Decentralized lending protocol More Markets, developed by More Labs and deployed on the Flow blockchain’s Ethereum Virtual Machine-compatible layer, suffered an exploit on August 31, 2026, that drained approximately 15.5 million Wrapped Flow (WFLOW) tokens from its mFlowWFLOW lending reserve.
Flow said the attack began at about 06:18 UTC on 31 August, with a vulnerability in Ankr’s ankrFLOW contract that allowed the attacker to create about 8.6 million unbacked ankrFLOW, which was then used as collateral on More Markets. At the spot FLOW price, the 15.5 million WFLOW was worth about $410,000. After slippage, the attacker realized about $246,000, according to Flow, or about $250,000, according to Blockaid. Blockaid said the ~$9.3 million figure in its first post was only an initial detector estimate.
The security firm attributed the attack path to an Ankr-issued bonded liquid staking token plus the protocol’s Efficiency Mode borrowing feature. Flow later said the root cause was a vulnerability in Ankr’s ankrFLOW Solidity contract, not in Flow EVM or More Markets. Blockaid said More Markets stated its contracts were not compromised.
What Blockaid Disclosed About the Attack
In an X post published on August 31, 2026, Blockaid stated that its automated detection system had flagged an active exploit on More Markets on Flow EVM. The firm identified the affected reserve as the mFlowWFLOW pool, the interest-bearing deposit market for Wrapped Flow (WFLOW). WFLOW is the ERC-20-compatible wrapped representation of the Flow network’s native FLOW token, used within Ethereum Virtual Machine (EVM) environments so that Solidity-based applications can interact with FLOW liquidity.
Blockaid first described the roughly $9.3 million figure as its “detector impact” estimate. In an update posted at 20:12 GMT on Aug. 31, 2026, Blockaid said that estimate was initial only, that 15.5 million WFLOW was worth about $410,000 at spot, and that the attacker realized about $250,000 after slippage. The firm added that the attack transaction cluster included post-exploit exfiltration transactions, meaning the attacker had already begun moving funds away from the origin address before the incident was publicly flagged.
Flow’s official statement, posted at 19:24 GMT on Aug. 31, 2026, said some reports incorrectly used the ~$9.3 million figure and asked for a correction.
According to the transaction data published by the security firm on Flowscan, the primary exploit transaction is identified by a hash beginning 0x2b2e6ea6c, with the attacker’s contract deployment transaction traceable to a hash starting with 0xca9cf3f46.
A subsequent cluster of post-exploit transfers was documented, including transactions with hashes beginning 0x519fecaa2, 0xb49e190a5, 0x050d1ee71, 0x5bee26f22, 0x5c4783d06, 0xd4a01da90, 0x2dafbc52c, 0x9a1e2f690, 0xc44a11d19, 0x4509c64dd, and 0x0af356746.
Blockaid identified the exploiter address as 0xa1E…6A7Cc and named a second helper wallet at 0xA0C..b3702. The victim contract was named as the More Markets Pool at 0xbC92..F2c8d.
More Markets, Aave V3 on Flow, and the WFLOW Reserve
More Markets is a decentralized, non-custodial lending protocol deployed on Flow EVM and built on Aave V3 architecture, the same codebase that powers Aave, a major DeFi lending protocol. The protocol’s public repository lists nine supported markets, allowing users to supply assets to earn interest, borrow against collateral at variable interest rates, and liquidate positions that fall below required collateral thresholds.
WFLOW and ankrFLOW are among the assets supported by the protocol. According to More Markets’ listed risk parameters, WFLOW carries a loan-to-value (LTV) ratio of 81.5% and a liquidation threshold of 83%, while ankrFLOW carries a 78.5% LTV and an 81% liquidation threshold. LTV determines how much a user can borrow against a given asset held as collateral, while the liquidation threshold sets the level at which a position becomes eligible for forced closure by liquidators.
More Markets reported approximately $3.99 million in total value locked (TVL) across the Flow chain at the time of the exploit, with about $3.48 million in active loans.
DeFiLlama’s TVL methodology measures collateral net of borrows, which is why the drained figure of 15.5 million WFLOW can exceed the reported TVL snapshot: the pool’s gross supply and borrow positions are considerably larger than the net collateral figure surfaced by the TVL metric, especially in a market that supports leveraged looping through Efficiency Mode.
For reference, FLOW was trading at roughly $0.026288 per token on Aug. 31, 2026, per data aggregated by CoinMarketCap. At the spot price of about $0.026288, 15.5 million WFLOW would translate to approximately $407,000–$410,000 in face-value tokens. That matches Flow’s and Blockaid’s later figures. Blockaid’s earlier $9.3 million figure was an initial detector estimate and was later corrected.
What E-mode Does and Why It Matters Here
Efficiency Mode, commonly called E-mode, is a borrowing feature introduced with Aave V3 that allows users to unlock higher capital efficiency when they supply and borrow assets that are economically correlated, such as two liquid staking tokens that track the same underlying asset.
When E-mode is enabled for a specific asset category, the protocol raises the maximum LTV, adjusts the liquidation threshold, and typically reduces the liquidation penalty for positions restricted to assets inside that category, per Aave’s official documentation.
The design of E-mode relies on the assumption that assets within a category maintain a tight price correlation. For a pair such as FLOW and ankrFLOW, which are economically linked because ankrFLOW represents staked FLOW plus accrued staking rewards, a correlation-based E-mode configuration allows a user to borrow FLOW (or WFLOW) against ankrFLOW at a much higher LTV than a general-purpose lending market would permit.
