More Markets Exploit Drains $9.3 Million in WFLOW From Flow…

How Did The More Markets Exploit Drain WFLOW? Decentralized lending protocol More Markets is investigating a suspected exploit on Flow EVM after blockchain security firm Blockaid identified approximately 15.5 million Wrapped Flow tokens leaving one of the protocol’s lending reserves. Blockaid estimated the initial impact at roughly $9.3 million and said the attacker used an Ankr liquid staking token together with More Markets’ E-Mode borrowing configuration to drain WFLOW from the mFlowWFLOW reserve. More Markets has acknowledged the report but has not confirmed the final loss, whether users face permanent losses or whether any of the withdrawn assets can be recovered. “Our team is currently investigating a claim that MORE Markets was exploited,” the protocol said, adding that it would publish its findings after completing the investigation. Blockaid identified an exploit transaction, deployment of an attacker contract and subsequent transactions apparently used to move assets after the initial attack. The security firm described the activity as a post-exploit exfiltration sequence. The incident affected More Markets, an application operating on Flow EVM, rather than the Flow blockchain itself. There is no indication that Flow’s consensus mechanism, EVM infrastructure or wider network was compromised. Why Did E-Mode Increase The Lending Risk? More Markets is a non-custodial lending protocol developed by More Labs using architecture derived from Aave V3. Users can deposit assets to earn interest or use supported tokens as collateral for loans. The protocol supports WFLOW and ankrFLOW, Ankr’s liquid staking representation of staked FLOW. Published risk parameters list WFLOW with an 81.5% loan-to-value ratio and an 83% liquidation threshold, while ankrFLOW carries a 78.5% loan-to-value ratio and an 81% liquidation threshold. E-Mode, or Efficiency Mode, can allow users to borrow more when collateral and borrowed assets are expected to remain closely correlated. That can improve capital efficiency when a liquid staking token closely tracks its underlying asset, but it also increases the consequences of inaccurate pricing, weak liquidity assumptions or overly aggressive collateral settings. According to Blockaid’s preliminary assessment, the attacker combined the Ankr-linked liquid staking asset with More Markets’ E-Mode configuration to overborrow WFLOW and eventually empty approximately 15.5 million WFLOW from the affected reserve. The available information does not indicate that Ankr itself was compromised. The investigation instead centers on how the liquid staking asset interacted with More Markets’ collateral and borrowing rules. Investor Takeaway The incident shows that DeFi security depends on more than smart contract code. Loan-to-value ratios, liquidation thresholds, liquidity assumptions, oracle pricing and E-Mode settings can become attack surfaces when protocols give correlated assets greater borrowing power. Is The $9.3 Million Loss Final? The reported $9.3 million figure remains preliminary. It reflects Blockaid’s estimate based on the amount of WFLOW removed and its market value around the time of the attack.