More Markets suffered an estimated $9.3 million exploit on Flow EVM on August 31, after an attacker used an Ankr bonded liquid-staking position together with E-Mode to empty the protocol's WFLOW lending reserve.

The attack removed 15.5 million WFLOW from the mFlowWFLOW market before the assets moved through a cluster of post-exploit transactions. The $9.3 million figure represents the initial detector impact, with the final bad debt and recoverable amounts still to be established.

Ankr LST and E-Mode Used to Drain WFLOW

More Markets is a noncustodial lending protocol built on Aave V3 and deployed on Flow EVM. Users can supply assets for yield, post collateral, and borrow from liquidity reserves, with WFLOW and ankrFLOW among its supported markets.

Aave V3's Efficient Mode, or E-Mode, increases capital efficiency for assets grouped into correlated categories by allowing category-level loan-to-value and liquidation parameters. The feature can therefore support greater borrowing capacity than standard collateral settings when an eligible position operates inside an E-Mode category. E-Mode was designed for assets expected to move closely in price, such as liquid-staking tokens paired with their underlying stake, and the higher borrowing capacity it enables depends on that correlation holding under market stress or manipulation.

Under More Markets' standard Flow configuration, WFLOW carries an 81.5% LTV with an 83% liquidation threshold, while ankrFLOW has a 78.5% LTV and an 81% liquidation threshold. E-Mode can replace these standard risk parameters with category-specific settings for qualifying collateral and debt positions.

The confirmed attack path centers on the Ankr-linked liquid-staking position, E-Mode, and the emptied mFlowWFLOW reserve. The affected component was More Markets' lending system, not Flow's underlying consensus infrastructure.

More Markets Liquidity Falls Below Exploit Estimate

After the exploit surfaced, More Markets was carrying about $3.64 million in TVL alongside roughly $3.67 million in active loans. The initial $9.3 million detector impact is therefore substantially larger than the protocol's remaining reported locked value.

The attack follows another major lending-market exploit less than a day earlier. Cronos halted block production after a Tectonic exploit produced an early loss estimate near $75 million, with manipulated TONIC collateral used to borrow higher-value assets.

Several days before that, a separate Moonwell attack on Base extracted roughly $9 million, after attackers inflated thinly traded MAMO collateral before borrowing cbBTC, USDC, and Ethereum-linked assets.

The three incidents share a common mechanism: collateral whose valuation could be distorted was used to borrow larger amounts of more liquid assets from lending reserves. This pattern has historically been one of the most recurring loss vectors in DeFi lending, which is why established protocols restrict oracles and borrowing against low-liquidity or tightly correlated asset pairs.

Flow Mainnet Continues Operating

Flow itself remained online throughout the More Markets attack. Mainnet core components remained operational, including block finalization, transaction execution, block sealing, and the network's EVM Gateway.

The network experienced no mainnet-wide halt tied to the More Markets drain. As of publication, Flow's EVM Gateway and core block-production infrastructure remained operational. Pending items for the protocol include the final bad-debt accounting, any recovery or fund-tracing efforts around the post-exploit transactions, and whether More Markets adjusts its E-Mode and liquid-staking risk parameters before reopening the affected market.