Blockaid links $9.3M WFLOW drain on More Markets to ankrFLOW E-mode overborrowing
The Flow EVM lending reserve loss is third-party reported, and the protocol had not confirmed user impact at publication time.
Web3 security platform Blockaid said More Markets’ mFlowWFLOW lending reserve on Flow EVM was drained of about 15.5 million WFLOW, valued at approximately $9.3 million. Blockaid attributed the drain to an attacker using Ankr Staked FLOW (ankrFLOW) alongside Aave-style E-mode mechanics to overborrow from the reserve.
Key Takeaways
- About 15.5 million WFLOW, valued at roughly $9.3 million, was drained from More Markets’ mFlowWFLOW lending reserve on Flow EVM, based on blockchain data shared by Blockaid.
- Blockaid attributed the drain to an overborrowing pathway that used Ankr Staked FLOW (ankrFLOW) as collateral alongside E-mode.
- E-mode, an Aave V3 feature, increases borrowing power for assets expected to move closely together in price, including a liquid staking token and its underlying asset.
- More Markets had not publicly confirmed the incident or disclosed whether users suffered losses at the time of publication.
Blockaid Flags a $9.3M WFLOW Drain From More Markets on Flow EVM
Blockaid said a lending reserve tied to More Markets on Flow EVM was drained of about 15.5 million Wrapped Flow (WFLOW), which the security firm valued at approximately $9.3 million. The reserve was identified as the “mFlowWFLOW lending reserve,” and Blockaid said its assessment was based on blockchain data it shared in a Monday post on X.
More Markets was described as a DeFi vault infrastructure protocol with lending reserves on Flow EVM, an EVM-compatible execution environment connected to the Flow ecosystem. The asset involved, WFLOW, is a wrapped version of FLOW used in EVM-style smart contract environments.
The immediate market relevance is not just the dollar figure, but the venue and the instrument mix. A WFLOW reserve on an EVM environment is the kind of pool traders treat as “plumbing” liquidity, and when that plumbing is drained, the question becomes whether the loss sits with the protocol’s balance sheet, with depositors in that specific reserve, or with borrowers who can no longer unwind positions cleanly.
At publication time, More Markets had not publicly confirmed the incident or disclosed whether users suffered losses. Blockaid also did not provide additional details beyond the initial public description by the time the report was published.
How ankrFLOW + E-Mode Can Turn “Correlated Collateral” Into Excess Borrowing Power
Blockaid’s core claim is that the drain was not framed as a simple key compromise or a direct withdrawal of WFLOW, but as an overborrowing route that used Ankr Staked FLOW (ankrFLOW) alongside “E-mode.” ankrFLOW was described as a liquid staking token, meaning it represents staked FLOW while remaining transferable and usable as collateral.
E-mode, short for efficiency mode, was described as an Aave V3 feature that increases borrowing power for assets whose prices are expected to move together, such as a liquid staking token and its underlying asset. The design intent is straightforward: if two assets are tightly correlated, a lending market can allow higher leverage because the collateral is assumed to track the borrowed asset closely, reducing liquidation risk under normal conditions.
The catch is that “expected to move together” is a risk assumption, not a guarantee, and it only holds if the integration and parameters are correct. In practice, E-mode style setups can amplify damage when something in the chain breaks: the collateral asset’s pricing, the correlation assumption, the caps and factors that limit borrow size, or the way the protocol recognizes and values the liquid staking token.
Blockaid said the attacker used ankrFLOW and E-mode to overborrow from the mFlowWFLOW reserve. Mechanically, that allegation implies a loop where the attacker’s collateral position was treated as strong enough under E-mode to support more WFLOW borrowing than the reserve’s risk settings should have allowed, and once the borrow ceiling was effectively bypassed, the reserve could be drained.
For traders, the important translation is that correlated-collateral leverage is not just a “higher LTV” toggle. It is an agreement between the protocol and the market about what counts as near-cash collateral, and when that agreement is wrong or can be gamed, the failure mode tends to be fast because the borrow side is liquid and the collateral side is slow to reprice or slow to liquidate.
What’s Known, What Isn’t: Protocol Confirmation, User Losses, and Missing Incident Details
The cleanest confirmed elements here are also the narrowest: Blockaid said the mFlowWFLOW lending reserve on Flow EVM was drained of about 15.5 million WFLOW, valued at approximately $9.3 million, and Blockaid said the attacker used ankrFLOW and E-mode to overborrow from the reserve.
