What To Know:
- A December 2025 Flow network vulnerability led to unauthorized minting of FLOW, prompting HTX to assist with tracing and risk controls to protect users.
- HTX says the Flow team unilaterally transferred FLOW from exchange wallets under an “Isolated Recovery” plan, including assets held by regular users.
- HTX argues the move undermines asset ownership principles and has triggered wider debate over protocol-level control and user rights.
Huobi HTX has publicly criticized the Flow project team over what it describes as a unilateral and forceful transfer of FLOW tokens from centralized exchange addresses, a move that has intensified debate around decentralization, asset ownership, and user protection within blockchain networks.
Huobi HTX vs Flow Network
The dispute stems from a major security incident on the Flow network on December 27, 2025. According to statements from HTX, a vulnerability at the protocol layer allowed attackers to mint and circulate a large volume of FLOW tokens without authorization. The incident disrupted market order and raised immediate concerns about the integrity of the network’s asset supply.
HTX said it acted quickly after detecting abnormal activity. The exchange contacted the Flow team to verify the issue, shared on-chain data and abnormal price movements, and supported efforts to trace suspicious transactions. At the same time, its internal risk-control systems monitored fund flows, restricted assets linked to identifiable attacker addresses, and attempted to prevent compromised tokens from entering the broader market. The platform maintains that these measures were taken to protect users holding FLOW during a period of heightened uncertainty.
Tensions escalated after the Flow project team announced what it described as an “Isolated Recovery” plan. Under this approach, the project team exercised protocol-level permissions to transfer FLOW tokens it deemed affected from centralized exchange addresses, including those controlled by HTX. According to HTX, this action was taken without sufficient communication with exchanges or users and without control of the private keys associated with those assets.
HTX stated that the assets subject to forced transfer include a significant amount of FLOW held by ordinary users who acquired the tokens through legitimate market trades. The Flow team has also indicated that the recovered tokens are scheduled to be destroyed on January 30, 2026. HTX argues that this approach blurs the line between illegally minted tokens and lawful user holdings, placing legitimate assets at risk.
In its statement, HTX said the recovery action represents a serious departure from the principles of decentralization and clear asset ownership. The exchange warned that allowing protocol-level authorities to remove assets from custodial platforms without consent could set a troubling precedent for the broader industry. From its perspective, such actions undermine trust in decentralized systems by introducing discretionary control at the protocol level.
Throughout the episode, HTX has emphasized its continued commitment to users. The exchange said it has allocated significant resources to monitoring, tracing, and coordination efforts to reduce potential harm. It also reiterated that its decision to speak publicly reflects concerns not only about the immediate incident, but about long-term implications for how security incidents are handled across blockchain ecosystems.
HTX has called on the Flow project team to distinguish clearly between illegally minted tokens and legitimate holdings. It has also urged the publication of a complete and auditable post-incident report that explains how the vulnerability occurred, how decisions were made during the recovery process, and how similar incidents will be prevented in the future. The exchange said outstanding issues should be addressed through negotiation and transparency rather than unilateral technical actions.
The situation has sparked broader discussion within the crypto community. On social media platforms, users have questioned whether the Flow network retains centralized control mechanisms (super-admin mechanisms) capable of overriding custodial ownership. Some commentators have raised concerns about the existence of privileged permissions that allow assets to be moved without user authorization, while others have called for clearer standards governing emergency responses to protocol failures.
HTX has said it will continue to engage with the Flow team and keep users informed of further developments. The outcome of the disagreement is likely to be closely watched, not only by FLOW holders, but by exchanges, developers, and regulators assessing the balance between technical authority and decentralized ownership.
Also Read: Flow Network Details $3.9M Exploit, Patches Cadence Vulnerability
