More Markets lending reserve drained for $9.3M: Blockaid
Blockaid says an attacker drained about $9.3 million in Wrapped Flow (WFLOW) from a More Markets lending reserve on Flow EVM by using an Ankr liquid staking token and E-mode to overborrow, pulling roughly 15.5 million WFLOW tokens from the mFlowWFLOW pool. The Web3 security firm shared blockchain data on Monday, marking another high-profile DeFi exploit as August hack losses climb toward $139.7 million.
Key Takeaways
- Blockaid reported about $9.3 million in WFLOW drained from More Markets' mFlowWFLOW lending reserve on Flow EVM.
- The attacker allegedly combined Ankr Staked FLOW (ankrFLOW) with E-mode, an Aave V3 feature that boosts borrowing power for correlated assets.
- August crypto hack losses reached $139.7 million, per DefiLlama — the third-largest month of 2026, though down from July's $254 million.
- More Markets had not publicly confirmed the incident or disclosed user losses at the time of reporting.
- The exploit followed a separate Sunday incident in which Cronos halted its network after an estimated $75 million Tectonic lending protocol breach.
How did the More Markets lending reserve exploit work?
According to CoinTelegraph, Blockaid traced the attack to the mFlowWFLOW lending reserve within More Markets, a decentralized finance vault infrastructure protocol. Blockchain data shared by Blockaid on Monday showed the attacker withdrew approximately 15.5 million WFLOW tokens, valued at roughly $9.3 million.
Blockaid said the exploit relied on Ankr Staked FLOW (ankrFLOW), a liquid staking token, paired with E-mode to overborrow against the reserve. The technique allowed the attacker to extract far more value than conventional collateral rules would typically permit.
Why does E-mode borrowing pose a risk to DeFi lenders?
E-mode, short for efficiency mode, is an Aave V3 feature designed to increase borrowing power for assets whose prices are expected to move together. A common pairing is a liquid staking token and its underlying asset — exactly the setup Blockaid flagged in this case.
When correlated-asset assumptions break down or are manipulated, E-mode can amplify losses rapidly, as demonstrated by the scale of the WFLOW withdrawal from the More Markets lending reserve.
What does the $9.3M drain mean for August crypto hack losses?
The More Markets incident pushed total cryptocurrency hack losses to $139.7 million for August, making it the third-largest month by value stolen so far in 2026, according to DefiLlama data cited by CoinTelegraph. That figure still represents a significant drop from the $254 million stolen during July.
The attack also landed amid a broader weekend of DeFi turmoil. On Sunday, Cronos halted its blockchain network after an exploit targeting lending protocol Tectonic involved an estimated $75 million, with researcher Weilin Li describing a pump-and-borrow attack on the TONIC governance token. Crypto.com CEO Kris Marszalek said the company's app and exchange were unaffected.
For ongoing coverage of protocol breaches and market-moving security events, see our Fintech & Crypto Alerts hub.
Has More Markets responded to the Blockaid report?
At the time of publication, More Markets had not publicly confirmed the incident or disclosed whether users suffered losses. CoinTelegraph reported it was unable to reach More Markets for comment and that Blockaid had not responded to requests for additional details.
Until an official statement arrives, the Blockaid report and on-chain data remain the primary public record of the exploit. Users with funds in More Markets lending pools should monitor official channels and exercise caution when interacting with affected reserves.