More Markets' Lending Reserve Drained of $9.3 Million in Wrapped Flow (WFLOW)

15.5M WFLOW Drained Overnight

An attacker drained roughly $9.3 million from the lending reserve of More Markets, a decentralized lending market on Flow EVM, in the early hours of August 31, 2026. Web3 security platform Blockaid, which flagged the incident onchain, estimates the thief walked away with about 15.5 million Wrapped Flow (WFLOW) tokens from the protocol's mFlowWFLOW reserve. More Markets is a non-custodial lending venue built by More Labs — one that matches lenders and borrowers directly rather than relying on the pooled liquidity model of Uniswap pools. The protocol has not confirmed the loss. In a post published the same morning, the team said it is reviewing the exploit claim and will share results once its investigation concludes. No full incident report was available at the time of writing, and Blockaid has stopped short of blaming either Ankr or the Flow blockchain itself for the breach.

How the Reserve Was Tapped

Blockaid's onchain reconstruction points to a two-part recipe. The attacker supplied an Ankr bonded liquid staking token, ankrFLOW, as collateral, then used More Markets' E-mode setting to overborrow against the mFlowWFLOW reserve. E-mode — efficiency mode in Aave V3 terminology — raises borrowing power for assets whose prices are expected to move in lockstep, a design calibrated for tightly correlated pairs such as a liquid staking receipt against its base token, or stablecoin pairs. The firm published the exploit transaction, the attacker's contract deployment and 11 follow-up transfers in a detailed post on X, naming the attacker address, a helper wallet and the affected pool. A competing read from onchain analyst Spronky argues the sequence was cross-protocol liquidity extraction rather than a simple Ankr LST-plus-E-mode bug — a distinction that may matter once the root cause is formally confirmed.

detailed post on Xhttps://x.com/blockaid_/status/2094317778719142172

FLOW Drops 8% to $0.026

Markets moved fast once the exploit surfaced. Flow (FLOW), the native token of the chain where More Markets operates, slid about 8% over 24 hours to trade near $0.026, though the drop came against a broader pullback that shaved roughly 3% off total crypto market capitalization. Value locked in More Markets fell to roughly $3.6 million; DefiLlama had listed the protocol at about $5.6 million earlier in the session, including $3.41 million in active loans. That makes More Markets a small target in absolute terms — the loss is not expected to ripple across DeFi — but the speed of the drawdown shows how quickly confidence exits a lending venue once its reserve is tapped. Whether depositors absorb the shortfall, or the protocol's treasury makes them whole, remains undisclosed.

August Hack Losses Near $140M

The incident closes a punishing month for protocol security. DefiLlama logs 37 hacks in August with combined losses of roughly $140 million — about $139.7 million — making it the third-largest month by value stolen in 2026 so far, though well below July's $254 million. Lending protocols account for the bulk of that figure. The weekend alone delivered more damage: Cronos halted its blockchain on August 30 after identifying an exploit at Tectonic, its largest lending market, in an attack reported at about $75 million. Moonwell lost an estimated $8.7 million last week to a price-manipulation attack on its primary market — its third security incident in nine months — while Ethereum lending protocol Ajna lost nearly $775,000 days earlier to manipulation of liquidation accounts. Readers tracking the market in real time can follow live spot and futures prices on Binance.

Onchain Trail, Review Pending

The onchain evidence here is unusually complete. Blockaid's trace names the exploit transaction, the deployed contract and every subsequent hop, and the drained sum — 15.5 million WFLOW, valued near $9.3 million at the time — is verifiable directly on Flow EVM, leaving the attacker wallet sitting on a crypto whale-sized position. What remains open is the post-mortem: More Markets' official statement commits to publishing findings, and the E-mode-plus-LST combination Blockaid identified mirrors the correlated-collateral overborrowing pattern that has dominated this month's lending losses. Until the team confirms root cause and remediation, the $9.3 million figure stays an estimate — not a confirmed loss.

official statementhttps://x.com/MORE_DeFi/status/2094337707753222313