More Markets has suffered a major security exploit on Flow EVM, with an attacker draining approximately 15.5 million WFLOW from the decentralized lending protocol.<\/p>\n\n\n\n
Blockchain security firm Blockaid estimated the impact of the attack at roughly $9.3 million. Its initial investigation linked the exploit to an Ankr bonded liquid staking token and More Markets’ E Mode mechanism.<\/p>\n\n\n\n
The affected funds were taken from the protocol’s mFlowWFLOW lending reserve. Blockaid has also identified a series of transactions used to move assets after the exploit, although the final amount lost and the ultimate destination of the funds remain under investigation.<\/p>\n\n\n\n
Importantly, the initial findings do not indicate that either the Flow blockchain itself or Ankr was directly compromised.<\/p>\n\n\n\n
Blockaid disclosed the incident on Aug. 31, saying an attacker targeted More Markets, a decentralized lending protocol developed by More Labs.<\/p>\n\n\n\n
According to the security firm’s preliminary findings, approximately 15.5 million WFLOW was drained from the mFlowWFLOW lending reserve.<\/p>\n\n\n\n
Blockaid estimated the detected impact at roughly $9.3 million.<\/p>\n\n\n\n
However, that figure remains preliminary. Investigators are still tracing the movement of the stolen assets and determining the final amount controlled by the attacker.<\/p>\n\n\n\n
Blockaid published information connected to the exploit transaction, the deployment of the attacker’s contract, and a cluster of transactions that followed the initial drain.<\/p>\n\n\n\n
Those transactions appear to have been used to move funds after the exploit.<\/p>\n\n\n\n
At the time of the initial disclosure, Blockaid had not provided a final accounting of where all the assets ended up.<\/p>\n\n\n\n
More Markets is a decentralized and noncustodial lending protocol operating on Flow EVM.<\/p>\n\n\n\n
The platform is built using Aave V3 architecture and allows users to supply assets to earn interest, borrow against collateral, and liquidate positions that fall below required collateral thresholds.<\/p>\n\n\n\n
Its public repository lists nine supported lending markets.<\/p>\n\n\n\n
Among the supported assets are WFLOW and ankrFLOW.<\/p>\n\n\n\n
More Markets lists WFLOW with a loan-to-value ratio of 81.5% and a liquidation threshold of 83%.<\/p>\n\n\n\n
For ankrFLOW, the loan-to-value ratio is 78.5%, while its liquidation threshold stands at 81%.<\/p>\n\n\n\n
Blockaid specifically identified an Ankr bonded liquid staking token and More Markets’ E Mode functionality as components involved in the attack.<\/p>\n\n\n\n
Blockaid’s initial report did not provide a complete technical explanation of how the attacker was able to drain the WFLOW reserve.<\/p>\n\n\n\n
As a result, the exact underlying vulnerability remains unclear.<\/p>\n\n\n\n
Based on the information released so far, it has not been determined whether the issue originated from More Markets’ implementation, the treatment of ankrFLOW inside the lending protocol, asset-pricing assumptions, or an interaction between multiple components.<\/p>\n\n\n\n
That distinction is important because mentioning an Ankr liquid staking token in the attack does not necessarily mean that Ankr’s underlying protocol or contracts were compromised.<\/p>\n\n\n\n
Blockaid’s initial disclosure only identified the bonded LST and More Markets’ E Mode mechanism as parts of the exploit.<\/p>\n\n\n\n
Ankr describes ankrFLOW as a reward-bearing liquid staking token issued when users stake FLOW through its staking service.<\/p>\n\n\n\n
Instead of requiring users to keep their FLOW locked without liquidity, ankrFLOW represents the value of their staked position and can be used elsewhere in decentralized finance.<\/p>\n\n\n\n
According to Ankr, the value of ankrFLOW relative to FLOW increases as staking rewards accumulate, while the number of ankrFLOW tokens held by a user stays unchanged.<\/p>\n\n\n\n
Ankr maintains separate smart contracts on Flow EVM for the ankrFLOW token, staking pool, staking configuration, and ratio feed.<\/p>\n\n\n\n
The ratio feed contains the token’s ratio certificate.<\/p>\n\n\n\n
Ankr also states that users can deploy ankrFLOW across DeFi applications, including lending markets, where the token can be used as collateral to borrow against the value of staked FLOW.<\/p>\n\n\n\n
Its Flow liquid staking contracts across Cadence and EVM have undergone external audits by Halborn, according to Ankr’s documentation.<\/p>\n\n\n\n
Despite ankrFLOW being involved in the mechanism identified by Blockaid, the security company did not say that Ankr itself had suffered an exploit.<\/p>\n\n\n\n
This is an important distinction.<\/p>\n\n\n\n
The available information points to More Markets as the protocol targeted in the incident.<\/p>\n\n\n\n
Until investigators release a detailed technical post-mortem, it remains uncertain whether the attack involved an issue with More Markets’ collateral settings, E Mode configuration, pricing assumptions, token integration, or another interaction within the lending system.<\/p>\n\n\n\n
The exploit occurred on an application running on Flow EVM, but Blockaid’s initial findings did not indicate that the Flow blockchain itself had been compromised.<\/p>\n\n\n\n
Flow EVM provides an Ethereum-compatible environment within the Flow ecosystem.<\/p>\n\n\n\n
This allows decentralized applications designed for the Ethereum Virtual Machine to operate on Flow, including lending platforms such as More Markets.<\/p>\n\n\n\n
That means an exploit targeting an application deployed on Flow EVM is not necessarily the same as an exploit against the underlying Flow network.<\/p>\n\n\n\n
