How to Buy FLOW Crypto After the 2025 Exploit

FLOW, the token behind the NBA Top Shot blockchain, survived a rough first quarter of 2026. On 27 December 2025 an attacker exploited a bug to counterfeit tokens. Validators halted the network, and Upbit, Bithumb and Coinone delisted FLOW on 16 March 2026 after a Seoul court refused to block the move. Outside Korea, Coinbase, Kraken, Binance, OKX and most other big exchanges restored full FLOW service. So the question of how to buy flow now comes down to two things: which venue you use, and whether you withdraw to a Cadence address or a Flow EVM address.

• As of October 2026, FLOW traded on Coinbase (FLOW-USD), Kraken (FLOW/USD, FLOW/EUR), Binance (FLOW/USDT), Binance.US, OKX, Bybit, KuCoin, Gate, MEXC, HTX and Uphold. Korbit is the remaining Korean venue.
• Upbit, Bithumb and Coinone ended FLOW trading on 16 March 2026. Binance’s FLOW/BTC pair is halted, but FLOW/USDT is active.
• Flow has two address types: Cadence accounts (0x plus 16 hex characters) and Flow EVM accounts (0x plus 40 hex characters). Exchanges generally support one network, so match it.
• Dapper is a custodial wallet tied to NFT apps. Flow Wallet is the main self-custody option for Cadence, and MetaMask works on Flow EVM.

The December 2025 exploit and its fallout

Flow’s technical post-mortem says that on 27 December 2025 an attacker used a flaw in the Cadence runtime to duplicate assets rather than mint them through normal supply controls, and extracted roughly $3.9 million. Validators halted the chain within about six hours, and it resumed around two days later under a recovery plan. Flow says no existing user balances were accessed. Exchanges froze most of the counterfeit tokens before they could be sold, and the duplicated supply, reported at around 87 billion nominal FLOW, was destroyed.

Then the exchanges responded:

What the recovery means for a buyer today

One detail matters for anyone holding FLOW now: Flow did not roll the chain back. Core developers first floated restoring a pre-exploit checkpoint, which would have erased several hours of transactions, but bridge partners objected and the Foundation dropped the idea on 29 December 2025. Instead, validators patched the bug, restarted from the last sealed block, froze the attacker’s wallets and quarantined the duplicated tokens, which governance then destroyed on 30 January 2026. Flow EVM and bridges came back in phases after verification. In practice, legitimate balances from before and after the halt stayed valid, and the circulating supply you see on price trackers excludes the counterfeit tokens. What the episode doesn’t erase is the precedent: during an emergency, validators can halt the network and exchanges can freeze FLOW for weeks. Factor that into how much you keep on any single platform.

The Foundation’s position is that the injunction ruling did not decide whether the delisting was justified. We found no later court decision as of October 2026. If you are curious about what Flow does beyond NFTs and gaming, our Flow explainer covers the chain itself.

Where FLOW is still listed (how to buy flow in 2026)

In a 16 March 2026 post, the Flow Foundation said Binance, HTX, Coinbase, Kraken, OKX, Gate, Bybit, KuCoin and MEXC had all restored full FLOW services after reviewing the incident. Public market data from late October 2026 matches that:

For a US buyer, Coinbase and Kraken are the most direct regulated routes. Elsewhere, the choice usually comes down to whether the exchange serves your country, the order-book depth on the FLOW pair, and, often overlooked, which Flow network it withdraws on. If you’re new to funding an exchange, the how to buy crypto hub covers that first step. Liquidity is thinner than before the Korean delistings, so a limit order protects you from slippage on larger buys.

The incident is also a reminder that coins sitting on an exchange can be frozen during a network emergency. Our guide to what happens if a crypto exchange shuts down explains what customers can and can’t recover when a platform fails.

Cadence vs EVM: which Flow address to use

Flow runs two environments on one chain, and they use different account formats. The address format tells you which one you’re looking at:

Before you withdraw, check which network the exchange uses and whether its form accepts a 16-character or a 40-character address. If it only supports the Cadence network, withdraw to a Cadence address in Flow Wallet. You can move FLOW to your linked EVM account later from inside Flow Wallet, which manages both through what Flow calls a Cadence-owned account. Pasting a 40-character EVM address into a Cadence-only withdrawal may fail or, worse, go somewhere you can’t access. And don’t send FLOW to an Ethereum mainnet address just because both start with 0x. Always send a small test transfer first.

Flow Wallet, Dapper and hardware options

• Flow Wallet: the self-custody wallet from the Flow team, for mobile and as a browser extension. It holds both a Cadence account and a linked EVM account, which makes it the most flexible option for exchange withdrawals.
• Dapper Wallet: the custodial account behind NBA Top Shot and other Dapper Labs apps. It’s convenient for collectibles, but Dapper holds the keys. Its support for direct FLOW deposits from exchanges has changed over time, so check Dapper’s help centre before sending.
• Hardware: Ledger devices can hold FLOW through Flow’s own tools such as Flow Port. Confirm current compatibility in Ledger’s supported-asset list.
• MetaMask: works for Flow EVM once you add the network. Use it if your FLOW is on the EVM side, not for Cadence-only withdrawals.

If you mainly want FLOW for NFTs and collectibles, our roundup of NFT wallets compares wallets that handle both tokens and digital items. For a wider look at the sector Flow competes in, see crypto gaming tokens.

Staking FLOW after buying

FLOW is a proof-of-stake asset, and holders can delegate to node operators instead of leaving coins idle. The usual self-custody route is Flow Port, Flow’s official staking dashboard, where you connect a Cadence wallet (Flow Wallet or a Ledger), choose a node operator and delegate. Some exchanges also offer FLOW staking products where available. Rewards vary and are not fixed. Unstaking involves a waiting period, and delegated FLOW can’t be sold during it. Check Flow Port for current reward rates and unbonding timing rather than relying on numbers quoted elsewhere.

FAQ

Where can I buy FLOW crypto in the US?

As of October 2026, Coinbase (FLOW-USD), Kraken (FLOW/USD), Binance.US (FLOW/USDT) and Uphold listed FLOW for US customers, subject to each platform’s state coverage. All restored services after the December 2025 exploit. Check which Flow network the platform withdraws on before you move coins to a wallet.

Was FLOW delisted after the exploit?

Only in South Korea. Upbit, Bithumb and Coinone ended FLOW trading on 16 March 2026 after a Seoul court dismissed an emergency injunction request. Korbit still lists it. Major global exchanges, including Coinbase, Kraken, Binance and OKX, restored full FLOW deposits, withdrawals and trading by March 2026.

What is the difference between a Flow EVM address and a Cadence address?

A Cadence address is 0x followed by 16 hex characters and is used by Flow Wallet, Dapper and native staking. A Flow EVM address is 0x followed by 40 hex characters, like Ethereum, and is used by EVM wallets such as MetaMask. Exchanges often support only one, so match the withdrawal network to your address.

Which wallet should I use for FLOW?

Flow Wallet is the most practical self-custody choice because it holds both a Cadence account and a linked EVM account. Dapper suits NBA Top Shot collectors but is custodial. For hardware security, Ledger works through Flow’s own tools such as Flow Port. Use MetaMask only for FLOW on the EVM side.

Crypto is volatile and risky; this is education, not financial advice. Do your own research.