Flow draws Huobi HTX ire with $3.9M hack recovery plan

The Flow protocol can’t seem to catch a break, as Huobi HTX, an exchange linked to Justin Sun, publicly condemned the project’s recovery plans after it suffered close to a $4 million exploit. 

An update shared via the Huobi official site detailed the major security incident that occurred on the Flow network in December last year, and claimed that after the incident, Huobi HTX immediately attempted to verify the situation by reaching out to the team and providing abnormal price monitoring and on-chain data.

Huobi criticizes Flow’s recovery plans

The report claims that after the project team confirmed the security incident, Huobi HTX continued to provide assistance to the project team in risk management and on-chain tracking, including providing relevant address information and related recharge information.

Through this process, Huobi HTX’s risk control and monitoring system continuously tracked abnormal capital flows and took restrictive measures on identifiable hacker-related assets to prevent further inflows into the market as much as possible while protecting the overall interests of currency holders.

However, the report claims that without fully communicating with the exchange and the community, the Flow project party decided to unilaterally promote its so-called “Isolated Recovery” plan through protocol layer authority.

Without mastering the private key, the team directly forcibly transferred its identified FLOW assets from centralized exchange addresses, including Huobi HTX. These assets included a large number of normal user positions obtained via real market transactions, and they were going to be unilaterally destroyed on January 30, 2026, according to plans announced by the team.

Huobi claims the approach not only seriously deviates from the decentralization principle that the blockchain should have, but it also fails to fully consider the legitimate rights and interests of the platform and its regular users.

Huobi HTX claims it was acting in the best interest of users and its community and continued to invest resources in monitoring, tracking, and coordination, striving to minimize the potential impact on users in a highly uncertain environment.

It has said it will continue to urge the Flow project team to handle this incident more transparently and responsibly, while fully respecting the legitimate rights and interests of users, exchange custody assets, and publish a complete and auditable post-analysis report.

The exchange has also said it will continue to synchronize the progress of the incident with users, and will provide explanations and follow-up as soon as possible in any situation that may affect users’ asset rights.

The collateral damage from the Flow exploit 

The hack that disrupted the Flow ecosystem went down on December 27, 2025.

The hacker minted counterfeit or duplicate tokens, which led to about $3.9 million in assets being drained and bridged out to other chains. To be clear, the exploit did not affect legitimate user deposits and balances; it only created fake assets.

In the days that followed, the Flow team claimed there was no other logical way forward than to initiate a rollback that would restore the network to a pre-hack state while removing unauthorized transactions from the ledger.

The rollback raised eyebrows and critics like Alex Smirnov, whose company, deBridge, is integrated with Flow, alleged the team had reached the decision to effect a rollback without communicating or coordinating with his platform, even though it had claimed they were synchronizing with critical partners.

After consulting, the foundation altered course, switching to a targeted recovery approach that saw it maintain most valid transactions on-chain and only process transactions that failed to act correctly. The plan saw affected accounts temporarily frozen as forensic analysis was carried out to identify and fully remediate the illicitly minted tokens.

The foundation called it the “scalpel” approach and claimed it would enable them to resolve the issue while staying true to their principles of decentralization.

If you’re reading this, you’re already ahead. Stay there with our newsletter.