More Markets hit by $9.3M WFLOW exploit on Flow EVM
6.7 Security More Markets lost ~$9.3M after attackers exploited its Flow EVM lending reserve using Ankr liquid staking tokens and E-Mode, draining 15.5M WFLOW. The incident highlights DeFi risk control issues.
More Markets, a DeFi lending protocol on Flow EVM, suffered an exploit on August 31, resulting in a loss of about $9.3 million. Attackers drained 15.5 million Wrapped Flow (WFLOW) tokens from the mFlowWFLOW lending reserve. They achieved this by leveraging Ankr bonded liquid staking tokens (ankrFLOW) and the protocol’s E-Mode, a feature adapted from Aave V3 that increases borrowing capacity for correlated assets. This combination allowed the attacker to overborrow, bypassing the protocol’s safeguards. Security firm Blockaid detected and reported the exploit, clarifying that neither Ankr nor the Flow blockchain was compromised; the vulnerability was specific to More Markets’ protocol design. The incident has not yet been publicly confirmed by More Markets, and the final losses and asset destinations remain under investigation. The exploit has renewed scrutiny of risk controls and correlated-asset borrowing mechanisms in DeFi protocols.
