The Flow Foundation says it has made strong progress fixing the damage from last week’s $3.9 million exploit, and parts of the network may be back online sooner than expected.
In an update shared on January 1, Flow said its recovery plan has now moved into phase two. The biggest news is that developers have found a way to restore EVM functionality early, while work continues on Flow’s native Cadence environment at the same time.
That means both systems can be fixed in parallel, instead of one after the other.
According to Flow, if everything goes smoothly, the EVM network could be live again within 24 hours of the announcement.
How the Recovery Is Working
To make this happen, Flow’s Community Governance Council, working with validators, is carrying out controlled cleanup transactions within strict limits.
On the Cadence side, teams are going through accounts one by one to identify and destroy any tokens that were fraudulently created during the exploit.
Meanwhile, the EVM layer is being brought back online with added safeguards. Some accounts flagged as suspicious will face temporary restrictions, while the rest of the network gradually returns to normal activity.
Flow says it’s also working with external forensic firms to speed things up without cutting corners.
Once everything is fully restored, Flow expects more than 99.9% of user accounts to have full access to their funds and be able to transact normally across both Cadence and EVM.
What Happened in the Exploit
The trouble started on December 27, when Flow was forced to halt the network after a serious bug was found in its cross-chain communication logic. The flaw allowed an attacker to mint about 150 million FLOW tokens and move millions of dollars’ worth of assets to outside exchanges.
In total, around $3.9 million was drained. The price of FLOW then collapsed nearly 50%, made worse by major South Korean exchanges suspending trading and transfers.
At first, Flow suggested a full-chain rollback to undo the damage. But the idea quickly ran into heavy backlash from the community, with many warning it would raise centralization concerns and threaten transaction finality.
After listening to feedback, the Foundation dropped that idea and switched to the current multi-phase, targeted recovery plan.
What’s Next
Right now, Cadence cleanup (Phase 2) and EVM reactivation (Phase 3) are happening at the same time. The final step, Phase 4, will reopen cross-chain bridges and allow exchanges to resume activity.
Flow says that step will only happen after the network passes a full stability check.
For now, the message from Flow is cautiously optimistic: the fix is complicated, but progress is real—and most users should be back to normal very soon.
