Correction (September 2, 2026): This article originally put the More Markets loss at roughly $9.3 million, based on security firm Blockaid’s initial automated estimate. Blockaid later corrected that number, and independent on-chain data confirms the ~15.5 million WFLOW drained was worth about $410,000 at the time, of which roughly $250,000 was realized by the attacker after slippage. Figures throughout have been updated; see the sourcing note at the end.
A decentralized lending protocol most crypto users had never heard of before August 31 just became the newest case study in a problem the DeFi industry keeps failing to fix. More Markets, a lending app built on Flow EVM using Aave V3’s architecture, lost roughly $410,000 in Wrapped Flow (WFLOW) tokens after an attacker combined a liquid staking token with a borrowing feature called E-Mode to walk away with far more than the protocol’s risk parameters were designed to allow.
Security firm Blockaid flagged the incident within minutes, tracing roughly 15.5 million WFLOW leaving the protocol’s mFlowWFLOW reserve. More Markets confirmed it was investigating but had not, as of publication, confirmed a final loss figure or said whether users face permanent losses. The exploit lands in the same week as the much larger Cronos-Tectonic incident, and together they cap a rough stretch for DeFi lending markets that has security researchers once again asking why correlated-asset collateral keeps breaking the same way.
What happened to More Markets on Flow EVM
More Markets is a non-custodial lending protocol built by More Labs on Flow EVM, the Ethereum-compatible execution layer of the Flow blockchain. Like dozens of newer lending apps launched over the past two years, it doesn’t write its own lending logic from scratch. It forks Aave V3’s battle-tested code, then adjusts collateral parameters for the assets it wants to support, in this case WFLOW (wrapped FLOW) and ankrFLOW, Ankr’s liquid staking token that represents staked FLOW plus accrued rewards.
According to Blockaid’s preliminary assessment, an attacker deposited ankrFLOW as collateral, then used it to borrow WFLOW against a feature called E-Mode. E-Mode, short for Efficiency Mode, is an Aave V3 feature that raises the loan-to-value ceiling for asset pairs the protocol treats as tightly correlated, such as a liquid staking token and the asset it represents. More Markets’ published risk parameters set WFLOW at an 81.5% loan-to-value ratio with an 83% liquidation threshold, while ankrFLOW carried a 78.5% loan-to-value ratio and an 81% liquidation threshold. Those settings work fine when the correlation assumption holds. When it doesn’t, or when an attacker can manipulate how that correlation is priced inside the protocol, the safety margin collapses fast.
Blockaid identified the exploit transaction, the deployment of an attacker-controlled contract, and a follow-up sequence of transfers it described as post-exploit exfiltration. The attacker drained roughly 15.5 million WFLOW from the mFlowWFLOW reserve. Blockaid’s first alert valued that haul at about $9.3 million, but that was an initial automated-detector figure that priced WFLOW far above its actual market rate. Blockaid subsequently corrected the number, and independent on-chain accounting from DeFiLlama values the drained reserve at roughly $410,000 to $420,000 at the time of the attack, of which the attacker realized an estimated $250,000 after slippage while exiting a thin market. More Markets had not confirmed a final loss figure as of publication, since the eventual loss depends on how much bad debt remains once liquidations and any recovery efforts settle.
This was not a breach of Flow’s underlying blockchain: Flow’s consensus mechanism and EVM environment kept running normally throughout, a meaningfully different failure mode than a bridge hack or a validator compromise. Where the root cause sat is still contested. Blockaid, the firm that flagged the attack, has not pinned down whether the flaw originated in More Markets’ own configuration, in how Ankr’s staking token was handled, or in the interaction between the two. The Flow Foundation says the root cause was a vulnerability in Ankr’s ankrFLOW liquid-staking contract that let the attacker create roughly 8.6 million unbacked ankrFLOW, and that neither Flow EVM nor More Markets was itself compromised; that account has not yet been independently confirmed, and the funds were ultimately drained from More Markets’ reserve after it accepted ankrFLOW as E-Mode collateral.
Why E-Mode turns a safety feature into an attack surface
E-Mode exists to solve a real capital-efficiency problem. Under normal Aave-style lending rules, a user depositing a liquid staking token as collateral to borrow the underlying asset gets a conservative loan-to-value ratio, because the protocol has to account for the possibility that the two assets could de-peg or trade apart. E-Mode relaxes that assumption for asset categories the protocol operator has decided are safe to treat as near-equivalents, unlocking much higher borrowing limits.
