Flow Foundation Abandons Controversial Rollback Plan Following $3.9M Exploit

Quick Breakdown

• Flow Network suffered a $3.9 million exploit, targeting its core protocol.
• Cadence Foundation proposes a full-state rollback to the pre-exploit snapshot, reversing all transactions.
• Move blindsides key partners, raising concerns over decentralization and user trust.

 

The Flow Foundation has scrapped its controversial plan to roll back the Flow blockchain following a $3.9 million exploit. The initial proposal to revert the network to a pre-attack state sparked intense backlash from ecosystem partners, most notably deBridge founder Alex Smirnov, who warned that a rollback would cause more financial damage than the hack itself. Instead, the Foundation has moved forward with a “revised remediation plan” that avoids a network rollback, preserving legitimate user activity while isolating the stolen funds.

Outcry over proposed “rushed decision”

The drama began after an attacker exploited a flaw in Flow’s execution layer to unauthorizedly mint tokens and siphon funds through various cross-chain bridges. In response, Flow developers initially suggested a global rollback to a checkpoint before the exploit.

Alex Smirnov, co-founder of deBridge, one of Flow’s primary bridge providers, slammed the proposal as a “rushed decision” that blindsided partners. Smirnov argued that a rollback would introduce systemic risks, potentially doubling balances for some users while leaving others with unrecoverable assets. He urged validators to halt operations until a coordinated plan was established.

Strategic pivot to preserve network integrity.

Following the industry outcry, the Flow Foundation shifted its strategy. On December 29, the Foundation

it would focus on destroying the fraudulently minted tokens rather than erasing hours of transaction history.

UPDATE: VALIDATOR CONSENSUS REACHED (MAINNET 28)

To preserve network integrity and prioritize user safety, the Flow Foundation proposed a protocol fix (Mainnet 28) which has been accepted and successfully deployed by network validators.

CURRENT STATUS: IDLE / READ-ONLY
The…

— Flow.com (@flow_blockchain) December 28, 2025

Dapper Labs, the original creator of Flow, publicly supported this revised approach, confirming that “no Dapper Labs user balances or assets are impacted,” including its own treasury. Gabriel Shapiro, General Counsel at Delphi Labs, had also

the earlier plan, suggesting it undermined the fundamental blockchain principle of transaction finality.

Market impact and network status

The security breach and the ensuing governance controversy have taken a heavy toll on the FLOW token. Data

the asset plummeted approximately 42% since the attack, as investors weighed the risks of network centralization.

While the network is transitioning out of “read-only” mode, the incident has highlighted ongoing struggles for the ecosystem. Once a high-profile Layer 1 competitor, Flow’s total value locked (TVL) currently sits at a modest $85.5 million, with its market cap falling outside the top 300 tokens.

In related news, Autonomous AI agents have demonstrated a concerning ability to discover and exploit significant vulnerabilities within blockchain smart contracts, leading to theoretical losses in the millions. Using the specialized SCONE-bench benchmark, researchers demonstrated that advanced language models can efficiently identify both historical flaws and new zero-day vulnerabilities at low operational cost. This alarming development suggests the window for relying on manual security checks is rapidly closing, necessitating the urgent adoption of AI-powered defences to counter these evolving digital threats.