More Markets, a non-custodial lending protocol on Flow EVM, lost 15.5 million Wrapped Flow (WFLOW) to an exploit on Monday. Security firm Blockaid put the initial impact at $9.3 million. The protocol itself hasn't confirmed any loss, and its team is still investigating the claim.
How the exploit worked
Blockaid traced the attack to a combination of an Ankr bonded liquid staking token and the protocol's Efficient Mode setting. That pairing let the attacker drain the mFlowWFLOW reserve. The security firm published the exploit transaction, the contract deployment, 11 follow-up transfers, the attacker's address, a helper wallet, and the affected pool.
The mechanics are still being pieced together, but the public trail gives other teams a chance to check their own deployments. Efficient Mode is meant to let users borrow against correlated assets with better capital efficiency. In this case, it became the entry point.
The broader damage
Flow (FLOW) fell about 8% over 24 hours to trade near $0.026. Value locked in More Markets dropped to roughly $3.6 million. The drop comes amid a broader market downturn, which has pulled the total market cap down roughly 3%.
The timing isn't great. Cronos halted its blockchain on August 30 after identifying an exploit at Tectonic, its largest lending market. Moonwell lost an estimated $8.7 million last week. DefiLlama data records 37 hacks in August, totaling roughly $140 million.
A bad month for lending
Lending protocols account for the bulk of that figure. That's a pattern, not a coincidence. These platforms hold large pools of liquid assets, and the complexity of their risk settings creates a wide attack surface.
More Markets is built by More Labs and operates as a lending market on Flow EVM. The team has not issued a statement confirming or denying the loss. The investigation is ongoing, and the attacker's address is public. Whether the protocol can recover the funds, or whether it will even acknowledge the loss, remains an open question.