That tradeoff has burned DeFi lenders before, and not just once. The pattern the More Markets exploit follows, correlated or thinly-traded collateral getting overvalued and then used to drain a lending pool, has shown up repeatedly since 2021. What changes each time is the specific mechanism: sometimes it’s a price oracle getting manipulated directly, sometimes it’s a flash loan distorting a spot price, and sometimes, as appears to be the case here, it’s a high-leverage mode designed for one risk profile getting applied to an asset pair that didn’t deserve the trust.
The core lesson security researchers keep repeating is that DeFi risk increasingly lives in economic configuration, not in raw code bugs. A smart contract can execute precisely as written, pass a full audit, and still produce a multimillion-dollar loss if the assumptions behind its collateral math are wrong. Loan-to-value ratios, liquidation thresholds, oracle sourcing, and E-Mode groupings are all knobs a protocol team sets manually, and getting any one of them wrong on a newer chain with thinner liquidity turns a design choice into an attack surface.
The numbers: what was lost and how it compares
The table below lays out the core facts of the More Markets incident, drawing on Blockaid’s monitoring, independent on-chain data, and the corrected loss figure that followed the initial reports.
| Detail | Figure |
|---|---|
| Date of exploit | August 31, 2026 |
| Protocol | More Markets (built on Aave V3 architecture) |
| Chain | Flow EVM |
| Reserve drained | mFlowWFLOW lending reserve |
| Tokens removed | ~15.5 million WFLOW |
| Value drained | ~$410,000 at the time (~$250,000 realized after slippage) |
| Initial estimate (later corrected) | ~$9.3 million — a withdrawn automated-detector figure |
| Attack vector | ankrFLOW liquid staking token + E-Mode overborrowing |
| Detection source | Blockaid on-chain monitoring |
| Base chain impact | None to Flow’s base layer — consensus and EVM ran normally (root cause still contested) |
Set against the rest of August 2026, the More Markets exploit is one of the smaller entries in an unusually busy month for DeFi security incidents. The same week saw Cronos halt block production entirely after an approximately $75 million exploit hit Tectonic, its largest lending protocol, and roughly a week earlier Moonwell lost about $8.7 million to a price-oracle exploit on Base. According to DeFiLlama data cited by outlets covering the incident, total crypto exploit losses for August 2026 reached approximately $139.7 million, the third-highest monthly total of the year, though still below July’s $254 million.
Scale matters here, and the corrected figure changes it. At roughly $410,000, the More Markets drain is small in dollar terms, the kind of loss that barely registers against a money market like Aave, which carries billions in total value locked. It lands harder in context, though: More Markets held only about $3.9 million in total value locked when it was hit, so the attacker emptied a large share of that specific reserve. Flow’s wider DeFi footprint is also thin and shrinking, with on-chain TVL falling from around $84 million at the start of 2026 to roughly $13 million by late August, so even a low-six-figure exploit is a visible dent in a small ecosystem rather than a rounding error the way it would be on Ethereum mainnet.
Historical context: this attack pattern isn’t new
DeFi lending has a long, well-documented history of losses tied to correlated or manipulable collateral, and More Markets fits neatly into that lineage rather than breaking new ground technically.
Euler Finance, an Ethereum lending protocol, lost about $197 million on March 13, 2023, after an attacker exploited flawed collateral accounting to create severely under-collateralized positions and drain reserves. Mango Markets, a Solana-based exchange and lending platform, lost roughly $116 million on October 11, 2022, when an attacker pumped the price of the platform’s own MNGO governance token and then used the artificially inflated token as collateral to borrow far more than it was actually worth. Cream Finance, an Ethereum lending fork, lost around $130 million on October 27, 2021, in a flash-loan-driven price manipulation attack against its collateral accounting.
What connects all three to the More Markets case is the underlying failure mode: an asset the protocol treats as safe or fairly priced turns out to be neither, and the gap between assumed and actual value gets converted into a drain on the lending pool. Euler and Cream were pure code and accounting failures. Mango was closer to what happened at More Markets, in that an attacker manufactured favorable pricing conditions around a specific token and then borrowed against it. E-Mode adds a new twist by baking the “these assets are correlated, trust them” assumption directly into the protocol’s rules rather than leaving it to an oracle, which narrows one kind of risk while opening another.
