How Did The More Markets Exploit Drain WFLOW?
Decentralized lending protocol More Markets is investigating a suspected exploit on Flow EVM after blockchain security firm Blockaid identified approximately 15.5 million Wrapped Flow tokens leaving one of the protocol’s lending reserves.
Blockaid estimated the initial impact at roughly $9.3 million and said the attacker used an Ankr liquid staking token together with More Markets’ E-Mode borrowing configuration to drain WFLOW from the mFlowWFLOW reserve.
More Markets has acknowledged the report but has not confirmed the final loss, whether users face permanent losses or whether any of the withdrawn assets can be recovered.
“Our team is currently investigating a claim that MORE Markets was exploited,” the protocol said, adding that it would publish its findings after completing the investigation.
Blockaid identified an exploit transaction, deployment of an attacker contract and subsequent transactions apparently used to move assets after the initial attack. The security firm described the activity as a post-exploit exfiltration sequence.
The incident affected More Markets, an application operating on Flow EVM, rather than the Flow blockchain itself. There is no indication that Flow’s consensus mechanism, EVM infrastructure or wider network was compromised.
Why Did E-Mode Increase The Lending Risk?
More Markets is a non-custodial lending protocol developed by More Labs using architecture derived from Aave V3. Users can deposit assets to earn interest or use supported tokens as collateral for loans.
The protocol supports WFLOW and ankrFLOW, Ankr’s liquid staking representation of staked FLOW. Published risk parameters list WFLOW with an 81.5% loan-to-value ratio and an 83% liquidation threshold, while ankrFLOW carries a 78.5% loan-to-value ratio and an 81% liquidation threshold.
E-Mode, or Efficiency Mode, can allow users to borrow more when collateral and borrowed assets are expected to remain closely correlated. That can improve capital efficiency when a liquid staking token closely tracks its underlying asset, but it also increases the consequences of inaccurate pricing, weak liquidity assumptions or overly aggressive collateral settings.
According to Blockaid’s preliminary assessment, the attacker combined the Ankr-linked liquid staking asset with More Markets’ E-Mode configuration to overborrow WFLOW and eventually empty approximately 15.5 million WFLOW from the affected reserve.
The available information does not indicate that Ankr itself was compromised. The investigation instead centers on how the liquid staking asset interacted with More Markets’ collateral and borrowing rules.
Investor Takeaway
The incident shows that DeFi security depends on more than smart contract code. Loan-to-value ratios, liquidation thresholds, liquidity assumptions, oracle pricing and E-Mode settings can become attack surfaces when protocols give correlated assets greater borrowing power.
Is The $9.3 Million Loss Final?
The reported $9.3 million figure remains preliminary. It reflects Blockaid’s estimate based on the amount of WFLOW removed and its market value around the time of the attack.
Final user losses could be lower or higher depending on the attacker’s remaining positions, protocol bad debt, recoveries and whether any assets can be frozen or returned.
The most important question for More Markets users is whether the withdrawal created unrecoverable bad debt. A lending protocol can continue operating after an exploit if losses are contained or covered, but a large deficit can affect withdrawals, liquidations and confidence in other lending markets using similar settings.
More Markets will also need to determine whether the same collateral configuration or E-Mode assumptions are used elsewhere in the protocol. If they are, additional markets may require revised borrowing limits, tighter collateral parameters or temporary restrictions.
What Does The Exploit Mean For DeFi Lending?
The incident adds to a difficult August for decentralized finance, with roughly $140 million in reported crypto protocol exploits during the month. Recent cases have included a roughly $75 million incident involving Tectonic and an estimated $8.7 million loss at Moonwell.
More Markets also illustrates how DeFi losses increasingly emerge from economic configuration rather than a simple compromise of private keys. A smart contract can execute exactly as designed while still producing severe losses if the assumptions governing collateral value, asset correlation or borrowing capacity are wrong.
That risk can be greater in smaller DeFi ecosystems, where a multimillion-dollar drain may represent a substantial portion of available liquidity. The same loss that a large lending market could absorb may create serious solvency or withdrawal concerns for a smaller protocol.
More Markets now needs to establish the final amount lost, whether bad debt remains, what allowed the WFLOW reserve to be drained and whether other lending markets share the same weakness. Until that investigation is complete, approximately 15.5 million WFLOW leaving the reserve and Blockaid’s roughly $9.3 million impact estimate remain the central confirmed figures.