Flow blockchain probes security incident as FLOW token plunges over 40%

The Flow Foundation announced Saturday that it is investigating a potential security incident affecting its Layer 1 blockchain, prompting major South Korean exchanges to halt token transfers and triggering a sharp selloff in the FLOW token.

“The Flow Foundation is currently investigating a potential security incident affecting the Flow network,” the team wrote on X. “Our engineering teams are actively collaborating with network partners to mitigate the issue. We will provide further, verified updates as soon as they are available.”

Onchain analyst Wazz first flagged what appears to be the exploit shortly after the price crash, estimating around $4 million was stolen. According to Wazz’s analysis, an attacker used a wallet created approximately six months ago to mint millions of wrapped FLOW (WFLOW) tokens through a TransparentUpgradeableProxy contract, a pattern consistent with a private key compromise rather than a smart contract vulnerability.

“Flow blockchain had [a possible vulnerability] that allowed the attacker to mint native token, FLOW, and other bridged tokens like WBTC, WETH, and stablecoins,” security expert Taylor Monahan told The Block in a direct message. “Looks like $3.9 million [lost]…All pools and bridges are now paused.” 

FLOW plummeted more than 40% in the hours following the incident, per The Block’s Flow Price page. The token was trading around $0.10 Saturday afternoon, down from approximately $0.17 earlier in the day. Trading volume has surged to over $170 million in the past 24 hours.

South Korean exchanges Upbit and Bithumb moved quickly to suspend FLOW deposits and withdrawals following the disclosure. The Digital Asset Exchange Alliance, or DAXA, the consortium comprising Korea’s five largest crypto exchanges, issued a formal “transaction risk warning” for the token and said member exchanges may take additional protective measures, including trading restrictions or termination of support, depending on how the situation develops.

Flow is the Layer 1 blockchain developed by Dapper Labs, the company behind popular NFT projects NBA Top Shot and CryptoKitties. The network was designed specifically for consumer applications and digital collectibles, and at its peak in 2021 powered hundreds of millions of dollars in monthly NFT trading volume.

The blockchain has faced challenges in recent years as the NFT market cooled. Dapper Labs, which was valued at $7.6 billion in 2021, has undergone multiple rounds of layoffs since 2022. The Flow Foundation did not immediately respond to a request for further information on the breach from The Block. 

The incident comes as the crypto industry grapples with a record year for security breaches. Cryptocurrency theft totaled more than $3.4 billion in 2025, according to Chainalysis, with the $1.5 billion Bybit hack in February accounting for nearly half of the annual total. Private key compromises have emerged as a leading attack vector this year, accounting for 88% of stolen funds in Q1 2025.

© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.