More Markets, a lending protocol on Flow EVM, was exploited on Aug. 31 in an attack that drained about 15.5 million WFLOW from its mFlowWFLOW lending reserve. Blockchain security firm Blockaid estimated the impact at roughly $9.3 million.

According to Blockaid, the attacker used an Ankr bonded liquid staking token alongside More Markets’ E Mode mechanism. The firm also traced a cluster of transactions used to move funds after the exploit, while saying the final losses and the destination of the assets were still under investigation.

Attack centered on More Markets, not Flow itself

The incident involved an application running on Flow EVM, an Ethereum-compatible environment on the Flow network. Blockaid’s initial disclosure identified More Markets as the protocol that was targeted, and there was no indication that the Flow blockchain itself had been compromised.

More Markets is developed by More Labs and operates as a decentralized, noncustodial lending protocol. Its lending contracts run on Flow EVM rather than on Flow’s base layer directly, which is why early reporting distinguished the application exploit from any issue with the wider blockchain.

What Blockaid says happened

Blockaid said the attacker exploited More Markets by combining an Ankr bonded liquid staking token with the protocol’s E Mode feature. The security firm identified the mFlowWFLOW lending reserve as the source of the drained tokens and published transactions linked to the exploit.

The firm has not said that Ankr was compromised. Its findings instead pointed to the way the attacker interacted with More Markets, with post-exploit transfers grouped into a transaction cluster that investigators are now following.

How the protocol is structured

More Markets is built using Aave V3 architecture and, according to its public repository, supports nine markets. Users can supply assets to earn interest, borrow against posted collateral at variable rates, and liquidate positions that fall below required collateral thresholds.

Among the supported assets are WFLOW and ankrFLOW. More Markets lists WFLOW with a loan-to-value ratio of 81.5% and a liquidation threshold of 83%, while ankrFLOW is listed with a 78.5% loan-to-value ratio and an 81% liquidation threshold.

Relevant role of ankrFLOW

Ankr’s documentation describes ankrFLOW as a reward-bearing liquid staking token issued when users stake FLOW through Ankr’s staking service. As staking rewards accumulate, the token’s value relative to FLOW increases, while the holder’s token balance remains unchanged.

That token was part of the attack path identified by Blockaid, though the available information does not show Ankr’s own systems being breached. Based on the initial findings, the confirmed next step is the continued investigation into total losses and where the drained assets ultimately moved.

Source: crypto.news