Decentralized lending protocol More Markets, developed by More Labs and deployed on the Flow blockchain’s Ethereum Virtual Machine-compatible layer, suffered a security exploit on August 31, 2026, that drained approximately 15.5 million Wrapped Flow tokens from its mFlowWFLOW lending reserve, with blockchain security firm Blockaid pegging the detected financial impact at roughly $9.3 million in an initial on-chain assessment.
The security firm attributed the attack to a combination of an Ankr-issued bonded liquid staking token and the protocol’s Efficiency Mode borrowing feature. A full technical reconstruction has not been published, and the final loss figure remains under investigation as the post-exploit transaction cluster tied to the incident is being traced.
What Blockaid Disclosed About the Attack
In an X post published on August 31, 2026, Blockaid stated that its automated detection system had flagged an active exploit on More Markets on Flow EVM. The firm identified the affected reserve as the mFlowWFLOW pool, the interest-bearing deposit market for Wrapped Flow (WFLOW). WFLOW is the ERC-20-compatible wrapped representation of the Flow network’s native FLOW token, used within Ethereum Virtual Machine (EVM) environments so that Solidity-based applications can interact with FLOW liquidity.
Blockaid described the roughly $9.3 million figure as its “detector impact” estimate, a characterization that suggests the final on-chain loss and the ultimate destination of the drained assets are still being reconciled. The firm added that the attack transaction cluster included post-exploit exfiltration transactions, meaning the attacker had already begun moving funds away from the origin address before the incident was publicly flagged.
According to the transaction data published by the security firm on Flowscan, the primary exploit transaction is identified by a hash beginning 0x2b2e6ea6c, with the attacker’s contract deployment transaction traceable to a hash starting with 0xca9cf3f46.
A subsequent cluster of post-exploit transfers was documented, including transactions with hashes beginning 0x519fecaa2, 0xb49e190a5, 0x050d1ee71, 0x5bee26f22, 0x5c4783d06, 0xd4a01da90, 0x2dafbc52c, 0x9a1e2f690, 0xc44a11d19, 0x4509c64dd, and 0x0af356746.
Blockaid identified the exploiter address as 0xa1E…6A7Cc and named a second helper wallet at 0xA0C..b3702. The victim contract was named as the More Markets Pool at 0xbC92..F2c8d.
More Markets, Aave V3 on Flow, and the WFLOW Reserve
More Markets is a decentralized, non-custodial lending protocol deployed on Flow EVM and built on Aave V3 architecture, the same codebase that powers Aave, a major DeFi lending protocol. The protocol’s public repository lists nine supported markets, allowing users to supply assets to earn interest, borrow against collateral at variable interest rates, and liquidate positions that fall below required collateral thresholds.
WFLOW and ankrFLOW are among the assets supported by the protocol. According to More Markets’ listed risk parameters, WFLOW carries a loan-to-value (LTV) ratio of 81.5% and a liquidation threshold of 83%, while ankrFLOW carries a 78.5% LTV and an 81% liquidation threshold. LTV determines how much a user can borrow against a given asset held as collateral, while the liquidation threshold sets the level at which a position becomes eligible for forced closure by liquidators.
More Markets reported approximately $3.99 million in total value locked (TVL) across the Flow chain at the time of the exploit, with about $3.48 million in active loans.
DeFiLlama’s TVL methodology measures collateral net of borrows, which is why the drained figure of 15.5 million WFLOW can exceed the reported TVL snapshot: the pool’s gross supply and borrow positions are considerably larger than the net collateral figure surfaced by the TVL metric, especially in a market that supports leveraged looping through Efficiency Mode.
For reference, FLOW was trading at roughly $0.026288 per token on Aug. 31, 2026, per data aggregated by CoinMarketCap. At the spot price, 15.5 million WFLOW would translate to approximately $407,464 in face-value tokens. Blockaid’s higher $9.3 million figure represents its internal detector impact metric rather than a token-count valuation, and the firm has indicated further disclosure will follow as its investigation progresses.
What E-mode Does and Why It Matters Here
Efficiency Mode, commonly called E-mode, is a borrowing feature introduced with Aave V3 that allows users to unlock higher capital efficiency when they supply and borrow assets that are economically correlated, such as two liquid staking tokens that track the same underlying asset.
When E-mode is enabled for a specific asset category, the protocol raises the maximum LTV, adjusts the liquidation threshold, and typically reduces the liquidation penalty for positions restricted to assets inside that category, per Aave’s official documentation.
The design of E-mode relies on the assumption that assets within a category maintain a tight price correlation. For a pair such as FLOW and ankrFLOW, which are economically linked because ankrFLOW represents staked FLOW plus accrued staking rewards, a correlation-based E-mode configuration allows a user to borrow FLOW (or WFLOW) against ankrFLOW at a much higher LTV than a general-purpose lending market would permit.
If that correlation assumption breaks, or if the price oracle governing the correlation can be influenced, positions inside an E-mode category can be exploited to borrow far more than the underlying collateral would normally support.
