More Markets, a decentralized finance vault infrastructure protocol on Flow EVM, had a lending reserve drained of approximately $9.3 million in Wrapped Flow tokens, according to Web3 security platform Blockaid. The attacker extracted about 15.5 million WFLOW from the mFlowWFLOW reserve using Ankr Staked FLOW, a liquid staking token, in combination with E-mode to overborrow against the collateral. E-mode is an Aave V3 feature that increases borrowing power for assets expected to move in tandem, such as a liquid staking token and its underlying asset.
This exploit pushes total August losses to $139.7 million, making it the third-largest month by value stolen in 2026, per DefiLlama data. However, the figure remains significantly below July's $254 million. A separate $75 million exploit reportedly hit Cronos-based lending protocol Tectonic over the weekend, prompting a network halt. The clustering of lending protocol exploits within days suggests heightened scrutiny of DeFi borrowing mechanisms, particularly those using liquid staking tokens as collateral.
For traders, this is a Flow ecosystem issue. Liquid staking tokens remain a persistent attack surface when protocols miscalibrate borrowing limits or fail to cap exposure to less liquid wrapped assets. More Markets had not publicly confirmed the incident or disclosed whether users suffered losses at publication. The protocol did not disclose its total value locked in available reports.
Watch for any confirmation that other Flow-based lending protocols share similar E-mode configurations or excessive exposure to ankrFLOW. If additional Flow protocols halt withdrawals or report unusual borrowing activity, local risk may escalate. As long as the exploit remains confined to More Markets with no follow-on failures, the event appears contained.
Source: CoinTelegraph