browser overhaul on Flowscan, Omnisearch NFT upgrades, Prism, API access changes, and a look ahead to 2026 🔥
https://t.co/JwUIoVhCsD

[Find Labs @findlabs]

Introducing Prism 🔍

Inspect the current on-chain state of any @flow_blockchain account and deploy or update Cadence contracts directly.

Built for clarity, correctness, and direct chain interaction - all open source.

Read the full announcement 👇
https://t.co/SEaZnm8beB

[Find Labs @findlabs]

@roham 👏Great direction to be going 🔥 and Flow continuing to grow it's powerhouse of unique features

[Find Labs @findlabs]

Flow is the dark horse of Blockchains. The tech being built is fantastic!

[Flow.com @flow_blockchain]

https://t.co/MMH7ybn0af

[Find Labs @findlabs]

@tradertrader350 Wonderful, congratulations 👏👏

[Find Labs @findlabs]

@BabyBoomWeb3 @flow_blockchain Congratulations 👏👏🔥🔥

[0xIrham @BabyBoomWeb3]

Wow, I'm truly humbled. I’m honored to share that my #ForteHacks project, WatcherForte, was recognized with 3 awards.

My main goal was simply to learn from @flow_blockchain, so this recognition is truly unexpected. A huge thank you to the Flow team, the partners @findlabs @dapperlabs etc, and the judges for this incredible honor. More committed than ever to mastering Cadence & building on Flow.

Big thanks also to @HackQuest_ID @HackQuest_

[Find Labs @findlabs]

@flow_blockchain Fantastic work.. Congratulations to the winning teams 👏👏 It's great to see so much innovation happening on Flow

[Flow.com @flow_blockchain]

https://t.co/cjVswG8qF4

[Find Labs @findlabs]

@flow_blockchain Well done to @flow_blockchain for another excellent Hackathon and congratulations to the winning teams 👏👏

[Flow.com @flow_blockchain]

You can now see the future on Flow thanks to @findlabs

Scheduled Transactions are now live on Flowscan Testnet, letting anyone view upcoming and executed onchain automations.

A key piece of the Forte upgrade: fully onchain scheduling and automation.

https://t.co/FfKCWVSZ2B

[flowscan @flowscanIO]

We just published the Flowscan Q4 2025 Update
with a trove of new features and refinements for @flow_blockchain!
- Design Overhaul
- Tags & Layouts
- Scheduled Transactions
- Contract Verification

https://t.co/1WdD8GQLnm