Attackers drain $9.3M in suspected More Markets exploit

The Blockaid security firm has reported an exploit estimated to have drained roughly $9.3 million from More Markets’ WFLOW lending reserve in the early hours of August 31, 2026. 

The Flow EVM lending protocol built by More Labs did not immediately confirm the loss in its response to the reports, writing that it is “currently investigating a claim that MORE Markets was exploited”  

How did attackers drain More Markets? 

More Markets has not yet confirmed the incident or loss, and a full post-mortem is not available as of this report. Blockaid also stopped short of fingering Ankr or the Flow blockchain as compromised. 

However, the security firm estimated that the attack could have come from one of two key components: 

• An Ankr-bonded liquid staking token
• More Markets’ E-Mode setting, a mode that lets borrowers take on higher leverage against correlated assets. 

An alternative theory being popularized by Sprunky, an on-chain analyst, is that this is a cross-protocol liquidity extraction that runs deeper than a simple “Ankr LST plus E-mode” bug.  

Exploits are finding big and small targets

By size, More Markets is not a big target and this incident is not expected to have a seismic effect throughout DeFi. DeFiLlama data puts the protocol’s combined total value locked at $5.6 million, with about $3.41 million in active loans.

However, the episode lands a fresh hit during a rough stretch for DeFi. Cryptopolitan reported that Moonwell lost as much as $9 million in late August to a MAMO price-manipulation attack on its Base market, its third security incident in nine months. 

Days later, Solana neobank Avici was drained of about $500,000 and pledged full refunds, while Ethereum lending protocol Ajna lost roughly $775,000 to liquidation accounting manipulation. 

If you're reading this, you’re already ahead. Stay there with our newsletter.