FLOW NETWORK INCIDENT: Forensic Fund Tracking Report FindLabs is publishing the following analysis in collaboration with the Flow Foundation's security and engineering teams, who conducted the primary forensic investigation. • INCIDENT CONFIRMATION On December 27, 2025, an attacker exploited a vulnerability in Flow's execution layer. The attacker then moved assets off-network — primarily through bridges to Ethereum — before validators executed a coordinated network halt. Confirmed funds exited to date total approximately $3.9M, with forensic analysis ongoing. Critically, this exploit did not access or affect existing user balances. All user deposits remain intact. The vulnerability has been identified and isolated. A full technical post-mortem will be published within 72 hours. • ATTACKER WALLET (ETHEREUM) 0x2e7C4b71397f10c93dC0C2ba6f8f179a47F994e1 All confirmed exit transactions route through this address. Freeze requests have been submitted to exchanges and stablecoin issuers. • CONFIRMED EXIT TRANSACTIONS The following exit paths have been identified and verified. Confirmed funds exited to date: ~$3.9M USD equivalent. Forensic analysis is ongoing and this report will be updated as additional transactions are identified. CELER BRIDGE — 297.69 ETH - 74.422 ETH — etherscan.io/tx/0xbf3f95b0fe… - 74.422 ETH — etherscan.io/tx/0xe6f55f2048… - 74.422 ETH — etherscan.io/tx/0x106b8db435… - 74.422 ETH — etherscan.io/tx/0x9d6684f6f8… DEBRIDGE — 479.35 ETH (includes USDC conversions) - 49.359 ETH — etherscan.io/tx/0x2d347295a0… - 151.781 ETH — etherscan.io/tx/0x1eae85eed6… - 123.30 ETH — etherscan.io/tx/0x3b56718613… - 14.932 ETH — etherscan.io/tx/0x9d6684f6f8… - [ 10 additional transactions ranging 11-17 ETH each] DIRECT WITHDRAWALS — 109.19 ETH - 90.299 ETH (Binance) — etherscan.io/tx/0xcf20b2c7f7… - 18.89 ETH (Binance) — etherscan.io/tx/0x6e5b6fb957… RELAY BRIDGE — 39.44 ETH - 39.44 ETH — etherscan.io/tx/0x6bc9883007… STARGATE — 9.98 ETH - 4.99 ETH — etherscan.io/tx/0x22a55360d2… - 4.99 ETH — etherscan.io/tx/0x4378c69889… WBTC — 9.8 WBTC (~$930K) - 4.9 WBTC — etherscan.io/tx/0xe00dee9daf… - 4.9 WBTC — etherscan.io/address/0x2e7c4… PYUSD — 339K PYUSD (converted to ~261 ETH) - 279K PYUSD — etherscan.io/tx/0x52580ac81a… - 60K PYUSD — etherscan.io/tx/0xeb3f5cf061… • ACTIVE LAUNDERING DETECTED The attacker is actively attempting to launder funds through privacy-preserving protocols: THORCHAIN (ETH → BTC conversion) - 250 ETH — etherscan.io/txs?a=0x2e7c4b7… - 248 ETH — etherscan.io/tx/0x83099b48a4… - 287 ETH — etherscan.io/tx/0x82276037a2… CHAINFLIP (ETH → BTC conversion) - 50.6 ETH — etherscan.io/tx/0x74330ac390… - 258.14 ETH — etherscan.io/tx/0x6d250dc073… - 258.82 ETH — etherscan.io/tx/0x3c18a6daf4… • CONTAINMENT STATUS ✅ Flow network halted — no further unauthorized activity possible ✅ Exit transactions identified to date mapped above ✅ Freeze requests submitted to Circle, Tether, Binance, Coinbase, Kraken ✅ Forensic partners and law enforcement engaged ✅ User funds unaffected — exploit did not access existing balances • NEXT STEPS The protocol fix has been developed and is entering final validation. → Target restart: Within 4-6 hours, pending successful testnet validation → Next status update from Flow Foundation: Within 2 hours → Full technical post-mortem: Within 72 hours This report will be updated as fund movement continues.

