'Hacking damage' Flow withdraws network rollback… fraudulent issued tokens isolated

Flow Foundation has finalized a revised recovery plan to resolve the recent fraudulent token issuance incident without rolling back the network.

On the 29th (local time), the Flow Foundation said on X, "After consultations with bridge operators, exchanges, and infrastructure partners, we have prepared a response plan using an 'Isolated Recovery' approach," adding, "Accordingly, there will be no rollback or reconstruction of blockchain records, and legitimate users' transaction histories and account activity will remain unchanged."

The foundation explained that with this measure, more than 99.9% of all accounts will not be affected and will operate normally. At the time of network restart, only accounts verified to have received tokens issued through the attack will be temporarily restricted as a precaution.

The types and quantities of fraudulently issued tokens will be verified through analysis by independent blockchain forensic firms. Afterwards, the Flow core development team will propose a software upgrade to node operators so that the Community Governance Committee can temporarily handle illicit assets. This authority will be activated only through optional participation by node operators, and no single entity can act unilaterally.

Once verification and agreement are complete, accounts included in the attackers' distribution path will be temporarily restricted, and confirmed fraudulent tokens will be transparently burned on-chain. Those accounts will immediately regain normal access rights thereafter, and following completion of all measures, the temporarily granted privileges will be fully revoked through additional upgrades.

Recovery will proceed in stages. First, the Cadence environment will be brought online and the EVM environment will be restricted to read-only. Afterward, asset correction work will be carried out for about 24–48 hours, after which EVM functionality will resume, and bridges and exchanges will resume services at each operator's discretion once stability is confirmed.

Meanwhile, the Flow Foundation said it will share technical details in a public document and will provide further updates on the next steps at a scheduled time.