More Markets loses $9.3M in lending reserve exploit, Blockaid reports

A DeFi lending protocol called More Markets lost roughly $9.3 million on August 31 after attackers found a way to exploit its lending reserve on the Flow EVM blockchain. Security firm Blockaid detected and disclosed the incident, which drained 15.5 million WFLOW tokens from the mFlowWFLOW reserve.

The method was surgical. Attackers paired Ankr’s bonded liquid staking token, ankrFLOW, with the efficiency mode feature baked into Aave V3, a mechanism designed to let borrowers extract more capital against correlated assets. In this case, that efficiency became a liability: combining the two allowed attackers to overborrow far beyond what the protocol’s safeguards were built to handle.

How the exploit worked

Aave V3’s E-mode, short for efficiency mode, is meant to increase capital efficiency for asset pairs that move closely together in price. When assets are correlated, the logic goes, there’s less liquidation risk, so the protocol can extend higher loan-to-value ratios.

AnkrFLOW, a liquid staking token representing staked FLOW, introduced a vector the protocol wasn’t designed to catch. By using ankrFLOW as collateral inside an E-mode configuration, the attacker unlocked borrowing capacity that exceeded what the underlying collateral could actually support.

After the drain, More Markets’ total value locked fell to roughly $3.64 million, with active loans sitting at approximately $3.67 million. Those numbers are nearly identical, which points to a protocol operating with almost no buffer between what it holds and what it owes.

The silence from More Markets

As of the time Blockaid reported the incident, More Markets had not released any public statement. No operational pause was announced, no guidance was offered to users about the status of their funds, and no recovery roadmap was shared.

August 2026 in context

The More Markets incident landed in a month that was already rough for the sector. Total exploit losses across DeFi in August 2026 reached $139.7 million, making it the third-largest month for hack losses in the year, according to data from DefiLlama.

That number represents a meaningful improvement over July, when total losses hit $254 million.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.