Very pleased to see this. A remarkably expeditious feat pulled together by a whole community of people. Very hard to take positives from things like this, but we can certainly take heart from the Herculean effort put in by many people during what should be a time of peace and enjoyment with friends and families. Well done to everyone involved for an excellent response to a horrendous act. I can finally go get a beer!....at least after monitoring for a bit

RT @flow_blockchain: UPDATE: FLOW NETWORK FULLY OPERATIONAL - CADENCE AND EVM ENVIRONMENTS LIVE This milestone marks the completion of one…

As the team behind Flowscan, the Flow block explorer, we were well positioned to see, monitor and engage in events that unfolded. What we witnessed was remarkable coordination under pressure. The Foundation proposed an initial approach. Bridge operators and ecosystem builders raised technical constraints. The plan was revised based on that feedback. Validators evaluated the new proposal and reached consensus. The response required genuine collaboration between parties under high stress. It takes serious stewardship to be responsive to ecosystem feedback, yet be ready to make the hard choices at the right time. Flowscan continues to provide transparent visibility into the ongoing remediation. Every cleanup transaction to remove the fraudulent tokens is publicly auditable on-chain. Every affected account restoration is verifiable in real time. This incident tested Flow's infrastructure in ways no one wanted. What remains is a secure network, with no user funds directly touched. This was something unlike anything we have witnessed before. Find Labs has been building on Flow for five years. We've watched this ecosystem mature through multiple upgrade cycles and network milestones. This weekend reinforced why we remain committed to this platform. We feel proud to be working with some of the best minds in crypto. To us Flow represents something larger than any single incident. Its vision of taking crypto mainstream is what we deeply believe in and it has a track record to prove why they can do it again. Its infrastructure built on solid technical foundations and supported by partners who show up when it matters. We're more committed than ever to building here and contributing to this ecosystem's continued development and we hope you will join us in supporting this next phase.

End of Year Update 2025 Contract Browser overhaul on Flowscan, Omnisearch NFT upgrades, Prism, API access changes, and a look ahead to 2026 🔥 findonflow.medium.com/1b98f9…

Introducing Prism 🔍 Inspect the current on-chain state of any @flow_blockchain account and deploy or update Cadence contracts directly. Built for clarity, correctness, and direct chain interaction - all open source. Read the full announcement 👇 findonflow.medium.com/prism-…

Flow is the dark horse of Blockchains. The tech being built is fantastic!

Wow, I'm truly humbled. I’m honored to share that my #ForteHacks project, WatcherForte, was recognized with 3 awards. My main goal was simply to learn from @flow_blockchain, so this recognition is truly unexpected. A huge thank you to the Flow team, the partners @findlabs @dapperlabs etc, and the judges for this incredible honor. More committed than ever to mastering Cadence & building on Flow. Big thanks also to @HackQuest_ID @HackQuest_

You can now see the future on Flow thanks to @findlabs Scheduled Transactions are now live on Flowscan Testnet, letting anyone view upcoming and executed onchain automations. A key piece of the Forte upgrade: fully onchain scheduling and automation. link.flow.com/Flowscan-Sched…

We just published the Flowscan Q4 2025 Update with a trove of new features and refinements for @flow_blockchain! - Design Overhaul - Tags & Layouts - Scheduled Transactions - Contract Verification medium.com/p/flowscan-q4-202…

Forte Hacks Partner: @findlabs Find Labs is one of the most experienced companies in the Flow ecosystem and have been building #onFlow since its inception. They run @flowscan along with the Find Labs API and have built multiple innovative solutions for companies such as @cryptokitties, @doodles and OneFootball. They’re offering mentoring and API access to aid hackathon participants for this momentous upgrade.

Flow is proud to have @findlabs as a Forte Hacks partner! Find Labs is one of the most experienced companies in the Flow ecosystem, building #onFlow since its inception and for multiple top projects. They’re offering mentoring, API access and prizes. Earn your share of $250k ⤵️

"If all you want a blockchain to do is what blockchains do today, then all the other blockchains are fine. But if you genuinely believe that this technology can do more, then you need a blockchain that is capable of more" - @dete73, Creator of ERC-721 Full video ⤵️

Scheduled maintenance: The EVM side of Flowscan and the API will be unavailable on Monday, 15 September, between 09:00–11:00 GMT (up to 2 hours). Thank you for your patience.

Forte brings protocol composability and native automation directly to the network. Forte is coming: • Testnet: September 17 • Mainnet: October 22 Watch @dete73 announce Forte, the future of consumer crypto and AI, at the @EthGlobal Pragma main stage⤵️

$FLOW hit 100 million in tvl 🎉

On Flow, real-time onchain data isn’t a nice-to-have, it’s the standard. With @findlabs x @QuickNode, accounting, compliance, and reporting just got a major upgrade. Developers, builders, and businesses, this one’s for you.

😼 Shout out to all the CK Gang! The next phase of the Page's Gang Meowcoins event started today 10 AM PDT – and this time, it’s all about eggs plus sweet, sweet LP action. 💸 Find out how to earn your share of rewards, with about 4206.9 $HotCocoa available every hour for the next two weeks! ⤵️