More Markets on Flow EVM Becomes Third DeFi Lending Exploit in Five Days

MakeCryippreferred on

More Markets, a lending protocol built on Flow EVM, lost about $9.3 million on Sunday after an attacker used a liquid-staking token from Ankr to drain its WFLOW reserve. Blockaid, the security firm that flagged the attack, said 15.5 million WFLOW were emptied from the protocol’s mFlowWFLOW market using a combination of the bonded Ankr token and More Markets’ E Mode setting, a feature that lets certain paired assets borrow against each other at a higher loan-to-value ratio.

The More Markets incident is not an isolated one. It is the third time in five days that a decentralized lending protocol has lost funds because of how it priced a collateral asset. Moonwell, on Coinbase’s Base network, lost $8.7 million on August 27 after an attacker inflated the price of MAMO, a thinly traded token, and borrowed real bitcoin and stablecoins against it. Three days later, an attacker pushed the price of TONIC, the governance token of Cronos lending protocol Tectonic, roughly 100 times higher in about 20 minutes, draining an estimated $66 million to $75 million and forcing Cronos validators to halt the entire chain. The three attacks hit three unrelated chains with three different attacker wallets and no shared exploit code, but each one turned the same weakness, how a lending market prices a correlated or thinly traded collateral token, against a different protocol.

More Markets runs on Aave V3 architecture and lists WFLOW with an 81.5% loan-to-value ratio and an 83% liquidation threshold, while ankrFLOW, the liquid-staking token Ankr issues for staked FLOW, carries a 78.5% loan-to-value ratio. E Mode exists to let assets like these, a token and its staked derivative, borrow against each other more efficiently than unrelated assets would. That efficiency is also what made the exploit possible: because the protocol treated the bonded Ankr position as high-quality collateral, the attacker could borrow close to the reserve’s full value once that collateral’s pricing was manipulated. Blockaid has not said Ankr’s own contracts were compromised, and it has not indicated that Flow EVM itself was affected, only that the attacker used a legitimate asset type against the protocol’s own risk settings.

Flow has been through this before. A December 27 attack exploited a flaw in the network’s separate Cadence execution layer, allowing an attacker to duplicate tokens and extract close to $3.9 million before validators froze the chain, according to the Flow Foundation’s own technical post-mortem. That incident forced Flow to abandon an initial rollback plan after bridge operators objected, and it later drew South Korean exchanges toward delisting FLOW entirely. The More Markets exploit sits on a different layer of the network and involves a different vulnerability, but it lands on a chain whose security track record is already under scrutiny.

More Markets had not published a statement or paused borrowing as of Monday afternoon. Data from DefiLlama shows the protocol’s Flow deployment holding about $27.9 million in deposits and $19.6 million in active loans, meaning most of the platform’s capital was not directly involved in the drained reserve. Blockaid said it is still tracing the post-exploit transaction cluster to determine where the funds ultimately moved.