2026’s DeFi exploit tally is already brutal
The More Markets exploit didn’t happen in a vacuum. Security firm CertiK’s mid-year Hack3D report put total crypto losses at roughly $1.32 billion across 344 security incidents in the first six months of 2026 alone. That compares with the record pace of DeFi exploits tracked earlier in 2026 and a full-year 2025 total that industry trackers put in the $3.4 billion to $4 billion range, depending on whether the methodology includes scams alongside direct protocol exploits. If the second half of 2026 tracks anywhere close to the first, this year is on pace to land in the same range as 2025, or worse.
CertiK’s framing of the first-half data is notable: fewer individual incidents than in prior years, but a higher average loss per incident, suggesting attackers are increasingly targeting larger, more complex protocols rather than picking off small, unaudited contracts. That tracks with what happened across the last week of August, when three separate lending and DeFi incidents (More Markets, Tectonic, and Moonwell) collectively accounted for tens of millions of dollars in losses within a matter of days.
| Incident | Date | Chain | Estimated loss | Attack type |
|---|---|---|---|---|
| More Markets | Aug 31, 2026 | Flow EVM | ~$410K (initially misreported as ~$9.3M) | Liquid staking token + E-Mode overborrowing |
| Tectonic (Cronos) | Aug 30, 2026 | Cronos | ~$75M | Illiquid token price manipulation |
| Moonwell | Aug 27, 2026 | Base | ~$8.7M | Price oracle exploit |
| Mango Markets (historical) | Oct 11, 2022 | Solana | ~$116M | Governance token price manipulation |
| Euler Finance (historical) | Mar 13, 2023 | Ethereum | ~$197M | Collateral accounting exploit |
Market and industry impact
The immediate market reaction to the More Markets exploit has been muted compared to the Cronos halt, which forced a network-wide pause and drew much wider attention because it affected a chain tied to Crypto.com’s broader ecosystem. More Markets is a smaller, newer application, and its exploit didn’t require halting Flow itself. That containment is itself a data point: unlike a base-layer compromise, an application-layer lending exploit can be isolated without freezing an entire chain’s transaction activity, which limits collateral damage to users of that specific protocol.
The month also saw a governance exploit drain $8.5 million from Term Finance and an exchange-side breach at Coinsbuy, which lost $8 million, underscoring how broad August’s losses were across both DeFi and centralized platforms. Still, the reputational cost for newer chains trying to build out DeFi ecosystems is real. Flow has spent the past few years positioning itself as a developer-friendly, EVM-compatible chain attractive to teams porting Ethereum-native protocols. An exploit within days of a much larger incident on another EVM-compatible chain reinforces a narrative security researchers have been pushing for over a year: forking a well-audited protocol like Aave doesn’t automatically inherit its safety record, because the risk parameters, oracle choices, and asset listings are decisions each deploying team has to get right independently.
For liquid staking providers like Ankr, incidents like this create a different kind of pressure. Ankr’s core staking operations kept running, though the Flow Foundation has pointed to Ankr’s ankrFLOW contract as the origin of the flaw, an attribution Ankr has not publicly confirmed and independent analysts have not verified. Either way, every time a liquid staking token gets implicated in an exploit, even indirectly through how a third-party lending protocol handled it, it adds friction to the broader case that liquid staking derivatives are safe collateral. That matters because liquid staking tokens have become one of the fastest-growing collateral categories across DeFi lending markets over the past two years.
Competitive landscape: how lending protocols are responding
Aave itself, whose V3 architecture underpins More Markets, has not been directly implicated. Aave’s own deployments on Ethereum and other established chains were not affected. Where exactly the vulnerability sat in the More Markets stack — its fork configuration, the way it priced and accepted ankrFLOW, or Ankr’s token contract itself — remains contested pending a full post-mortem. That distinction matters for how the market should read this incident: it’s less an indictment of Aave’s code than of the growing ecosystem of protocols that copy Aave’s architecture onto newer chains without matching its years of parameter tuning and stress testing.
That gap between established, heavily audited money markets and their younger forks is becoming one of the clearer fault lines in DeFi security. Large, established protocols with years of live risk-parameter tuning and multiple audit cycles behind them have generally proven more resilient to this specific class of correlated-collateral exploit than newer forks launched on emerging chains, where teams are moving fast to capture early liquidity and may not have stress-tested every asset pairing under adversarial conditions. Newer chains chasing developer activity by welcoming Aave forks, Compound forks, and similar money-market clones face a tradeoff: faster ecosystem growth against a thinner layer of battle-tested risk management underneath it.
