Flow Security Incident Review: Type Confusion Vulnerability in Cadence Identified as Key Factor

On January 7, Flow released an attack retrospective report, noting attackers exploited a Flow Network vulnerability to mint fake tokens and steal roughly $3.9 million via a bridging attack. The incident did not access or leak existing user balances—assets were duplicated but legitimate holdings remained untouched. Most fake assets were either stored on-chain before liquidation or frozen by exchange partners. Network validators approved a decentralized governance action to permanently destroy all fake assets. The network resumed operations on December 29, runs smoothly now, and all transaction history is preserved. Attackers deployed over 40 malicious smart contracts using a three-stage chain: 1) bypassing attachment import verification; 2) circumventing built-in type defense checks; 3) exploiting a contract initializer semantic vulnerability. **The root cause was a type confusion flaw in the Cadence runtime (v1.8.8), now patched in v1.8.9+. This flaw let attackers disguise non-duplicable protected assets as standard duplicable data structures, bypassing runtime security checks to mint tokens.** Beyond moving assets off Flow, attackers tried depositing fake FLOW on several centralized exchanges (CEXs). Multiple exchanges froze deposits upon receipt due to abnormal transaction volume and internal anti-money laundering (AML) protocols. Roughly 50% of fake FLOW deposits have been returned and destroyed by partner exchanges (including OKX, Gate, MEXC), while the foundation continues coordinating with other platforms.