As part of the remediation process following the December 27 security incident, two on-chain burns were executed in January to permanently remove all counterfeit FLOW identified during recovery.
This was first announced in the Technical Post Mortem, along with all relevant details of the security incident, which can be found here: https://flow.com/post/dec-27-technical-post-mortem
As outlined in the post-mortem, this was part of the isolated recovery plan focused on tracing, reclaiming, and destroying counterfeit assets without impacting legitimate network history.
The destruction, executed on-chain by the Community Governance Council, removes all seized counterfeit assets from circulation. This action completed the final mechanical step of the isolated recovery plan.
The network has been operating normally since validators deployed the security patch within 24 hours of the incident, with additional safeguards now implemented across the protocol. Here’s the relevant transaction information on the destruction of the tokens:
January 6 — 484,434,923.21 FLOW burned
The initially recovered counterfeit FLOW was isolated and permanently destroyed:.
FLOW Transaction: 88782f3fa88ff1054b9047c007bf3e3ffbaa015eceb3f32c472c4ec595ead215
January 30 — 87,426,151,401.99 FLOW burned
The remaining counterfeit FLOW was seized and permanently destroyed. There was also an additional destruction of counterfeit wETH and wBTC assets.
FLOW Transaction ID: 371dd2cf89f76e21c7e4b0c45cafc49f6181e22aec1b2569bf773f66b74ff5ef
wETH Transaction ID: d6c36b3ffeec306e4526170a3b9d5816d92f0aeafbcef77500b578f50457949e
wBTC Transaction ID: 5bc64e197e0fc68284613180aec7eae752b4c3e45bbbfaee12186fb63bd1396d
A number of counterfeit FLOW tokens (approximately 50M) were mixed with valid tokens when the attacker traded FLOW onto DEXes. Due to how DEXes function, it is impossible to differentiate between valid and invalid tokens in this context. To address this imbalance, the Flow Foundation will acquire that many tokens (~50M) from the general supply and permanently destroy them. The transaction related to this destruction will be added to this article once completed.
