Attackers drain 15.5M WFLOW from More Markets in suspected $9.3M Flow exploit

The Flow EVM lending protocol built by More Labs did not immediately confirm the loss in its response to the reports, writing that it is “currently investigating a claim that MORE Markets was exploited”  

How did attackers drain More Markets? 

More Markets has not yet confirmed the incident or loss, and a full post-mortem is not available as of this report. Blockaid also stopped short of fingering Ankr or the Flow blockchain as compromised. 

However, the security firm estimated that the attack could have come from one of two key components: 

• An Ankr-bonded liquid staking token
• More Markets’ E-Mode setting, a mode that lets borrowers take on higher leverage against correlated assets. 

An alternative theory being popularized by Sprunky, an on-chain analyst, is that this is a cross-protocol liquidity extraction that runs deeper than a simple “Ankr LST plus E-mode” bug.  

Exploits are finding big and small targets

By size, More Markets is not a big target and this incident is not expected to have a seismic effect throughout DeFi. DeFiLlama data puts the protocol’s combined total value locked at $5.6 million, with about $3.41 million in active loans.

However, the episode lands a fresh hit during a rough stretch for DeFi. Cryptopolitan reported that Moonwell lost as much as $9 million in late August to a MAMO price-manipulation attack on its Base market, its third security incident in nine months. 

Days later, Solana neobank Avici was drained of about $500,000 and pledged full refunds, while Ethereum lending protocol Ajna lost roughly $775,000 to liquidation accounting manipulation.