Flow officially announced on the X platform that on December 27, 2025, attackers exploited a vulnerability in the Flow execution layer to transfer approximately $3.9 million in assets before the network outage. The attack did not access users' existing balances, and all user deposits are safe. The approximately $3.9 million was primarily transferred out through bridges such as Celer, Debridge, Relay, and Stargate. The attacker's wallet has been identified and flagged, and their money laundering activities through Thorchain and Chainflip are being tracked in real time. The Flow Foundation has submitted freezing requests to Circle, Tether, and major exchanges. The network is currently shut down to cut off all exit paths, and the remediation plan is undergoing final verification. The target restart time is 4 to 6 hours, depending on the testnet verification results. FindLabs is releasing forensic data including transaction hashes and the attacker's Ethereum wallet address.