More Markets Reserve Drained as Blockaid Flags $9.3M DeFi Lending Exploit

More Markets’ WFLOW lending reserve was drained on Monday after an attacker exploited the DeFi protocol’s collateral setup on Flow EVM, with security firm Blockaid putting its initial detector impact at roughly $9.3 million.

Blockaid said the attacker used an Ankr bonded liquid staking token together with More Markets’ E-Mode borrowing mechanism. About 15.5 million WFLOW was removed from the mFlowWFLOW reserve, while a cluster of transactions showed assets being moved after the exploit.

The $9.3 million figure remains preliminary. Blockaid described it specifically as its “detector impact,” rather than a finalized accounting of losses, and More Markets had not confirmed the amount at the time of publication.

🚨 Blockaid detected an exploit on More Markets (More Labs) on Flow EVM. Attacker used Ankr bonded LST + E-mode to drain the WFLOW lending reserve. 15.5M WFLOW emptied from mFlowWFLOW (~$9.3M detector impact). Attack tx cluster includes post-exploit exfil.
More details in🧵

— Blockaid (@blockaid_) August 31, 2026

More Markets said it was investigating the reported exploit and would publish its findings. No recovery figure or remediation plan had been announced.

E-Mode interaction under scrutiny

E-Mode, or Efficiency Mode, allows lending protocols to offer higher borrowing limits when supplied and borrowed assets are expected to remain closely correlated. More Markets’ markets framework describes the feature as a way for correlated assets to access higher loan-to-value ratios while other safeguards, including health factors and liquidation thresholds, remain active.

Blockaid’s initial disclosure points to the combination of the Ankr liquid staking asset and E-Mode, but does not yet establish the precise technical failure. It remains unclear whether the exploit stemmed from collateral pricing, risk parameters applied to the asset, the E-Mode configuration itself, or an interaction between those components.

There is also no indication in the initial findings that Ankr’s staking protocol or the Flow blockchain itself was compromised. The affected contracts belonged to the More Markets lending application running on Flow EVM.

Blockaid published transactions tied to the attack and subsequent movement of funds, while More Markets’ investigation is expected to determine the final loss and whether the drained assets can be recovered.