Event Overview

Recently, the public chain project Flow encountered a cybersecurity incident defined as a "poisoning attack," forcing a disruption in the normal operation of its mainnet and drawing concentrated attention from the market regarding its underlying security architecture. According to various publicly available information, this incident was disclosed at the end of 2025 as a malicious attack targeting core network components, resulting in the network being unable to produce blocks and process transactions as expected for a period of time. As the attack was identified and isolated, Flow validators and the core development team entered an emergency response process, moving from shutdown and impact assessment to discussing repair strategies and forming a unified technical and governance plan. Subsequently, after completing key software upgrades and reaching a consensus on remedial protocols, the network gradually restarted and advanced functionality unlocking through a phased recovery plan. During this process, balancing the rapid restoration of network security with adherence to decentralized governance procedures became the core contradiction of this incident, reflecting the institutional challenges faced by public chains in extreme situations.

Attack and Impact

According to market reports, the direct impact of this poisoning attack on the Flow mainnet was first reflected in the interruption of consensus and block production processes, with some block production hindered and normal transactions unable to be packaged on-chain, leading to a sharp decline in on-chain activity. To prevent the attack from spreading further, the network entered a protective shutdown state, pausing general transaction processing and retaining only necessary system-level operations. From a technical stack perspective, Flow's native smart contract environment Cadence and the compatible layer EVM faced varying degrees of functional restrictions: account operation permissions in the Cadence environment were strictly controlled, restored in batches only after passing security assessments; the EVM environment was maintained in read-only mode, allowing developers and applications to query on-chain status but not initiate state-changing transactions. Affected accounts remain in a restricted state at this stage, with some contract calls, transfers, and complex interactions deferred, causing short-term operational uncertainty for ecosystem applications relying on Flow, such as NFTs, games, and DeFi, with some business functions needing to wait for subsequent recovery phases to fully return to normal.

Validator Response

After the attack was confirmed, Flow network validators collectively entered an emergency collaboration mechanism, engaging in multiple rounds of discussions on software upgrades and remedial protocols, ultimately reaching a consensus. According to public statements, all validator nodes agreed to deploy a new version of the software within a short time to eliminate components affected by the poisoning, strengthen security checks, and reserve governance interfaces for subsequent phased recovery. This consensus serves as both a technical and governance prerequisite: in PoS public chains, the collective signature and version switch of validators represent the update permission of on-chain rules. The network's re-launch and restoration of block production were based on the widespread adoption of this upgrade consensus. Meanwhile, Flow officials and several media outlets mentioned that "the network has entered the repair and testing phase," clearly stating that "general transaction reception remains paused to ensure safety," indicating that in terms of recovery priorities, the team and validators chose to place security above availability: first ensuring the consistency and cleanliness of the chain state, then gradually opening transaction flow. Although this decision sacrificed user experience and ecosystem activity in the short term, it helps reduce the possibility of secondary attacks or the amplification of residual risks.

Phased Recovery

According to multiple sources of verification, Flow's recovery plan is designed to proceed in phases, with the technical and governance actions of the first phase starting at 6 AM Pacific Time, marking the network's shift from passive defense to orderly repair. In this phase, the core rhythm is to gradually restore account operation permissions in the Cadence environment rather than unlocking all functions at once. On one hand, Cadence is Flow's native programming language and contract execution environment, where the vast majority of core assets and application logic are hosted; on the other hand, through refined permission restoration, the availability of key accounts and infrastructure can be prioritized before monitoring and auditing conditions are fully restored. In contrast, the EVM environment is deliberately maintained in read-only mode as a temporary security measure: users and developers can query balances, contract statuses, and historical transactions but cannot initiate new write operations in this environment. This "semi-open" state reduces the likelihood of further poisoning or replay attacks exploiting potential residual vulnerabilities. According to official disclosures, approximately 99.9% of Cadence accounts are expected to ultimately restore full functionality, conveying confidence in the recovery efforts while also implying boundaries: about 0.1% of accounts may be delayed due to security reviews, disputed statuses, or technical reasons, and relevant users and project parties need to continue monitoring subsequent announcements to confirm the specific recovery nodes of their assets and contracts.

