Blockaid Reports $9.3M Lending Reserve Depleted Across More Markets

DeFi lending infrastructure has suffered another high-value breach on Flow EVM, with Blockaid reporting that the protocol More Markets lost roughly $9.3 million in assets from a lending reserve. The incident, described in a Monday post by Blockaid on X, centers on an overborrow strategy using a liquid staking token. Blockaid said the attacker drained about 15.5 million Wrapped Flow (WFLOW) tokens—valued at approximately $9.3 million—from the mFlowWFLOW lending reserve. The exploit reportedly involved Ankr Staked FLOW (ankrFLOW), together with Aave V3’s “efficiency mode” (E-mode), to expand borrowing capacity beyond what the reserve should allow. Key takeaways Blockaid attributes the More Markets Flow EVM reserve drain to an overborrowing approach using Ankr Staked FLOW (ankrFLOW) and Aave V3 E-mode. About 15.5 million Wrapped Flow (WFLOW), worth around $9.3 million, were taken from the mFlowWFLOW lending reserve. The month-to-date total losses from crypto hacks reached $139.7 million in August, placing the month as the third-largest by stolen value so far in 2026. The August figure is sharply lower than July’s $254 million in stolen funds, suggesting either fewer major breaches or reduced impact from exploits. Cronos paused its network on Sunday following a separate reported $75 million exploit tied to the Tectonic DeFi lending protocol. How the More Markets reserve was drained According to Blockaid’s account of the event, the attacker targeted More Markets’ lending reserve that holds mFlowWFLOW. Blockaid said the stolen amount consisted of 15.5 million Wrapped Flow (WFLOW) tokens, which it valued at approximately $9.3 million based on blockchain data it shared publicly. Blockaid further claimed that the exploit depended on two linked mechanisms: the use of Ankr Staked FLOW (ankrFLOW) and Aave V3’s E-mode. E-mode is designed to increase borrowing power for specific asset groups when their values are expected to move together—commonly a liquid staking token and its corresponding underlying token. In practical terms, this means that when the protocol’s configuration treats certain pairs as sufficiently correlated, the borrowing limits can become more permissive. Blockaid’s report indicates the attacker leveraged that increased borrowing power to overextend against the reserve, resulting in the loss of WFLOW tokens from mFlowWFLOW. E-mode designed for correlation—what this incident suggests E-mode in Aave V3 is intended to make capital more efficient by rewarding users when asset prices track each other closely. Blockaid’s description of this exploit highlights a recurring risk in DeFi: when an attacker can obtain collateral exposure through a token wrapper or staking derivative, the assumed relationship between the assets may be insufficiently protective during the exploit window. Blockaid specifically tied the strategy to Ankr Staked FLOW (ankrFLOW) in combination with E-mode for correlated assets.