More Markets Drained Of $9.3M In WFLOW After Attacker Exploits Ankr LST And E-Mode Collateral Pricing
Crypto lending protocol More Markets has suffered an exploit resulting in the loss of approximately $9.3 million. Blockchain security firm Blockaid detected the attack on More Labs’ lending protocol operating on Flow EVM, where roughly 15.5 million wrapped WFLOW tokens were drained from the mFlowWFLOW lending reserve.
According to Blockaid’s disclosure, the attacker employed Ankr’s bonded liquid staking token in conjunction with More Markets’ E-mode mechanism to execute the exploit. The attacker appears to have manipulated the perceived value of their collateral, allowing them to borrow genuine WFLOW against artificially inflated collateral and subsequently deplete the protocol’s entire WFLOW lending reserve.
Blockaid identified the exploit transaction, the initial contract deployment, and a cluster of post-exploit transfers used to exfiltrate funds following the drainage, though the firm had not provided a final accounting of the attacker’s holdings at the time of disclosure.
More Markets operates as a decentralized, noncustodial lending protocol built on Aave V3 architecture and deployed on Flow EVM. The platform lists nine supported markets where users supply assets to earn interest, borrow against collateral at variable rates, and liquidate positions falling below required collateral levels. WFLOW, the native wrapped asset, carries an 81.5% loan-to-value ratio and 83% liquidation threshold, while ankrFLOW holds a 78.5% LTV and 81% liquidation threshold.
Application-Layer Scope Distinguishes Exploit from Flow’s Prior Network Breach
The ankrFLOW token, issued by Ankr, functions as a reward-bearing liquid staking token whose value appreciates relative to FLOW as staking rewards accumulate, without altering the holder’s token balance. Ankr’s documentation states that its Flow liquid staking contracts on both Cadence and EVM underwent external audits by Halborn.
Blockaid’s analysis did not identify Ankr itself as compromised, specifying only that the bonded LST and More Markets’ E Mode served as components in the attacker’s methodology. The precise technical sequence remains undisclosed, leaving uncertainty whether the vulnerability originated in More Markets’ implementation, the handling of the Ankr asset, its pricing assumptions, or an interaction between these components.
The incident targeted an application operating within Flow EVM, an Ethereum-compatible execution environment on the Flow blockchain, with no indication that the underlying network infrastructure was compromised. This distinction carries importance given Flow’s recent security history. In December 2025, a separate attack exploited a vulnerability in Flow’s Cadence execution layer version 1.8.8, enabling the duplication of a protected asset disguised as a standard data structure and the extraction of approximately $3.9 million.
That incident involved over one billion counterfeit FLOW tokens minted and distributed to centralized exchanges, though 484.4 million were subsequently returned by OKX, Gate.io, and MEXC and destroyed, while the network isolated 98.7% of the remaining counterfeit supply.
Following the disclosure, the More Markets team reported that it was investigating claims that the protocol had been exploited and that it would share its findings shortly.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
