On August 31, 2026, an exploit took place against More Markets, a lending protocol developed by More Labs on Flow EVM. Blockaid found that the protocol's mFlowWFLOW reserve was being drained by 15.5 million WFLOW, with an estimated $9.3 million damage. The attacker extracted more WFLOW than the collateral should have permitted by using an Ankr liquid staking token and E-mode borrowing. The final loss and user impact have not yet been confirmed by More Markets' investigation.

How the More Markets Exploit Happened

The attack targeted the way More Markets used its E-mode borrowing system to manage Ankr's liquid staking token (LST).

To put it simply, when consumers offer assets that are thought to be closely related in value, E-mode enables them to borrow more. Because assets with comparable pricing can support higher borrowing limits, this is beneficial for lending markets.

The attacker's combination of Ankr's bonded LST with E-mode was the source of the issue. The attacker was able to borrow more WFLOW than the collateral should have supported by taking advantage of how the lending arrangement evaluated the collateral.

In the end, that extra borrowing was taken from the mFlowWFLOW reserve of the protocol. After identifying the attack, Blockaid stated that the reserve had been depleted of 15.5 million WFLOW.

Exploit tx: https://t.co/V5lb1qD4Ne

Deploy: https://t.co/T0hiMVeHII

Post-exploit exfil: https://t.co/ZmV2nDLAB7 https://t.co/OZgDdD8AEL https://t.co/NY1hN3Hdqv https://t.co/aj5wxwoUoy https://t.co/dr8pTI6dOE https://t.co/HSNV6yD5Er https://t.co/EVTOLxrrXo…

— Blockaid (@blockaid_) August 31, 2026

15.5M WFLOW Leaves the Lending Reserve

The incident's largest figure is 15.5 million WFLOW. More Markets' WFLOW lending reserve, mFlowWFLOW, was depleted of these tokens. At the time of its study, Blockaid estimated the impact to be worth about $9.3 million.

But it's crucial to avoid treating $9.3 million as a definitive loss just yet. More Markets has stated that it is looking into the situation, while Blockaid described the figure as its detection impact. The protocol has not verified if users have experienced losses or the total amount lost.

Because investigators are still tracking the attacker's transactions and figuring out where the drained WFLOW went after leaving the lending reserve, this distinction is important.

Ankr LST & E-Mode Were the Key Pieces

Ankr's bonded liquid staking token and More Markets' E-mode system were the two key components of the assault.

Staked FLOW is represented by Ankr's liquid staking token, which may be utilized in DeFi applications like as lending markets. More Markets permitted the usage of assets like WFLOW and ankrFLOW in its lending system.

The connection between these assets and E-mode seems to have been exploited by the attacker to boost borrowing power over what the collateral should have supported.

Due to this, rather than just someone transferring WFLOW straight from the protocol, the incident is better viewed as a collateral and borrowing-risk abuse.

A full technical post-mortem has not yet been released, so the exact sequence of transactions and the precise calculation that allowed the attacker to overborrow remain under investigation. Blockaid’s initial disclosure specifically identified the Ankr bonded LST + E-mode combination as the key part of the attack.

🚨 Blockaid detected an exploit on More Markets (More Labs) on Flow EVM. Attacker used Ankr bonded LST + E-mode to drain the WFLOW lending reserve. 15.5M WFLOW emptied from mFlowWFLOW (~$9.3M detector impact). Attack tx cluster includes post-exploit exfil.
More details in🧵

— Blockaid (@blockaid_) August 31, 2026

Attacker Moved Funds After the Exploit

The 15.5 million WFLOW that left mFlowWFLOW did not stop the attack. A cluster of attack transactions with post-exploit exfiltration activities was also found by Blockaid. Put another way, the attacker started transferring the assets through more transactions after depleting the lending reserve.

The exploit transaction, attacker-controlled contracts, and subsequent fund movements are all visible in on-chain traces that were made public in relation to the event. It has been revealed that some of the extracted assets were transferred from the Flow EVM ecosystem to external wallets.

The confirmed amount of the loss and the ultimate destination of all the funds are still being investigated.

The ultimate financial impact and user losses have not yet been established by More Markets. As a result, the incident's current WFLOW drained from mFlowWFLOW is 15.5 million, and Blockaid estimates the impact to be around $9.3 million.

Flow EVM was the target of the attack, although neither Flow nor Ankr were compromised, according to Blockaid's revelation. The information that is currently available indicates that the exploit targets the lending setup of More Markets.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Harmony ONE Token Crashes After $4B Unauthorized Mint
2. ZachXBT Exposes Alleged $5M Crypto Scam
3. Crypto User Loses $100K to Address Poisoning Scam
4. What the COLDCARD Exploit Means for Crypto?
5. Carrot Shuts Down After Drift Exploit Fallout

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.