According to a recent update, the Flow Foundation has made “significant progress” in its remediation plan to address the damages dealt during the $3.9 million exploit of the blockchain last week.

Remediation of the Flow network has entered “phase two” of its multi-phase recovery plan, Flow said in a Jan. 1 X update.

Flow’s core developer team has “identified a path to restore EVM functionality” while work continues on the native Cadence environment, which will allow the network to fix both systems at the same time and get the EVM side back online much faster than originally planned, the update noted.

“Barring unforeseen blockers, EVM network is expected to be online within 24 hours of the publication of this announcement,” it added.

To accomplish this, the network’s Community Governance Council is carrying out cleanup transactions within specific boundaries set by validators.

On the native Cadence side, teams are conducting a detailed, account-by-account verification process to find and destroy any tokens that were created fraudulently during the exploit.

At the same time, the EVM layer is being brought back online with specific safeguards. While the cleanup continues, certain accounts identified as suspicious will face temporary restrictions to ensure that no further illicit activity occurs, while the rest of the network returns to normal operations, Flow said.

“This is a complex process requiring individual account assessment and verification. The Foundation is working with external forensic firms to accelerate remediation while maintaining the precision required for secure restoration,” the update noted.

Flow estimates that more than 99.9% of all accounts will have complete access to their funds and the ability to perform transactions across both the Cadence and EVM environments once the network is fully restored.

A $3.9 million exploit

Flow blockchain was forced to halt operations on Saturday, December 27, after a critical execution-layer vulnerability in its cross-chain communication logic allowed an attacker to mint 150 million FLOW tokens and move millions in assets to external exchanges. 

Roughly $3.9 million worth of tokens were drained, while the price of the FLOW token crashed nearly 50% in the aftermath of the incident as major South Korean exchanges halted trading and transfers.

To address the issue, Flow initially proposed a plan to execute a full-chain rollback to a pre-exploit state, but the idea was met with community-wide criticism, as many were concerned over the centralization risks and the threat to transaction finality that the rollback would pose, compelling the Flow Foundation to switch to the more surgical current multi-phase recovery approach.

While the Cadence cleanup (Phase 2) and EVM re-enablement (Phase 3) are now moving forward together, the final Phase 4 will involve reopening cross-chain bridges and resuming exchange activities. 

This final step will only take place once a conclusive verification of the network’s stability is completed, Flow noted.