If that correlation assumption breaks, or if the price oracle governing the correlation can be influenced, positions inside an E-mode category can be exploited to borrow far more than the underlying collateral would normally support.
Blockaid’s disclosure specifically tied the More Markets attack to an “Ankr bonded LST + E-mode” pathway, without publishing a step-by-step reconstruction. Flow later said the root cause was Ankr’s ankrFLOW contract, which allowed unbacked tokens to be minted. E-mode was the borrowing path used on More Markets after those tokens were posted as collateral.
Ankr’s ankrFLOW Liquid Staking Token in Context
Ankr describes ankrFLOW as a reward-bearing liquid staking token issued when users stake native FLOW through its staking service. The value of each ankrFLOW increases relative to FLOW as staking rewards accumulate on the Flow network, while the quantity of tokens held by the user remains constant. This is the same reward-accrual model used by tokens such as Rocket Pool’s rETH on Ethereum.
Ankr operates separate smart contracts on Flow EVM for the ankrFLOW token, the staking pool, the staking configuration, and the ratio feed. The ratio feed is the on-chain source of the token’s exchange ratio against FLOW, and its accuracy is critical to any lending market that uses ankrFLOW as collateral. Ankr’s own documentation states that both its Cadence and EVM contracts for Flow liquid staking underwent external audits by security firm Halborn.
Flow said the underlying exploit was in an Ankr Solidity smart contract. The attacker created about 8.6 million ankrFLOW with no backing. Flow said this was not an exploit of Flow EVM, the Flow protocol, or More Markets. Ankr and More Markets paused the affected contracts. Flow Foundation said it would replace the drained WFLOW reserve and rebalance liquidity. No More Markets or ankrFLOW depositor lost funds, and no FLOW holder was affected.
Flow EVM Was Not the Attack Surface, But Security History Adds Context
The August 31 incident targeted an application-layer contract running on Flow EVM. Flow EVM is the Ethereum Virtual Machine-compatible execution environment on the Flow blockchain, allowing developers to deploy Solidity smart contracts alongside applications written in Flow’s native Cadence language. Blockaid’s disclosure did not implicate the Flow blockchain’s base layer in the incident. Flow’s official statement confirmed the network was operating normally, that Flow EVM was not exploited, and that FLOW tokenomics were not affected.
The distinction is worth drawing because Flow suffered a separate protocol-level security breach in late December 2025. As reported, a December 27, 2025 attack exploited a vulnerability in Flow’s Cadence execution layer that allowed an attacker to duplicate fungible tokens before extracting approximately $3.9 million in value.
Flow Foundation’s subsequent post-mortem stated that the attacker deployed more than 40 malicious smart contracts in a coordinated sequence, exploiting a flaw in Cadence runtime version 1.8.8 that allowed a protected asset to be disguised as a standard data structure and duplicated.
Following that incident, Flow initially proposed a full chain rollback. That proposal faced significant opposition from bridge operators and ecosystem participants, who warned that reversing confirmed transactions could produce duplicated balances or losses for users who had bridged assets during the affected window.
Flow subsequently abandoned the rollback plan in favor of an isolated recovery process that identified and destroyed counterfeit assets while retaining legitimate transaction history. During recovery, Flow reported that it had isolated 98.7% of the remaining counterfeit supply, with 484.4 million FLOW returned by centralized exchanges OKX, Gate.io, and MEXC and destroyed.
The fallout later extended to South Korea, where Flow Foundation and Dapper Labs sought a court order in March 2026 to prevent domestic exchanges Upbit, Bithumb, and Coinone from ending trading support for FLOW after the December incident.
The current More Markets exploit is materially different from the December 2025 event because it targets a single deployed application rather than the chain’s execution layer, and no impact on Flow’s core protocol has been reported.
2026’s Wider Crypto Exploit Backdrop
The More Markets incident adds to a year in which decentralized finance security incidents have moved at a pace that outstrips 2025. As The Crypto Times reported using Blockaid’s own H1 2026 data, crypto losses exceeded $1.1 billion across 212 verified incidents in the first half of the year, marking the most-hacked half-year on record by incident count.
More recently, The Crypto Times documented how the week of August 17 to August 23 alone produced more than $13 million in verified on-chain losses across five separate exploits, including Maya Protocol, Allbridge, BounceBit, The Sandbox, and Term Labs. That stretch pushed 2026’s running loss total past $1.26 billion across more than 219 incidents.
Lending-protocol exploits involving specialized borrowing modes and liquid staking token pricing have emerged as one of the more difficult vectors to preempt, because the attack surface turns on the interaction between two independently sound components rather than on a single broken contract at the perimeter.
What Comes Next
Flow said Ankr and More Markets paused the affected contracts within hours. ankrFLOW staking and More Markets lending remain paused until Ankr deploys a contract upgrade. User funds are safe and will be retrievable once the protocols are unpaused. Flow Foundation said it will replace the drained WFLOW reserve and rebalance the ankrFLOW/WFLOW pool. Some exchanges paused FLOW deposits as a precaution; Flow said the issue is contained and asked partners to re-enable deposits.
Users of the protocol are advised to monitor More Markets’ official communication channels and to weigh withdrawing supported assets from any affected markets until the team confirms the scope of the incident. On-chain observers can follow the exploiter address at 0xa1E4…6A7Cc and the helper wallet at 0xA0C..b3702 on Flowscan for further movement of funds.
Also Read: Cronos Halts Entire Blockchain After $75M Tectonic Exploit