Everything that matters for second-order risk is still unresolved because it depends on protocol-side confirmation and a fuller technical write-up. More Markets had not publicly confirmed the incident at the time of publication, and it had not disclosed whether users suffered losses. That leaves open basic questions traders typically need answered before they can price the damage: whether depositors in the affected reserve are impaired, whether the protocol has backstops, and whether any positions elsewhere in the system are now undercollateralized because the borrowed asset liquidity was pulled out.
There is also a detail gap on the exploit mechanics. Blockaid’s public description names the ingredients, ankrFLOW plus E-mode, but it does not, at least in the information available at publication time, specify the parameter or integration failure that made the overborrow possible. Without that, it is hard to separate three very different categories of incident that can look similar from the outside: a misconfigured E-mode category, an oracle or pricing pathway issue affecting the liquid staking token, or a protocol-specific accounting edge case in how collateral and debt were tracked.
That uncertainty is why the $9.3 million figure should be treated as a credible third-party estimate rather than a finalized loss number. The number is tied to blockchain data Blockaid said it reviewed, but the protocol itself had not confirmed the incident or the user impact by the time of publication.
Hack Tape Context: August at $139.7M, Lending Incidents in Focus After the Reported $75M Tectonic Hit
The reported More Markets drain landed in a month where aggregate hack losses were lower than July but still large enough to keep lending venues in the crosshairs. DefiLlama data cited alongside the incident put total August 2026 crypto hack losses at $139.7 million, versus $254 million stolen in July 2026, and August was described as the third-largest month by value stolen so far in 2026.
The timing also matters because it followed another lending-focused shock. On Sunday, Cronos halted its blockchain network after a reported $75 million exploit targeting DeFi lending protocol Tectonic. Different chain, different protocol, but the same broad category of risk: lending markets concentrate value, and when a borrow pathway breaks, the loss can be both immediate and socially contagious as liquidity leaves adjacent pools.
Near-term, there are four signals that will determine whether this stays a contained reserve event or becomes a wider risk repricing for Flow EVM lending. The first is a public incident confirmation from More Markets that states whether user funds were impaired and what remediation, if any, is planned. The second is whether Blockaid follows with transaction-level detail that pins the root cause to a specific configuration or integration failure, rather than a generic “E-mode was used” description.
The third is observable risk-parameter change on Flow EVM or within More Markets affecting ankrFLOW, WFLOW, or any E-mode category settings, including collateral factors, borrow caps, and whether E-mode toggles are tightened or disabled. The fourth is whether DefiLlama’s monthly totals move materially as August closes and early September incidents are logged, which would help confirm whether lending-focused exploits remain the dominant loss center even in lower-total months.
My Read: Why Correlated-Asset Leverage Setups Keep Showing Up in DeFi Losses
The incident is being read as another “lending got hacked” headline, but the procedural detail that matters is the alleged pathway. If Blockaid’s account is accurate, the failure mode was not simply that WFLOW was taken, it was that the system treated ankrFLOW and its underlying as tightly correlated under E-mode assumptions, and that assumption translated into borrowing power that could be pushed past what the reserve could survive.
That pattern keeps showing up because it sits at the intersection of incentives and configuration risk. Protocols want to offer higher capital efficiency to attract volume, liquid staking tokens want to be treated as high-quality collateral to expand their utility, and traders want leverage that does not immediately liquidate them on small moves. E-mode is the mechanism that makes that bargain possible, but it also compresses the margin for error. When the correlation breaks, when the pricing path is wrong, or when parameters are mis-set, the system does not fail gracefully. It fails by letting someone borrow too much, too quickly, against collateral the protocol thinks is safer than it is.
The threshold that matters next is not whether the $9.3 million estimate is off by a few percent, it is whether More Markets confirms the incident and clarifies who is holding the bag. If depositors in the mFlowWFLOW reserve are impaired, the market will treat this as a solvency and trust event for that venue on Flow EVM. If the protocol can make depositors whole and the root cause is clearly narrowed to a fixable parameter or integration issue, it becomes a contained risk-ops failure that still forces a repricing of correlated-asset leverage assumptions.
The real test is whether the follow-up detail identifies a specific E-mode configuration or ankrFLOW integration weakness that can be generalized to other correlated-collateral setups. If that link is made cleanly, this stops being a one-off Flow EVM story and becomes another precedent for why “correlated” collateral is only as safe as the risk settings and the integration surface that enforce it.
