More Markets suffered an estimated $9.3 million exploit on Flow EVM on August 31 after an attacker used an Ankr bonded liquid-staking position and E-Mode to empty its WFLOW lending reserve.
The attack removed 15.5 million WFLOW from the mFlowWFLOW market before assets moved through a cluster of post-exploit transactions. The $9.3 million figure represents the initial detector impact, with final bad debt and recoverable assets still to be established.
Ankr LST and E-Mode Used to Drain WFLOW
More Markets is a noncustodial lending protocol built on Aave V3 and deployed on Flow EVM. Users can supply assets for yield, post collateral and borrow from liquidity reserves, with WFLOW and ankrFLOW among its supported markets.
Aave V3’s Efficient Mode, or E-Mode, increases capital efficiency for assets grouped into correlated categories by allowing category-level loan-to-value and liquidation parameters. The feature can therefore support greater borrowing capacity than standard collateral settings when an eligible position operates inside an E-Mode category.
More Markets’ standard Flow configuration assigns WFLOW an 81.5% LTV with an 83% liquidation threshold, while ankrFLOW carries a 78.5% LTV and an 81% liquidation threshold. E-Mode can replace standard risk parameters with category-specific settings for qualifying collateral and debt positions.
The confirmed attack path centers on the Ankr-linked liquid-staking position, E-Mode and the emptied mFlowWFLOW reserve. The affected component was More Markets’ lending system rather than Flow’s underlying consensus infrastructure.
More Markets Liquidity Falls Below Exploit Estimate
More Markets was carrying about $3.64 million in TVL after the exploit surfaced, alongside roughly $3.67 million in active loans. The initial $9.3 million detector impact is therefore substantially larger than the protocol’s remaining reported locked value.
The attack follows another major lending-market exploit less than a day earlier. Cronos halted block production after a Tectonic exploit produced an early loss estimate near $75 million, with manipulated TONIC collateral used to borrow higher-value assets.
A separate Moonwell attack on Base extracted roughly $9 million several days earlier after attackers inflated thinly traded MAMO collateral before borrowing cbBTC, USDC and Ethereum-linked assets.
Flow Mainnet Continues Operating
Flow itself remained online throughout the More Markets attack. Mainnet core components remained operational, including block finalization, transaction execution, block sealing and the network’s EVM Gateway.
The network had no mainnet-wide halt tied to the More Markets drain. As of publication, Flow’s EVM Gateway and core block-production infrastructure remained operational.
