More Markets Protocol Suffers $9.3 Million Exploit on Flow EVM

Blockchain security firm Blockaid reports that DeFi protocol More Markets lost roughly $9.3 million from a lending reserve, after an attacker exploited the protocol's use of a liquid staking token alongside an Aave V3–style efficiency-mode (E-mode) feature. For anyone deploying idle capital into smaller-chain venues, the episode is a clean reminder that the same plumbing that boosts capital efficiency can quietly enlarge the blast radius when something goes wrong.

How the reserve was drained

According to Blockaid, about 15.5 million Wrapped Flow (WFLOW) tokens were pulled from the mFlowWFLOW reserve — the figure the security firm used to estimate the $9.3 million loss. The attacker is said to have combined Ankr Staked FLOW (ankrFLOW), a liquid staking derivative, with E-mode. E-mode is the borrowing feature popularized by Aave V3, designed to let a user post a collateral asset and borrow a tightly correlated one at a higher loan-to-value ratio than the base parameters allow. In More Markets' case, pairing a staked-FLOW receipt with the underlying collateral appears to have given the attacker enough headroom to drain the reserve. More Markets itself had not publicly confirmed the incident or commented on user losses at the time of the initial report, so I'm holding anything more specific about depositors until the team speaks.

The August backdrop, and what to actually check

The More Markets episode lands inside a rough month for on-chain lending. DefiLlama data cited in coverage puts August crypto hack losses at roughly $139.7 million — the third-highest monthly total of 2026, though still below the $254 million recorded in July. The weekend before Blockaid's writeup, the Cronos network was paused after an exploit on the Tectonic lending protocol, with damages initially estimated near $75 million. Two lending drains in a single week isn't noise; it's a pattern worth respecting.

For you as a passive-income operator, the practical question isn't whether E-mode is "good" or "bad" — it's how protocols that copy the Aave V3 design are configuring their correlated-asset baskets. That same design also powers a lot of legitimate upside: stablecoin liquidity on Aave V3 has been climbing alongside renewed DeFi borrowing demand, as laid out in Tether liquidity surging on Aave V3. The trade-off is familiar. Correlated collateral gives you tighter capital efficiency, but it concentrates risk inside a single price relationship.

Before sitting in any of these reserves, I'd want to know the answer to four things, in order: who secures the oracle for the liquid staking token and its underlying asset, and whether those feeds are shared or independent; which LSTs are actually whitelisted inside E-mode, and at what LTV; whether the audit history is recent and specific to that feature, not a generic fork audit; and whether the team has published a post-mortem rather than silence. If you can't answer those quickly, the capital probably belongs somewhere you can answer them in your sleep. The yield on a long-tail lending reserve is, almost always, compensation for risk the APY screen isn't showing up.