Blockaid’s disclosure specifically tied the More Markets attack to an “Ankr bonded LST + E-mode” pathway, without publishing a step-by-step reconstruction. It is not yet clear from the initial statement whether the root cause originated in More Markets’ own implementation of E-mode, the way the ankrFLOW asset was integrated into that configuration, its price assumptions, or an interaction between those components.
Ankr’s ankrFLOW Liquid Staking Token in Context
Ankr describes ankrFLOW as a reward-bearing liquid staking token issued when users stake native FLOW through its staking service. The value of each ankrFLOW increases relative to FLOW as staking rewards accumulate on the Flow network, while the quantity of tokens held by the user remains constant. This is the same reward-accrual model used by tokens such as Rocket Pool’s rETH on Ethereum.
Ankr operates separate smart contracts on Flow EVM for the ankrFLOW token, the staking pool, the staking configuration, and the ratio feed. The ratio feed is the on-chain source of the token’s exchange ratio against FLOW, and its accuracy is critical to any lending market that uses ankrFLOW as collateral. Ankr’s own documentation states that both its Cadence and EVM contracts for Flow liquid staking underwent external audits by security firm Halborn.
Blockaid has not stated that Ankr’s protocol itself was compromised. The disclosure only named the bonded LST and More Markets’ E-mode as components used by the attacker, leaving open the possibility that the exploit turned on how More Markets ingested or priced the Ankr asset rather than on any vulnerability inside Ankr’s own contracts.
Flow EVM Was Not the Attack Surface, But Security History Adds Context
The August 31 incident targeted an application-layer contract running on Flow EVM. Flow EVM is the Ethereum Virtual Machine-compatible execution environment on the Flow blockchain, allowing developers to deploy Solidity smart contracts alongside applications written in Flow’s native Cadence language. Blockaid’s disclosure did not implicate the Flow blockchain’s base layer in the incident.
The distinction is worth drawing because Flow suffered a separate protocol-level security breach in late December 2025. As reported, a December 27, 2025 attack exploited a vulnerability in Flow’s Cadence execution layer that allowed an attacker to duplicate fungible tokens before extracting approximately $3.9 million in value.
Flow Foundation’s subsequent post-mortem stated that the attacker deployed more than 40 malicious smart contracts in a coordinated sequence, exploiting a flaw in Cadence runtime version 1.8.8 that allowed a protected asset to be disguised as a standard data structure and duplicated.
Following that incident, Flow initially proposed a full chain rollback. That proposal faced significant opposition from bridge operators and ecosystem participants, who warned that reversing confirmed transactions could produce duplicated balances or losses for users who had bridged assets during the affected window.
Flow subsequently abandoned the rollback plan in favor of an isolated recovery process that identified and destroyed counterfeit assets while retaining legitimate transaction history. During recovery, Flow reported that it had isolated 98.7% of the remaining counterfeit supply, with 484.4 million FLOW returned by centralized exchanges OKX, Gate.io, and MEXC and destroyed.
The fallout later extended to South Korea, where Flow Foundation and Dapper Labs sought a court order in March 2026 to prevent domestic exchanges Upbit, Bithumb, and Coinone from ending trading support for FLOW after the December incident.
The current More Markets exploit is materially different from the December 2025 event because it targets a single deployed application rather than the chain’s execution layer, and no impact on Flow’s core protocol has been reported.
2026’s Wider Crypto Exploit Backdrop
The More Markets incident adds to a year in which decentralized finance security incidents have moved at a pace that outstrips 2025. As The Crypto Times reported using Blockaid’s own H1 2026 data, crypto losses exceeded $1.1 billion across 212 verified incidents in the first half of the year, marking the most-hacked half-year on record by incident count.
More recently, The Crypto Times documented how the week of August 17 to August 23 alone produced more than $13 million in verified on-chain losses across five separate exploits, including Maya Protocol, Allbridge, BounceBit, The Sandbox, and Term Labs. That stretch pushed 2026’s running loss total past $1.26 billion across more than 219 incidents.
Lending-protocol exploits involving specialized borrowing modes and liquid staking token pricing have emerged as one of the more difficult vectors to preempt, because the attack surface turns on the interaction between two independently sound components rather than on a single broken contract at the perimeter.
What Comes Next
At the time of writing, neither More Markets nor More Labs had published an official post-mortem or a public statement of remediation, and the final loss figure has not been reconciled against Blockaid’s detector estimate. Blockaid indicated in its disclosure that additional details would follow as it completes the investigation and traces the transaction cluster used to move funds after the reserve was drained.
Users of the protocol are advised to monitor More Markets’ official communication channels and to weigh withdrawing supported assets from any affected markets until the team confirms the scope of the incident. On-chain observers can follow the exploiter address at 0xa1E4…6A7Cc and the helper wallet at 0xA0C..b3702 on Flowscan for further movement of funds.
Also Read: Cronos Halts Entire Blockchain After $75M Tectonic Exploit
