More Markets Lending Reserve Drained of $9.3M in WFLOW, Blockaid Reports
Key Takeaways
- •Blockaid reported that roughly $9.3 million worth of Wrapped Flow tokens, about 15.5 million WFLOW, was drained from More Markets' mFlowWFLOW lending reserve on Flow EVM.
- •The attacker combined Ankr Staked FLOW, a liquid staking token, with E-mode, an Aave V3 feature that raises borrowing power for closely correlated assets, to overborrow from the reserve.
- •The exploit brought August 2026 cryptocurrency hack losses to $139.7 million, the third-highest monthly total of the year but well below July's $254 million.
- •The incident came shortly after a reported $75 million exploit of the Tectonic lending protocol prompted Cronos to halt its blockchain network on Sunday.
- •More Markets had not publicly confirmed the incident, disclosed user losses, or announced a compensation plan at the time of publication.
A lending reserve on More Markets, a decentralized finance (DeFi) vault infrastructure protocol, was drained of roughly $9.3 million in digital assets on Flow EVM, according to Web3 security platform Blockaid.
Blockchain data shared by Blockaid in a Monday X post showed the attacker drained approximately 15.5 million Wrapped Flow (WFLOW) tokens, valued by Blockaid at about $9.3 million, from the mFlowWFLOW lending reserve.
According to Blockaid, the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, together with E-mode to overborrow from the reserve. E-mode, short for efficiency mode, is an Aave V3 feature that increases borrowing power for assets whose prices are expected to move together — for example, a liquid staking token and its underlying asset. While E-mode is designed to improve capital efficiency for closely correlated assets, exploits involving liquid staking tokens paired with high-leverage borrowing modes have surfaced repeatedly across DeFi lending markets, as the security assumption that the paired assets will hold their price relationship is a common attack surface.
The exploit brought total losses from cryptocurrency hacks to $139.7 million for August, making it the third-largest month by value stolen so far in 2026. That figure nonetheless represents a significant decrease from the $254 million stolen in July, according to DefiLlama data. Lending and vault protocols have remained a frequent target within those totals, with attackers focusing on mechanisms that allow borrowed positions against correlated collateral.
The incident follows another major DeFi breach: on Sunday, Cronos halted its blockchain network after a reported $75 million exploit targeting the DeFi lending protocol Tectonic. Back-to-back incidents of this size within days of each other underscore that lending-market design — rather than single wallet compromises — has been a recurring source of large losses this year.
At the time of publication, More Markets had not publicly confirmed the incident or disclosed whether users suffered losses. Cointelegraph contacted Blockaid for further details but had not received a response by publication, and was unable to reach More Markets for comment. A post-incident confirmation, user-loss disclosure, or compensation plan from More Markets, along with any follow-up analysis from security firms, would clarify the full impact on depositors in the mFlowWFLOW reserve.
Related: Humanity Protocol to prioritize operational security following $36M hack
