More Markets Suffers $9.3 Million DeFi Exploit on Flow EVM, Highlighting Evolving Security Risks

The decentralized finance (DeFi) ecosystem continues to grapple with persistent security vulnerabilities, as evidenced by a recent exploit targeting More Markets, a protocol focused on providing vault infrastructure. On the Flow EVM blockchain, approximately $9.3 million in digital assets were drained from More Markets’ lending reserve. The breach, first identified by Web3 security platform Blockaid, underscores the sophisticated methods attackers are employing and the inherent risks within complex DeFi protocols.

According to blockchain data shared by Blockaid in a post on the social media platform X, the attacker successfully siphoned off roughly 15.5 million Wrapped Flow (WFLOW) tokens. At the time of the incident, Blockaid valued these tokens at approximately $9.3 million. The targeted reserve was specifically identified as the mFlowWFLOW lending reserve, a component of More Markets’ infrastructure on the Flow network.

Blockaid’s analysis revealed a strategic approach employed by the perpetrator. The attacker leveraged a combination of Ankr Staked FLOW (ankrFLOW), a liquid staking token, and a feature known as "E-mode" to facilitate the overborrowing from the reserve. AnkrFLOW represents staked FLOW tokens, offering holders liquidity while their underlying assets are locked for staking rewards. This liquid nature allows it to be used as collateral in DeFi protocols.

E-mode, a specialized functionality within the Aave V3 protocol, is designed to enhance borrowing power for specific asset pairings. It is activated when the prices of assets are expected to move in tandem, such as a liquid staking token and its corresponding underlying asset. In this instance, the attacker likely utilized the correlation between ankrFLOW and WFLOW, which itself is a wrapped version of FLOW, to amplify their borrowing capacity beyond what would typically be permissible. This allows for a more efficient use of collateral, but also introduces a heightened risk of liquidation or, as seen here, exploitation if not properly secured.

The exploit at More Markets has contributed to a significant sum of losses from cryptocurrency hacks in August. According to data compiled by DefiLlama, total losses from such incidents in August have reached $139.7 million. This figure positions August as the third-largest month in terms of value stolen so far in 2026, indicating a substantial financial impact on the DeFi sector. However, it is crucial to note that this represents a considerable decrease compared to the $254 million that was stolen during July, suggesting a potential, albeit temporary, abatement in the severity of individual hacks.

This incident follows closely on the heels of another significant exploit within the broader blockchain landscape. On Sunday, the Cronos network was forced to halt its operations following a reported $75 million exploit that targeted Tectonic, a DeFi lending protocol operating on the Cronos blockchain. The simultaneous nature of these high-value exploits highlights a concerning trend of attackers probing and exploiting vulnerabilities across different blockchain networks and DeFi applications.

At the time of publication, More Markets had not publicly confirmed the incident or provided details regarding whether users had suffered any direct financial losses. Efforts by Cointelegraph to gather further information from Blockaid proved unsuccessful, as no response was received by the time of going to print. Similarly, attempts to reach More Markets for an official statement or comment were also unsuccessful, leaving the full extent of the damage and the protocol’s response to be determined.

The ongoing barrage of DeFi exploits raises critical questions about the robustness of security measures within the rapidly evolving decentralized finance space. While protocols like More Markets aim to enhance financial infrastructure through decentralization, they remain susceptible to the ingenuity of malicious actors. The use of advanced techniques, such as E-mode combined with liquid staking tokens, demonstrates an increasing sophistication in attack vectors. This necessitates a continuous evolution of security audits, smart contract verification, and risk management strategies for protocols operating in this domain.

The broader implications of these exploits extend beyond immediate financial losses. They erode investor confidence, potentially slowing down the adoption of DeFi technologies. Regulators are also increasingly scrutinizing the sector, and significant security breaches can lead to calls for stricter oversight. For developers and users alike, the incident serves as a stark reminder of the importance of due diligence, robust security practices, and a proactive approach to risk mitigation.

The interconnectedness of the DeFi ecosystem means that a vulnerability in one protocol can have ripple effects. As More Markets navigates this crisis, the wider industry will be watching closely for their response, including their efforts to compensate affected users and implement enhanced security measures to prevent future occurrences. The ongoing trend of high-value exploits, as seen with both More Markets and Tectonic, underscores the critical need for ongoing innovation in cybersecurity within the blockchain and cryptocurrency space. The industry must adapt and strengthen its defenses to foster a more secure and trustworthy decentralized future.

In related news, the Humanity Protocol has announced its commitment to prioritizing operational security following a $36 million hack, signaling a renewed focus on safeguarding user assets and data within the industry. This broader industry trend towards enhanced security measures is a direct response to the persistent threats that have plagued DeFi and other blockchain-based applications.

Cointelegraph remains committed to independent, transparent journalism, producing news articles in accordance with its Editorial Policy. The aim is to provide accurate and timely information, and readers are encouraged to independently verify all information presented. The dynamic nature of the cryptocurrency market and the evolving landscape of DeFi security necessitate continuous vigilance and critical assessment of all developments.