Attacker Drains 15.5 Million WFLOW From More Markets Lending Reserve on Flow EVM

WFLOW Reserve Drained

An attacker exploited the More Markets DeFi lending protocol on Flow EVM and drained 15.5 million WFLOW, which Blockaid estimated at roughly $9.3 million, from the protocol’s mFlowWFLOW lending reserve.

Blockaid said the attacker used an Ankr liquid staking token, Ankr Staked FLOW (ankrFLOW), together with E-mode to overborrow from the reserve, leveraging how borrowing limits were calculated.

The incident quickly affected token markets, with the WFLOW price dropping around 9% and FLOW falling about 8.7% to $0.0262, as traders reacted to the exploit rather than a broad crypto market sell-off.

More Markets had not confirmed the loss amount or disclosed a recovery plan as of publication, while its team said, “Our team is currently investigating a claim that MORE Markets was exploited. We will share our findings shortly.”

Reporting for this sectionCryptoRank

Blockaid’s Mechanism

Blockaid’s analysis, as echoed by Menafn, tied the theft to “Ankr Staked FLOW (ankrFLOW), a liquid staking token, together with E-mode -a feature associated with Aave V3,” describing how the protocol’s E-mode assumptions could be exploited. Menafn also reported that the exploitation contributed to total crypto hack losses of $139.7 million in August 2026, while DefiLlama data showed July thefts at $254 million.

Cointelegraph framed the same core mechanics by saying Blockaid reported an attacker used an Ankr liquid staking token and E-mode to overborrow from More Markets and drain about $9.3 million in WFLOW from a lending reserve. Cointelegraph added that More Markets had not publicly confirmed the incident or disclosed whether users suffered losses at the time of publication, and it said it contacted Blockaid but did not receive a response by publication.

Reporting for this sectionMenafnCointelegraph

Broader Risk and Next Steps

Blockaid’s disclosure, as summarized by Crypto News, described the drained tokens as coming from the mFlowWFLOW lending reserve and said its “detected impact” of roughly $9.3 million was not yet confirmed while investigators trace the transactions. Crypto News also reported that Blockaid had not said Ankr or the Flow blockchain itself was compromised, and that the initial disclosure identified More Markets as the protocol targeted.

Beyond the More Markets incident, Cointelegraph reported that on Sunday Cronos halted its blockchain network after a reported $75 million exploit targeting the DeFi lending protocol Tectonic. For More Markets users, the immediate stakes remained unresolved in the sources, with Menafn stating More Markets had not publicly confirmed the incident or disclosed potential user losses as of publication.

Reporting for this sectionCrypto NewsCointelegraph