What More Markets and Flow need to do next
More Markets faces a familiar post-exploit checklist. First, it needs to determine whether the drained reserve created permanent bad debt or whether some portion of the funds can be recovered or frozen before being converted to other assets. Second, it needs to audit whether the same E-Mode and collateral assumptions that failed for the ankrFLOW-WFLOW pair are applied elsewhere in the protocol, since a configuration error in one market often means the same mistake was copied into others. Third, and most consequential for user trust, it needs to decide whether to cover losses from a treasury or insurance fund, or leave affected depositors exposed to whatever bad debt remains once liquidations settle.
An on-chain analyst tracking the incident has floated an alternative theory suggesting the exploit could involve a more complex cross-protocol liquidity extraction than a straightforward ankrFLOW-plus-E-Mode mechanism. If that holds up under further investigation, it would suggest the attack surface is broader than a single misconfigured parameter, and other protocols using similar liquid staking integrations on Flow EVM may need to review their own settings before the same technique gets reused elsewhere.
Predictions: where this trend goes next
Based on the pattern visible across 2026’s exploit data and the historical precedents above, a few things look likely over the next several months.
- Expect more exploits targeting E-Mode-style high-leverage categories specifically, since attackers have now seen this attack vector work and will look for other protocols with similarly loose correlated-asset assumptions.
- Newer EVM-compatible chains courting DeFi liquidity (Flow, Base, and similar ecosystems) will likely face increased scrutiny of Aave and Compound forks deployed on them, with security firms and community researchers pre-emptively auditing risk parameters rather than waiting for exploits.
- Liquid staking tokens will keep growing as a collateral category despite incidents like this, but protocols will likely move toward more conservative E-Mode groupings and additional oracle safeguards specifically for LST-underlying pairs.
- Total 2026 DeFi losses will likely land close to or above 2025’s $3.4 billion to $4 billion range if the pace of incidents seen in the second half of August continues, given CertiK’s mid-year figure of $1.32 billion already booked by June.
- Expect increased adoption of automated on-chain monitoring services like Blockaid across smaller and newer protocols, since rapid detection (as happened here) is increasingly the difference between an exploit that gets contained in hours versus one that drains a reserve completely before anyone notices.
How this fits the bigger DeFi security picture
Zoom out and the More Markets exploit is a small chapter in a much longer story about DeFi lending’s unresolved relationship with correlated collateral. The technology for managing this risk exists: conservative loan-to-value ratios, tighter E-Mode groupings, multiple independent price feeds, and circuit breakers that pause borrowing when price deviations exceed a threshold. What keeps failing is the discipline to apply those tools consistently, especially on newer chains where teams are incentivized to move fast and capture liquidity before a competing fork does.
The Aave documentation itself is explicit that E-Mode is meant for assets with a proven, stable price correlation, not a blanket setting to apply to any liquid staking derivative that shows up on a new chain. More Markets’ own risk parameters weren’t reckless on paper — an 81.5% loan-to-value ratio on WFLOW is within normal industry range — but the combination with E-Mode and a thinner-liquidity environment on Flow created exactly the conditions this attack exploited.
For everyday DeFi and cryptocurrency users, the practical takeaway is unglamorous but important: a protocol forking audited code isn’t the same thing as a protocol inheriting that code’s safety record. Collateral parameters, E-Mode groupings, and oracle choices are decisions each new deployment makes on its own, and those decisions are exactly where 2026’s biggest lending exploits keep originating.
Why Flow EVM matters to this story
Flow launched as a chain built for consumer apps and NFT-heavy projects, created by Dapper Labs (the studio behind CryptoKitties and NBA Top Shot) and now stewarded by the independent Flow Foundation. Its EVM-compatible layer, which lets Ethereum developers deploy existing Solidity contracts with minimal changes, is a more recent addition aimed at pulling DeFi liquidity and developer talent away from congested chains. That strategy has worked well enough to attract lending protocols like More Markets, but it also means Flow’s DeFi ecosystem is younger and thinner than chains that have had years to battle-test their money markets against real attackers.
