Case summary
What happened
Blockaid reported that an attacker used an Ankr bonded liquid-staking token together with MORE Markets' E-Mode configuration to remove approximately 15.5 million WFLOW from the mFlowWFLOW lending reserve. MORE Markets publicly said it was investigating a claim that it had been exploited and would publish findings. CYA records the incident without treating the initial USD estimate, technical mechanism, bad debt, user loss or recovery as final until the protocol or a technical post-mortem confirms them.
Customer result
Customer outcome
Unknown
No final user-loss allocation, bad-debt amount, recovery amount, repayment process or compensation plan was established in the reviewed same-day evidence. The incident remains under investigation.
- Estimated recovery
- Unknown
- Repayment started
- —
- Repayment completed
- —
- Confidence
- Medium
Asset treatment
Terms risk
Unclear
Protocol design is non-custodial, but exploit-loss allocation, any resulting bad debt and any recovery or compensation mechanism remain unresolved as of 2026-08-31.
- Affected product
- mFlowWFLOW lending market
- Confidence
- Medium
MORE Markets is non-custodial and smart-contract based, but the reviewed incident evidence does not by itself establish a complete legal characterization of lender claims or loss allocation after the exploit.
Known unknowns
Uncertainty
MORE Markets had not confirmed a final loss amount, final root cause, bad-debt amount, lender loss allocation, recovered-fund amount or compensation plan in the reviewed same-day material. The reported approximately USD 9.3 million figure is Blockaid's initial detector-impact estimate, not a final audited loss.
Chronology
Historical record
MORE Markets investigates Flow EVM lending-reserve exploit
Blockaid reported that approximately 15.5 million WFLOW left MORE Markets' mFlowWFLOW lending reserve on Flow EVM in an exploit involving an Ankr bonded liquid-staking token and the protocol's E-Mode configuration. Blockaid estimated approximately USD 9.3 million of detector impact. MORE Markets said it was investigating the exploit claim and would publish findings.
The USD value is Blockaid's preliminary detector-impact estimate and must not be presented as a final confirmed protocol or user loss. Root cause, bad debt, recovery and user compensation remained unresolved in the reviewed same-day evidence.
Source record
Evidence dossier
Filter by claim, reliability, source type, and whether evidence is linked to a specific event.
Entity
1 sourcesMORE Markets documentation
MORE Markets
First-party documentation supporting platform identity and lending-market context. It is not used as evidence for the final exploit amount or root cause.
Event
3 sourcesBlockaid Traces $9.3 Million Exploit at Flow Lender More Markets
BeInCrypto · 2026-08-31
Contemporaneous report reproducing Blockaid's 15.5 million WFLOW / approximately USD 9.3 million detector-impact disclosure and MORE Markets' statement that it was investigating the exploit claim.
More Markets Hacked for $9.3M on Flow EVM, 15.5M WFLOW Drained
The Crypto Times · 2026-08-31
Independent contemporaneous coverage of the Blockaid finding, affected mFlowWFLOW reserve and unresolved final loss/root-cause state.
Attackers drain 15.5M WFLOW from More Markets in suspected $9.3M Flow exploit
Cryptopolitan · 2026-08-31
Corroborates that MORE Markets had not confirmed the final loss and that Blockaid described the reported USD amount as detector impact while tracing the incident.
No evidence records match the current filters.
Comparative records