Flow moves to Phase 2 recovery; EVM expected back within 24 hours after $3.9M exploit
Flow Foundation has advanced to Phase 2 of a targeted recovery after a Dec. 27 exploit that led to roughly $3.9 million in assets and the illicit minting of 150 million FLOW. Developers say the Ethereum Virtual Machine (EVM) layer can be restored faster than originally planned, potentially within 24 hours if no blockers emerge. Recovery runs in parallel: an account-by-account Cadence cleanup to destroy fraudulently minted tokens and a constrained EVM re-enablement using validator-approved cleanup transactions. The team abandoned a full chain rewind after community pushback and chose a surgical approach that freezes suspicious accounts, reverts illegitimate tokens, and preserves valid on-chain activity. Flow estimates over 99.9% of accounts will regain full access once both Cadence and EVM are restored. The incident forced some services offline, triggered exchange halts and a near-50% drop in FLOW price at one point. Forensics and audits continue with validators, bridge providers, exchanges and independent partners; final phases will only reopen bridges and exchange activity after conclusive verification of network stability.
Bearish
Short-term bearish: The exploit caused immediate market stress — exchange halts, service outages and a near-50% drop in FLOW price — and uncertainty remains while cleanup and forensics continue. Temporary account restrictions and suspended bridge/exchange activity limit liquidity and trading depth, which typically keeps downward pressure on price and increases volatility. Medium-term mixed: successful, transparent recovery that restores EVM within 24 hours and returns >99.9% of accounts would reduce uncertainty and could stabilize the token, but confidence damage from the breach (including large illicit FLOW minting and rapid exchange withdrawals) may depress demand and slow recovery. Long-term depends on audit outcomes, bridge/exchange responses and whether validators and ecosystem partners fully close the exploited paths. If remediation is thorough and audited, price could recover; if additional issues or slow re-openings occur, bearish conditions could persist.