More Markets, a decentralized noncustodial lending protocol on Flow EVM built by More Labs, suffered an exploit in the early hours of Aug. 31, 2026 that drained about 15.5 million WFLOW from its mFlowWFLOW lending reserve. Blockchain security firm Blockaid estimated the detected impact at roughly $9.3 million and linked the attack to an Ankr bonded liquid staking token and More Markets’ E Mode mechanism.
Blockaid said in an Aug. 31 post on X that the attacker used an Ankr bonded LST together with the protocol’s E Mode setting, which allows higher leverage against correlated assets. The firm published the exploit transaction, the contract deployment transaction and a cluster of post-exploit transfers used to move funds. It stopped short of saying Ankr or the Flow blockchain was compromised, describing its disclosure as an initial assessment while final losses and the destination of the assets remain under investigation.
More Markets had not immediately confirmed the loss, writing that it was “currently investigating a claim that MORE Markets was exploited.” The protocol is built using Aave V3 architecture and lists nine supported markets, allowing users to supply assets for interest, borrow against collateral and liquidate positions below required collateral levels. WFLOW and ankrFLOW are among the supported assets, with WFLOW listed at an 81.5% loan-to-value ratio and 83% liquidation threshold, and ankrFLOW at 78.5% LTV and 81% liquidation threshold.
Ankr describes ankrFLOW as a reward-bearing liquid staking token issued when users stake FLOW through its staking service. Its value relative to FLOW increases as staking rewards accrue, while the token balance remains unchanged. The documentation states that Flow liquid staking contracts underwent external audits by Halborn, and Blockaid has not indicated that Ankr itself was compromised.
The incident targeted an application on Flow EVM rather than the Flow blockchain, according to Blockaid’s disclosure. That distinction matters because Flow suffered a separate network-level breach in late December 2025, when an attacker exploited a Cadence execution layer vulnerability and extracted about $3.9 million. Flow later abandoned a proposed full chain rollback and pursued an isolated recovery process.
DeFiLlama data puts More Markets’ total value locked at about $5.6 million with roughly $3.41 million in active loans, so the episode is not expected to have a seismic effect across DeFi. It nevertheless adds to a rough stretch for the sector, following Moonwell’s loss of as much as $9 million in a MAMO price-manipulation attack on its Base market, a roughly $500,000 drain from Solana neobank Avici, and about $775,000 lost by Ethereum lending protocol Ajna to liquidation accounting manipulation.
