An attacker overborrowed against ankrFLOW collateral to drain 15.5 million Wrapped Flow tokens—valued at approximately $9.3 million—from the mFlowWFLOW lending reserve on More Markets, a DeFi vault infrastructure protocol running on Flow EVM. Blockaid flagged the drain on Aug. 31 through on-chain data.
The attack vector combined two components: Ankr Staked FLOW (ankrFLOW), a liquid staking token, and E-mode—efficiency mode—an Aave V3 feature that raises a borrower's collateral factor when paired assets are expected to trade in close correlation, such as a liquid staking token and its underlying asset. By depositing ankrFLOW as collateral and activating E-mode, the attacker gained elevated borrowing capacity, then overborrowed WFLOW from the reserve far beyond what standard collateral ratios would have allowed.
On pa E-mode mechanics are straightforward: Aave V3 sets loan-to-value ratios and liquidation thresholds higher for correlated pairs inside an E-mode category than for uncorrelated assets. The assumption is that price correlation limits liquidation risk. When that assumption holds, protocols run leaner and borrowers access more capital per dollar of collateral. When it breaks—or when an attacker exploits the elevated limits before a liquidation bot can react—the reserve absorbs the loss.
More Markets had not publicly confirmed the incident or disclosed whether user funds were permanently lost as of the exploit report. Blockaid did not respond to requests for additional detail.
The $9.3 million drain pushed total losses from crypto hacks in August to $139.7 million, according to DefiLlama data. That makes August the third-largest month by value stolen in 2026, though it represents a sharp decline from July, when attackers took $254 million.
The More Markets exploit was not the only major DeFi security failure in late August. On Aug. 30—one day before Blockaid flagged the More Markets drain—Cronos halted its entire blockchain network following a reported $75 million exploit targeting Tectonic, a lending protocol on the Cronos chain. The two incidents account for the bulk of August's $139.7 million total.
Flow EVM, where More Markets operates, is the Ethereum-compatible execution layer built on top of the Flow blockchain. Flow was originally developed by Dapper Labs as a high-throughput chain for NFTs and consumer applications. The EVM layer extends compatibility to Solidity-based protocols, allowing an Aave V3 fork like More Markets to run on the network. Liquidity on Flow EVM remains thin relative to Ethereum mainnet or large L2s, which makes large reserve concentrations in a single lending pool a higher-risk surface.
Liquid staking tokens as attack instruments represent a recurring pattern in DeFi exploits. Liquid staking tokens carry oracle dependencies and redemption-rate assumptions that differ from their underlying assets. When a protocol uses E-mode or any elevated-collateral-factor category for a liquid staking token, the accuracy and manipulation-resistance of the price feed becomes the critical security variable. If an attacker can move the oracle reading or exploit a stale price, the elevated borrowing limit becomes a direct extraction mechanism.
More Markets describes itself as a vault infrastructure protocol, positioning its lending reserves as a core primitive for the Flow EVM ecosystem. The mFlowWFLOW reserve is the protocol's primary WFLOW liquidity pool. With the reserve emptied, any liquidity provider who held a position in that pool at the time of the exploit faces direct exposure to the loss.
