Direct answer: More Markets, a lending protocol deployed on Flow EVM, was reportedly exploited on August 31, 2026. Blockchain security firm Blockaid said an attacker used an Ankr bonded liquid-staking token together with More Markets’ E Mode mechanism to drain about 15.5 million WFLOW from the protocol’s mFlowWFLOW reserve. Crypto.news reported Blockaid’s detected impact at roughly $9.3 million. That dollar figure is preliminary: the final loss, recovered funds and destination of the assets were still under investigation at publication time.

The important market lesson is not simply that one protocol was hacked. It is that composability can turn a narrow collateral or parameter problem into reserve stress. An LST, its ratio or pricing assumptions, and a lending market’s correlated-asset mode can interact in ways that are difficult to judge from the headline token price alone.

Key takeaways

• The reported target was More Markets on Flow EVM, not evidence that the Flow blockchain itself was compromised.
• Blockaid attributed the attack sequence to an Ankr bonded liquid-staking token and More Markets’ E Mode mechanism.
• About 15.5 million WFLOW was reported drained from the mFlowWFLOW lending reserve; Blockaid’s estimated impact was approximately $9.3 million.
• The incident’s technical sequence, final accounting and ultimate asset destination remained unresolved in the initial disclosure.
• Ankr’s and Flow’s involvement should not be overstated: the available reporting did not say Ankr or Flow was itself compromised.
• Traders should monitor reserve depth, WFLOW and ankrFLOW liquidity, withdrawals, parameter changes, cross-venue spreads and any evidence of bad debt.

Visual credit: Original LiveVolatile editorial SVG created from Blockaid’s August 31, 2026 disclosure as reported by Crypto.news. The first four boxes summarize reported facts; the monitoring boxes are editorial analysis. It is not a forensic reconstruction or price forecast.

Reported path and analysis boundary

flowchart LR
  A[Ankr bonded LST] --> B[More Markets E Mode]
  B --> C[Reported WFLOW reserve drain]
  C --> D[Reserve and withdrawal stress]
  D --> E[Monitor depth spreads and bad debt]
  F[Flow EVM application] -. not established .-> G[Flow base-layer compromise]

Diagram note: The solid path reflects the initial Blockaid/Crypto.news account. The dashed relationship marks a boundary: the available evidence did not establish a Flow base-layer compromise.

What happened at More Markets?

Blockaid said on August 31 that it detected an exploit on More Markets, developed by More Labs and deployed on Flow EVM. Its initial disclosure identified an Ankr bonded liquid-staking token, More Markets’ E Mode and the mFlowWFLOW lending reserve as parts of the incident. The security firm also published an exploit transaction, a contract-deployment transaction and a cluster of post-exploit transfers.

The reported outflow was approximately 15.5 million WFLOW. Blockaid described the detected impact as about $9.3 million, but that should be read as an initial estimate rather than a settled protocol balance-sheet figure. Investigators still needed to trace the transaction cluster, distinguish gross movements from realized loss, identify any recovered or frozen assets and determine whether other positions were affected.

Crypto.news described More Markets as a noncustodial lending protocol based on Aave V3 architecture. Its listed markets included WFLOW and ankrFLOW. The report said More Markets listed WFLOW with an 81.5% loan-to-value ratio and an 83% liquidation threshold, while ankrFLOW had a 78.5% loan-to-value ratio and an 81% liquidation threshold. These displayed parameters are useful context, but they do not by themselves establish the exploit’s root cause.

The initial public evidence did not establish that:

• Ankr’s underlying staking system was breached;
• the Flow base network or consensus was compromised;
• every WFLOW or ankrFLOW holder suffered a loss;
• the reported $9.3 million estimate was final; or
• the precise fault was exclusively in the token, oracle, E Mode configuration or lending implementation.

Keeping those distinctions visible is essential in a fast-moving incident. A protocol exploit can create real liquidity risk without justifying a claim that the whole chain or an external asset issuer failed.

Why the LST and E Mode combination matters

A liquid-staking token represents a claim connected to staked underlying assets. Its exchange relationship may change as rewards accrue, and its usable liquidity depends on the number of buyers, pools, bridges and redemption paths available at the moment a position needs to exit.

A lending protocol adds another layer. It converts an asset’s assessed value into borrowing capacity. E Mode, in Aave-style lending systems, is designed to improve capital efficiency for assets treated as closely correlated. That efficiency can be useful in normal conditions, but it also makes the assumptions behind correlation, pricing, liquidation and isolation more consequential.

The available disclosure did not publish a complete technical reconstruction. The safest description is therefore conditional:

1. A bonded LST was part of the reported attack path.
2. More Markets’ E Mode was also identified as a component.
3. The attacker drained WFLOW from the mFlowWFLOW reserve.
4. The interaction converted a protocol-specific configuration or valuation weakness into an outflow of a more liquid reserve asset.

That is a risk-transmission model, not a claim about an unverified exploit opcode or oracle call. The completed investigation should clarify whether the decisive weakness involved the LST’s ratio, a price feed, collateral validation, E Mode asset grouping, liquidation assumptions, contract implementation or a combination of these factors.

Reported facts versus unresolved questions

The volatility transmission chain

The market impact of a DeFi exploit is often nonlinear. A reserve outflow can matter even when the affected collateral token is small because users, market makers and connected applications reprice the reliability of exits.

1. Collateral assumptions become a market event

If an LST is accepted as collateral, the protocol relies on more than its nominal relationship with FLOW. It relies on an executable market, a defensible ratio or price feed, sufficient liquidation depth and parameters that remain safe during stress. If any link fails, the borrowing capacity shown on-chain can exceed the amount the market can actually absorb.

