More Markets Protocol Drained of $9.3 Million in Flow EVM Exploit

The exploit combined Ankr's bonded liquid staking token with the protocol's E-mode mechanism, hitting the mFlowWFLOW reserve that had been configured with an 81.5% LTV and an 83% liquidation threshold. For anyone with open exposure to Flow-based lending markets, this is a reminder that high-LTV corridors and correlated-asset modes compress safety margins faster than utilization data implies.

How the Reserve Was Emptied

The mFlowWFLOW reserve was the single point of extraction. Inside More Markets, WFLOW sits at 81.5% LTV with an 83% liquidation threshold, while ankrFLOW, the reward-bearing liquid staking token Ankr issues when users stake FLOW, carries 78.5% LTV and an 81% liquidation threshold. E-mode, a feature inherited from Aave V3, allows correlated assets to share elevated LTV parameters within a designated category, which widens borrow capacity but narrows the buffer between collateral value and liquidation. Blockaid says the attacker used an Ankr bonded LST alongside that mechanism to drain the reserve, and published the exploit transaction, the contract deployment, and a cluster of post-exploit transfers. Whether the failure originated in More Markets' implementation, in how ankrFLOW was priced inside the lending market, or in the interaction between the two remains undisclosed. The roughly $9.3 million figure is Blockaid's detected impact, not a confirmed final loss.

What LPs and Borrowers Should Check

For anyone supplying WFLOW or ankrFLOW to More Markets, the immediate task is position review: confirm health factor, isolate exposure to the mFlowWFLOW reserve, and check whether open borrows were routed through E-mode. The protocol lists nine supported markets, so exposure to unrelated assets may not be directly affected, but the post-exploit transfer cluster shows the attacker continued moving funds after the initial drain, and the final destination has not been traced. Blockaid had not provided a final accounting of the attacker's holdings at the time of writing, so the realized dollar loss will depend on WFLOW peg stability and the liquidity depth available to exit the position. Ankr states that its Flow liquid staking contracts on both Cadence and EVM were externally audited by Halborn, and Blockaid has not indicated that Ankr itself was compromised.

The Surface That Matters

Until Blockaid publishes a full technical breakdown, the prudent read is that any Aave V3 fork accepting Ankr's bonded FLOW derivatives should be treated as under review, especially where E-mode is enabled and LTV parameters sit above 80%. The scenario split is clean: if the fault was in More Markets' handling of the bonded LST, the blast radius is protocol-specific; if it lived in the LST's accounting layer, every lending market that lists ankrFLOW inherits the same risk surface. Watch for the post-mortem, watch the WFLOW peg, and treat the mFlowWFLOW APR as a lagging signal, not a safety one.