More Markets Protocol Drained of $9.3 Million on Flow EVM

The August 31 incident specifically targeted the protocol's mFlowWFLOW lending reserve. According to Blockaid, the attacker leveraged Ankr bonded liquid staking tokens alongside More Markets’ E Mode—a feature typically designed to allow for higher borrowing power among correlated assets—to drain the reserve. While the firm has identified a cluster of transactions used to exfiltrate the funds, a final accounting of the attacker's holdings and the ultimate destination of the assets remains under investigation.

More Markets, built on Aave V3 architecture, is a noncustodial platform that allows users to supply and borrow assets. The protocol documentation lists WFLOW with a loan-to-value ratio of 81.5% and ankrFLOW at 78.5%. Despite the scale of the theft, Blockaid emphasized that the breach appears confined to the More Markets application rather than a compromise of the Ankr protocol or the underlying Flow blockchain itself. This distinction is significant for the Flow ecosystem, which previously navigated a complex recovery following a $3.9 million exploit in late 2025 that targeted the network's Cadence execution layer.