2. E Mode can amplify correlated-asset exposure

Capital-efficiency settings reduce friction when assets behave as expected. They can also concentrate risk if the system treats assets as interchangeable during a dislocation that is not interchangeable in practice. An LST may trade with a discount, face a delayed redemption route or become thinly liquid while the lending market continues using ordinary assumptions.

3. Liquid reserve assets absorb the loss

The reported drain came from the WFLOW reserve. That is the critical conversion: a problem involving a bonded LST and lending logic can become a shortage of an asset that suppliers expected to withdraw or borrowers expected to use. Reserve scarcity can widen spreads and increase liquidation slippage even for users who never supplied the LST.

4. Cross-venue pricing can fragment

If withdrawals pause, bridges slow or liquidity providers retreat, WFLOW can show different prices and depths across Flow EVM venues and external markets. A displayed price is not the same as a price at which a large holder can exit. Watch executable depth, not just the last trade.

5. Governance and recovery become volatility catalysts

A pause, parameter change, reimbursement plan, rescue proposal or contract migration can each move market expectations. A change that limits new borrowing may reduce immediate exploit risk while making existing positions harder to manage. Conversely, reopening markets without a clear technical explanation can create a second confidence shock.

What traders and liquidity providers should monitor

Use LiveVolatile’s markets monitor, liquidations dashboard and volatility tools for broader market context. For this incident, the most useful checkpoints are protocol- and chain-specific.

Reserve and withdrawal health

Track the WFLOW reserve, supplier withdrawals, borrow balances, utilization and any announced pause. A reserve that is technically solvent but difficult to withdraw from can still produce short-term volatility. Look for an official accounting rather than relying on a single dashboard snapshot.

WFLOW and ankrFLOW market depth

Monitor pool liquidity, bid-ask spreads, slippage and the number of routes supporting each asset. A falling price is important, but a widening spread or disappearing depth can be an earlier warning that liquidation and recovery assumptions are deteriorating.

Oracle, ratio and parameter changes

The follow-up should identify the relevant price source, Ankr ratio feed, update cadence, deviation protections, collateral factors and E Mode grouping. Parameter changes are signals, not explanations. The strongest remediation evidence will connect each change to a documented failure mode and a testable control.

Flow application versus network signals

Do not treat an application exploit as a Flow-wide failure without evidence. A broader network event would require separate indicators such as validator disruption, chain halt, consensus fault, bridge restrictions or coordinated exchange action. Until then, keep the scope at More Markets and its connected assets.

Recovery and asset destination

Blockaid’s initial disclosure included post-exploit transfer activity, but the final destination and net recoverable amount were unresolved. Track tagged addresses, freezes, returned funds, protocol reserves and any formal recovery plan. Do not convert an address label or a large transfer into a confirmed realized loss without corroboration.

FAQ

Was Flow EVM hacked?

The initial reporting identified an exploit of More Markets, an application running on Flow EVM. It did not establish a compromise of Flow’s base network. Further technical disclosures could refine the scope, but the current evidence supports an application-level description.

How much was stolen?

Blockaid reported that approximately 15.5 million WFLOW was drained from the mFlowWFLOW reserve and estimated the impact at about $9.3 million. The final net loss remained under investigation, so neither number should be presented as a final audited result.

Was Ankr compromised?

The initial disclosure said an Ankr bonded liquid-staking token was used in the attack path. It did not say that Ankr’s staking contracts or infrastructure were compromised. The role of the token and its pricing or ratio assumptions requires further technical evidence.

Does this mean WFLOW is going to collapse?

No. The incident creates a risk to liquidity, confidence and connected positions, but it does not provide a reliable price forecast. Traders need current venue depth, withdrawal status, spreads, funding and official recovery information before making any decision.

What makes this different from a simple token exploit?

The reported path involved a collateral asset, lending-market logic and a reserve of WFLOW. That composability means the damage can spread through borrowing capacity and withdrawals even when users do not hold the original LST.

Conclusion

The More Markets incident is a timely example of how DeFi risk can travel through assumptions about correlation. An Ankr bonded LST and an E Mode configuration were named in the initial attack disclosure; the reported result was an outflow of about 15.5 million WFLOW from the mFlowWFLOW reserve, with an estimated impact near $9.3 million.

The responsible conclusion is narrower than a chain-wide alarm. More Markets was the reported target, the technical root cause was still being investigated, and the final accounting was unresolved. For volatility analysis, the next evidence to watch is reserve health, executable WFLOW and ankrFLOW liquidity, oracle and parameter remediation, withdrawal behavior and any verified recovery.

Risk disclaimer: This article is for informational and educational purposes only. Crypto assets, DeFi positions and related tokens are highly volatile and may lose some or all of their value. Nothing here is financial, legal or investment advice.

Sources

• Blockaid disclosure on X — August 31, 2026; initial detection and transaction references. The post was the primary incident disclosure cited by the secondary report.
• Crypto.news: More Markets suffers $9.3m WFLOW exploit on Flow EVM — August 31, 2026; reports the Blockaid assessment, affected reserve, named attack components and unresolved final accounting.
• Flow Developer Portal: How Flow EVM Works — official technical reference for the EVM execution environment and its relationship to Flow.
• Flow Developer Portal: DeFi Contracts on Flow Mainnet — official contract directory listing WFLOW and ankrFLOW on Flow EVM; used for asset and deployment context.

Image credit: Original LiveVolatile SVG at /images/articles/2026-08-31-more-markets-ankrflow-emode-risk-map.svg, created from the cited incident disclosure and reporting. No third-party image is reproduced.

— LiveVolatile Research Desk