Data and Signals

From the current publicly available information, Flow officials have repeatedly emphasized that the network has "entered the repair and testing phase," indicating that the mainnet has transitioned from a complete shutdown state to a controlled operational phase, but remains under high monitoring and functional restrictions. At the same time, multiple reports mention that "general transaction reception remains paused to ensure safety," meaning that only specially configured or whitelisted transaction types are allowed on-chain, while most interactions for ordinary users must wait for further release. Combining the timing of "6 AM Pacific Time starting the recovery phase" and the ratio of "99.9% of Cadence accounts expected to restore full functionality," a rough outline of the current recovery progress can be sketched: underlying block production and state maintenance have resumed, and the vast majority of native accounts meet the technical conditions for recovery, while the specific unblocking rhythm will be executed according to the phased plan. Meanwhile, the 0.1% of accounts that are temporarily restricted, the EVM environment still in read-only status, and the general transaction reception function that has not yet been opened all indicate that the network still carries certain residual risks and uncertainties, potentially involving complex contracts, suspicious activities, or states requiring further audits. These technical and governance "tail issues" will determine whether this recovery can ultimately be viewed by the market as a successful conclusion.

Security and Governance

A significant tension exposed by this poisoning attack lies in the difficult-to-reconcile relationship between urgent security upgrades and decentralized governance. To quickly stem the bleeding, Flow validators and the core team had to reach consensus on software upgrades and remedial protocols within a short time, which in practice often means a more centralized and efficient decision-making mechanism, inherently conflicting with the idealized governance model of complete decentralization and slow voting. In crisis management, the decision-making power of validators is reflected in: who has the authority to decide on shutdowns, upgrades, rollbacks, or restrictions on certain types of transactions; the boundary of responsibility is reflected in who should bear the coordination and compensation responsibilities if the upgrade introduces new risks or adversely affects specific users. Mechanically, Flow's response this time is similar to the handling paths of most public chains when encountering security incidents: completing emergency upgrades through validator voting or core maintainer coordination, then restoring functions in phases, rather than through conventional on-chain voting or long-term community negotiations; the difference may lie in its differentiated treatment of the Cadence and EVM environments, as well as the refined recovery design aimed at "99.9% of accounts being recoverable." For the entire industry, such events again highlight the need for public chains to find an operable middle ground between security and decentralization, embedding crisis governance procedures into protocols in an institutionalized manner to reduce ad-hoc decision-making and governance disputes under pressure.

Follow-up Observations

From the current publicly available information, Flow's response path after this poisoning attack clearly leans towards prioritizing security in the trade-off between security and governance, on one hand quickly reaching an upgrade consensus among validators and pausing general transaction reception to prevent further deterioration of the on-chain state; on the other hand, striving to provide the market with a relatively clear expectation through phased recovery rhythms and clear recovery ratio targets. Its shortcomings lie in the restricted accounts and EVM read-only status, which weakened the continuity of ecosystem applications for a period and may also impose trust pressure on developers and users. Key milestones that need to be closely tracked in the future include: the full unblocking progress of affected accounts, the time window for the EVM environment to transition from read-only to writable, and the security assessment results and third-party audit reports when the network fully restores functionality (including high-frequency trading and complex contract calls). Additionally, the regulatory response to this incident, as well as the reassessment of Flow's risk management mechanisms by trading platforms and institutional participants, will all impact the medium- to long-term ecological development: if the recovery process is transparent, audits are sufficient, and no new security incidents are exposed subsequently, it is expected to gradually restore market trust; conversely, if tail risks remain unresolved for a long time or information disclosure is insufficient, it may constrain Flow's position adjustment in the public chain competitive landscape.

Join our community to discuss and become stronger together!
Official Telegram community: https://t.me/aicoincn
AiCoin Chinese Twitter: https://x.com/AiCoinzh

OKX benefits group: https://aicoin.com/link/chat?cid=l61eM4owQ
Binance benefits group: https://aicoin.com/link/chat?cid=ynr7d1P6Z

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。