In early 2026, the crypto market staged a jaw-dropping spectacle. The Flow project, once renowned in the industry for its NFT concept and attracting countless users, is now facing a survival crisis—an emergence of 800 million "ghost tokens" has pushed the project to the brink. Even more heartbreaking is that the deadline for delisting on January 14 is approaching, yet the project team and exchanges are blaming each other, with neither willing to foot the bill for this mess.

The story begins on December 27. Cadence VM, the core execution layer of Flow, revealed a basic security flaw—equivalent to leaving the vault door unlocked, allowing hackers to exploit it. The consequences of this breach were severe: $3.9 million in funds were stolen, and even more astonishingly, the hackers artificially inflated the token supply. Among these, 800 million newly minted tokens had no real backing but quietly flowed into major trading platforms. After multiple rounds of trading, these "ghost tokens" had long since mixed into compliant trading pools, becoming a hot potato no one wanted to hold.

According to industry standard practice, the only technically feasible way to restore the token supply to normal is for the project team to buy back and burn these excess tokens. But the question is: who will pay for this huge sum? This directly triggered blame-shifting between Flow and the exchanges.

The Flow team offered a set of explanations: the exchanges' anti-money laundering mechanisms and identity verification are virtually useless, and the hackers exploited these vulnerabilities to cash out smoothly. Since the risk control failures are on the exchanges’ side, why should the project team bear the cost? They even bluntly stated they had "no money," effectively throwing in the towel. The exchanges, in turn, did not hold back, accusing Flow of irresponsibility at the technical level, which led to this disaster.