Based on Blockaid’s initial assessment, the Aug. 31 attack targeted More Markets rather than Flow’s core blockchain infrastructure.<\/p>\n\n\n\n
Flow has previously promoted both More Markets and Ankr as part of its decentralized finance ecosystem.<\/p>\n\n\n\n
Its Community Rewards program, for example, has offered incentives for activity involving lending protocols such as More Markets as well as staking FLOW through Ankr’s liquid staking service.<\/p>\n\n\n\n
The latest incident therefore affects a protocol operating within Flow’s ecosystem, but there is currently no evidence in Blockaid’s initial disclosure suggesting a network-wide compromise.<\/p>\n\n\n\n
This difference is especially significant because Flow suffered a separate blockchain-level security incident in late 2025.<\/p>\n\n\n\n
On Dec. 27, 2025, Flow experienced a separate security breach involving a vulnerability in its Cadence execution layer.<\/p>\n\n\n\n
That exploit allowed an attacker to duplicate fungible tokens before extracting approximately $3.9 million in value.<\/p>\n\n\n\n
Flow Foundation’s subsequent investigation found that the attacker had deployed more than 40 malicious smart contracts in a coordinated sequence.<\/p>\n\n\n\n
The vulnerability existed in Cadence runtime version 1.8.8.<\/p>\n\n\n\n
According to Flow’s post-mortem, the flaw allowed a protected asset that should not have been copyable to be disguised as a standard data structure and duplicated.<\/p>\n\n\n\n
More than 1 billion counterfeit FLOW tokens were sent to centralized exchanges during that incident.<\/p>\n\n\n\n
Flow later said that approximately 484.4 million FLOW was returned by OKX, Gate.io, and MEXC and subsequently destroyed.<\/p>\n\n\n\n
The network also reported isolating approximately 98.7% of the remaining counterfeit supply.<\/p>\n\n\n\n
The December 2025 exploit forced Flow validators to halt the blockchain within hours of the first malicious transaction.<\/p>\n\n\n\n
Flow Foundation initially proposed a complete chain rollback.<\/p>\n\n\n\n
That approach would have restored the network to a checkpoint before the exploit took place.<\/p>\n\n\n\n
However, the proposal faced strong opposition from bridge operators and other members of the Flow ecosystem.<\/p>\n\n\n\n
Critics warned that reversing already confirmed transactions could create duplicated balances for users who had transferred assets through bridges during the affected period.<\/p>\n\n\n\n
It could also potentially create losses for users who had moved assets into or out of Flow before the rollback.<\/p>\n\n\n\n
Flow eventually abandoned the network-wide rollback.<\/p>\n\n\n\n
Instead, the project adopted a more targeted recovery process aimed at identifying and destroying counterfeit assets while preserving legitimate transaction history.<\/p>\n\n\n\n
During the recovery from the December incident, Flow developers worked to restore both Cadence and Flow EVM functionality.<\/p>\n\n\n\n
Accounts connected to suspicious activity were temporarily restricted while outside forensic firms helped analyze affected addresses.<\/p>\n\n\n\n
Flow estimated that more than 99.9% of accounts would regain full access once the recovery process was completed.<\/p>\n\n\n\n
The incident eventually created regulatory and market consequences outside the technical recovery process as well.<\/p>\n\n\n\n
The aftermath of the December exploit later reached South Korea.<\/p>\n\n\n\n
Flow Foundation and Dapper Labs sought a court order in March to prevent Upbit, Bithumb, and Coinone from ending support for FLOW trading.<\/p>\n\n\n\n
The exchanges had moved toward delisting the cryptocurrency following the security incident.<\/p>\n\n\n\n
Flow argued that legitimate user balances had not been compromised and challenged the proposed removal of FLOW from those trading platforms.<\/p>\n\n\n\n
This earlier incident provides important context for the latest More Markets exploit, but the two attacks appear fundamentally different based on the information currently available.<\/p>\n\n\n\n
The Aug. 31 More Markets attack is currently based on Blockaid’s preliminary assessment.<\/p>\n\n\n\n
So far, investigators have identified approximately 15.5 million WFLOW drained from the mFlowWFLOW lending reserve, with an estimated impact of around $9.3 million.<\/p>\n\n\n\n
The attack appears to involve an Ankr bonded liquid staking token and More Markets’ E Mode mechanism.<\/p>\n\n\n\n
However, the precise technical vulnerability has not yet been publicly established.<\/p>\n\n\n\n
There is also no indication in Blockaid’s initial disclosure that Ankr itself or the underlying Flow blockchain was compromised.<\/p>\n\n\n\n
Until investigators provide a full technical breakdown and complete tracing of the transferred assets, the final financial loss and exact root cause of the More Markets exploit remain uncertain.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
More Markets has suffered a major security exploit on Flow EVM, with an attacker draining approximately 15.5 million WFLOW from the decentralized lending protocol. Blockchain security firm Blockaid estimated the impact of the attack at roughly $9.3 million. Its initial investigation linked the exploit to an Ankr bonded liquid staking token and More Markets’ E…<\/p>\n","protected":false},"author":3,"featured_media":16322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,70],"tags":[65,86,2339],"class_list":["post-16321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto-news","category-finance","tag-crypto","tag-market","tag-wflow"],"yoast_head":"\n