Blockaid Flags $9.3M Lending Reserve Drain via Ankr Tokens, E-Mode

Flow-based DeFi lending protocol More Markets suffered a reserve drainage of about $9.3 million in digital assets, according to security firm Blockaid. Blockaid said the attacker extracted roughly 15.5 million Wrapped Flow (WFLOW) tokens from the protocol’s mFlowWFLOW lending reserve on the Flow EVM network. The incident, outlined in a Monday post on X by Blockaid (see Blockaid’s report), highlights how lending platforms that support liquid staking tokens can be vulnerable when borrowing mechanics are combined with liquidity and efficiency-mode features. Key takeaways $9.3 million worth of WFLOW was reportedly drained from More Markets’ mFlowWFLOW lending reserve on Flow EVM. Blockaid attributes the attack to the use of ankrFLOW (Ankr Staked FLOW) and Aave V3 E-mode overborrowing conditions. The exploitation contributed to total crypto hack losses of $139.7 million in August 2026, per DefiLlama. While August thefts remain the third-largest month of 2026 so far, they are far below $254 million stolen in July, according to DefiLlama data. More Markets has not publicly confirmed the incident or disclosed potential user losses as of publication. How Blockaid says the Flow EVM exploit worked In its analysis, Blockaid linked the theft to the borrowing and collateral logic used inside the protocol. The security firm said the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, together with E-mode—a feature associated with Aave V3. E-mode (short for efficiency mode) is designed to increase borrowing power for certain asset pairs when their prices are expected to move together. Blockaid’s explanation focuses on the relationship between a liquid staking token and its underlying asset: if the tokenized staking position (ankrFLOW) behaves closely to the underlying FLOW, then the protocol may assign more favorable risk parameters under E-mode. According to Blockaid, the attacker leveraged those assumptions to overborrow from the mFlowWFLOW reserve and drain liquidity. Blockaid’s public figures point to 15.5 million WFLOW tokens being pulled from the reserve and valued at about $9.3 million in the incident. What the reserve drainage means for DeFi risk management Incidents like this tend to raise a difficult question for DeFi lenders: how to balance the capital efficiency benefits of supporting liquid staking derivatives against the edge cases that can emerge when borrowing rules are pushed to their limits. E-mode is meant to reflect a correlation between assets, but the way correlation is enforced on-chain can be exploited if attackers can find a path where collateral valuation, liquidity availability, or borrowed asset dynamics allow them to extract value faster than the system can correct risk exposure. In this case, Blockaid specifically cited E-mode plus the use of a liquid staking token to achieve an outcome that resulted in reserve depletion. For users, the immediate practical takeaway is less about the specific tokens involved and more about the mechanics.