Flow: A vulnerability in AML/KYC standards exposes $5 million in suspicious transactions

The Flow Foundation has released a detailed report regarding the critical events that occurred on December 27, revealing a series of operational anomalies that allowed an unauthorized account to make significant withdrawals without proper identity verification checks.

The Event and Transaction Dynamics

In the immediate period following the network vulnerability exploit, a single address deposited 150 million FLOW tokens, representing about 10% of the project’s total circulating reserves. The speed and volume of this operation raised suspicions from the very beginning. The account proceeded to convert the vast majority of the acquired tokens into Bitcoin, subsequently transferring over $5 million out of the platform before security systems could block further activity.

Critical Deficiencies in Compliance Mechanisms

The Flow Foundation identified the root of the problem in the anti-money laundering (AML) and identity verification (KYC) procedures of a particular exchange. Forensic investigators documented significant transactional anomalies both before and after the network interruption, suggesting an organized pattern rather than random actions.

Currently, FLOW is quoted at $0.09 with a circulating supply of approximately 1.6 billion tokens. The volume of tokens held by the foundation’s reserves enabled this level of damage. Official communications through regular operational channels have gone unanswered, leading to an escalation of the situation.

Actions Taken and Subsequent Developments

The Flow Foundation coordinated with numerous global exchange platforms to protect users and restore compromised operational functionalities. A partner exchange took the lead in response, while other entities have already normalized their services.

Meanwhile, the Foundation has submitted an urgent request for a meeting with the decision-makers of the platform in question to address procedural inadequacies. Relevant authorities have been involved in parallel investigations.

This incident highlights the critical importance of regulatory compliance in the digital currency sector and the need for robust and consistently applied AML/KYC protocols.