DeFi lending exploit drains $9.3M from More Markets, leaves reserves razor-thin

A DeFi lending exploit drained roughly $9.3 million from More Markets on August 31, after attackers found a way to overborrow against the protocol’s Flow EVM lending reserve. Blockaid, the blockchain security firm that flagged the incident, said the attacker combined a liquid staking token from Ankr with a capital-efficiency feature built into Aave V3’s architecture, exploiting a gap the protocol’s safeguards were never designed to catch.

Key takeaways

• More Markets lost approximately $9.3 million after attackers drained 15.5 million WFLOW tokens from its mFlowWFLOW lending reserve on Flow EVM.
• The attacker combined Ankr’s liquid staking token, ankrFLOW, with Aave V3’s efficiency mode (E-mode) to unlock borrowing capacity beyond what the collateral could support.
• After the exploit, More Markets’ total value locked fell to roughly $3.64 million against active loans of about $3.67 million, leaving almost no buffer between assets and liabilities.
• More Markets had not issued any public statement, pause, or user guidance at the time Blockaid reported the incident.
• DeFi-wide exploit losses hit $139.7 million in August 2026, the third-largest monthly total of the year, though better than July’s $254 million, according to DefiLlama.

More Markets suffers $9.3 million lending reserve exploit

The short version: an attacker manipulated a liquid staking asset inside a high-leverage lending mode and walked away with millions in WFLOW before anyone could react. Blockaid disclosed the incident in an X post on August 31, identifying More Markets — a lending protocol built by More Labs on the Flow EVM blockchain — as the target and estimating the detected impact at around $9.3 million.

Attack details and token drain

According to Blockaid, the attacker emptied 15.5 million WFLOW tokens from the protocol’s mFlowWFLOW lending reserve. The security firm published the exploit transaction, the contract deployment used in the attack, and a cluster of post-exploit transfers that moved the drained funds onward. Blockaid described the $9.3 million figure as its detected impact rather than a final tally, meaning the ultimate loss could shift as investigators trace where the assets landed.

More Markets is a noncustodial lending protocol built on Aave V3 architecture, supporting nine markets where users can supply assets, borrow against collateral, and face liquidation if their positions fall below required thresholds. WFLOW carries a loan-to-value ratio of 81.5% on the platform, while ankrFLOW sits at 78.5%, according to the protocol’s own documentation.

Mechanics of the exploit using ankrFLOW and Aave V3’s efficiency mode

This is where the attack gets technical, and it’s the part worth understanding if you use similar protocols. Aave V3’s efficiency mode, or E-mode, is designed to let borrowers extract more capital when the assets they’re using move in tight correlation with each other. The logic is straightforward: correlated assets carry less liquidation risk, so the protocol allows higher loan-to-value ratios between them.

The attacker used ankrFLOW — Ankr’s bonded liquid staking token representing staked FLOW — as collateral inside that E-mode configuration. Because ankrFLOW’s value is meant to track FLOW closely as staking rewards accumulate, the setup unlocked borrowing capacity that outstripped what the underlying collateral could actually back. In effect, a feature built to reward efficient capital use became the exact lever used to overborrow.

Blockaid’s initial disclosure has not clarified whether the underlying flaw sat in More Markets’ own implementation, in how the Ankr asset was priced within the lending market, or in the interaction between the two. The firm has also not indicated that Ankr’s staking infrastructure or the Flow blockchain itself was compromised — the incident, so far, appears isolated to the application layer running on Flow EVM.

Impact on More Markets’ protocol and operations

The numbers after the exploit tell their own story: a protocol running with almost nothing left in reserve. Once the drain was complete, More Markets’ total value locked fell to roughly $3.64 million, while active loans stood at approximately $3.67 million. Those two figures being nearly identical suggests the protocol was left holding almost no cushion between what it owed users and what it actually had on hand.

Post-exploit liquidity status indicating minimal reserves

That razor-thin margin matters beyond More Markets itself. A lending protocol is supposed to maintain a buffer precisely so that a shock — whether a market swing or an exploit — doesn’t leave it insolvent. Here, the gap between assets and liabilities essentially vanished, meaning any further liquidity event could put remaining user funds at risk.

Lack of public response or guidance from More Markets

As of the time Blockaid reported the incident, More Markets had said nothing publicly. No pause was announced on the protocol, no statement addressed the status of user funds, and no recovery plan was shared. For depositors trying to figure out whether their assets are safe, that silence is arguably as significant as the exploit itself — it leaves users without any official channel to track what happens next.

Broader context of DeFi security in August 2026

This exploit didn’t happen in isolation — it landed in a month that was already bruising for decentralized finance. Total exploit losses across DeFi reached $139.7 million in August 2026, according to data from DefiLlama, making it the third-largest month for hack losses so far this year.

Magnitude of DeFi losses in August and comparison with July

Even so, August marked an improvement on the previous month. July’s total hack losses across DeFi hit $254 million, nearly double August’s figure. That comparison offers some perspective: the sector’s losses eased month over month, even as individual incidents like the More Markets breach show that lending protocols relying on liquid staking tokens and leveraged borrowing modes remain a recurring target.

Position of More Markets exploit within sector-wide challenges

Why this matters for the wider market: the mechanism behind this DeFi lending exploit — pairing a yield-bearing liquid staking token with a high-leverage borrowing mode — isn’t unique to More Markets’ codebase. Aave V3’s efficiency mode is widely deployed across DeFi, and any protocol pairing correlated assets under similar configurations carries a comparable exposure if pricing assumptions or collateral handling aren’t airtight. For a sector still working to convince institutional users that its infrastructure is resilient, an unexplained $9.3 million gap — met with silence rather than a statement — does little to build that confidence.

FAQ

How did attackers exploit More Markets’ lending reserve?

Attackers combined Ankr’s liquid staking token ankrFLOW with Aave V3’s efficiency mode to overborrow WFLOW tokens, exploiting the increased borrowing capacity the mode grants against correlated assets.

What was the financial impact of the exploit on More Markets?

The exploit resulted in approximately $9.3 million worth of WFLOW tokens being drained from More Markets’ lending reserve, based on Blockaid’s detected impact estimate.

Did More Markets provide any communication or recovery plan after the exploit?

As of the latest reporting, More Markets had not released any public statement, paused operations, or offered guidance regarding the status of user funds or a recovery plan.

How does this exploit fit into the broader trend of DeFi security issues in 2026?

The More Markets exploit occurred during a difficult August 2026 for DeFi, with total exploit losses reaching $139.7 million — the third-largest monthly total of the year — though that figure still marked an improvement from July’s $254 million in losses.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.