Web3 security platform Blockaid reported that an attacker exploited More Markets' lending infrastructure on Flow EVM, withdrawing approximately $410,000 worth of Wrapped Flow tokens from a protocol reserve.
The attacker removed roughly 15.5 million WFLOW from the mFlowWFLOW lending reserve, Blockaid disclosed in an X post on Monday. Blockchain records examined by the security firm show the exploit relied on Ankr Staked FLOW — a liquid staking derivative — combined with efficiency mode to extract funds beyond normal borrowing limits.
Efficiency mode is an Aave V3 mechanism that permits higher loan-to-value ratios when collateral and borrowed assets share correlated pricing, such as a staking token paired with its base asset. The attacker appears to have used this feature to over-leverage the position and drain the reserve.
The incident brings August's total cryptocurrency theft to $139.7 million, placing the month third by stolen value in 2026, DefiLlama records indicate. That figure represents a sharp drop from July's $254 million in losses.
One day before the More Markets disclosure, Cronos suspended its blockchain following an alleged $75 million attack on Tectonic, a decentralised lending protocol operating on that network.
At publication time, More Markets had issued no public statement acknowledging the drain or clarifying whether individual users sustained losses. Cointelegraph reached out to Blockaid for additional detail but received no reply by press time; attempts to contact More Markets were unsuccessful.
Blockaid later published corrections to its initial assessment of the drained amount on September 3 at 14:20 UTC.
Source: cointelegraph.com