A thinner ecosystem cuts both ways for security. Fewer protocols means fewer places for an exploit to hide, which is part of why Blockaid caught the More Markets attack quickly. But it also means fewer independent eyes have reviewed each protocol’s specific parameter choices before an attacker finds them first. Chains competing for the same pool of DeFi developers face pressure to onboard lending markets fast, and that pressure doesn’t always leave room for the kind of extended, adversarial testing that catches an E-Mode misconfiguration before it costs users money.
Frequently asked questions
What is the More Markets exploit and how much was lost?
More Markets, a lending protocol on Flow EVM, was drained of about 15.5 million WFLOW on August 31, 2026 after an attacker used Ankr’s liquid staking token ankrFLOW combined with a high-leverage feature called E-Mode. An initial automated estimate from security firm Blockaid valued the loss at roughly $9.3 million, but Blockaid later corrected that figure and independent on-chain data puts the drained amount at about $410,000 (roughly $250,000 realized by the attacker after slippage). More Markets had not confirmed a final figure as of publication.
Was the Flow blockchain itself hacked?
No. Flow’s base-layer consensus mechanism and EVM infrastructure were unaffected, and the network kept running normally. The attack played out at the application layer, though where the underlying flaw sat — More Markets’ configuration, Ankr’s ankrFLOW smart contract, or the interaction between them — is still contested.
What is E-Mode and why did it matter here?
E-Mode, or Efficiency Mode, is an Aave V3 feature that allows higher borrowing limits for asset pairs a protocol treats as closely correlated, such as a liquid staking token and its underlying asset. It boosts capital efficiency but increases exposure if the correlation assumption is wrong or gets manipulated, which is what appears to have happened between ankrFLOW and WFLOW on More Markets.
Is this related to the Cronos and Tectonic exploit from the same week?
They are separate, unrelated incidents that happened to land within a day of each other. Tectonic on Cronos lost an estimated $75 million to a price manipulation attack that forced Cronos to halt block production entirely. More Markets on Flow EVM lost far less, about $410,000 (initially misreported as $9.3 million), to a different mechanism involving E-Mode and liquid staking collateral, and did not require halting the underlying chain.
How does this compare to past DeFi lending exploits?
It follows a well-established pattern seen in incidents like Mango Markets ($116 million, October 2022), Cream Finance ($130 million, October 2021), and Euler Finance ($197 million, March 2023), all of which involved manipulated or overvalued collateral being used to borrow far more than a position was actually worth. More Markets is smaller in dollar terms but relies on the same underlying weakness: collateral the protocol trusts more than it should.
Will More Markets users get their funds back?
That remains unconfirmed. More Markets said it is investigating and will publish findings once the review is complete, but has not stated whether losses will be covered by a treasury fund, whether any exploited assets can be recovered, or whether some users will be left with unrecoverable bad debt.
How much has DeFi lost to exploits in 2026 overall?
CertiK’s mid-year Hack3D report put total losses at approximately $1.32 billion across 344 security incidents in the first half of 2026. August 2026 alone saw roughly $139.7 million in losses according to DeFiLlama data, the third-highest monthly total of the year, driven largely by the Tectonic, Moonwell, and More Markets incidents.
What should DeFi users do to protect themselves from similar exploits?
Check whether a lending protocol’s collateral parameters and E-Mode groupings have been independently audited beyond a generic security review, favor protocols with a longer track record of live risk-parameter tuning, and be cautious with newer forks on emerging chains that haven’t yet been stress-tested by real attackers the way established protocols like Aave have.
A note on sourcing and this correction
The corrected loss figure in this article rests on several independent sources. On-chain accounting from DeFiLlama valued the drained mFlowWFLOW reserve at about $420,000 on August 31, 2026. Spot pricing for FLOW of roughly $0.026 at the time (CoinGecko and CoinMarketCap) values the ~15.5 million WFLOW that was removed at about $410,000, not $9.3 million. Blockaid, whose initial automated alert produced the $9.3 million estimate, issued a follow-up correction to roughly $410,000 with about $250,000 realized after slippage, and the Flow Foundation put the same figures in a public statement. The original $9.3 million estimate implied a WFLOW price more than 20 times its actual market rate and exceeded More Markets’ entire total value locked (about $3.9 million), which is what prompted this review. The exploit mechanism and risk parameters were verified against More Markets’ published contracts and on-chain configuration. Root-cause attribution remains contested and is presented as such.
