More Markets (2026) — Crypto Hack
Partially RecoveredAttacker minted ~8.6M unbacked ankrFLOW via an Ankr contract flaw, supplied it as collateral on More Markets (Flow EVM), and used E-Mode to borrow 15.5M WFLOW. Blockaid's initial $9.3M estimate was revised to ~$410K.
Summary
Attacker minted ~8.6M unbacked ankrFLOW via an Ankr contract flaw, supplied it as collateral on More Markets (Flow EVM), and used E-Mode to borrow 15.5M WFLOW. Blockaid's initial $9.3M estimate was revised to ~$410K.
How It Was Compromised — DeFi via Unbacked Collateral / E-Mode Exploit (Liquid Staking Token)
On August 31, 2026, an attacker exploited a vulnerability in Ankr's ankrFLOW liquid staking contract to create ~8.6M ankrFLOW without corresponding FLOW backing, supplied the unbacked tokens as collateral on More Markets (an Aave V3-based lending protocol on Flow EVM), and used E-Mode to borrow 15.5M WFLOW from the mFlowWFLOW reserve. Blockaid initially estimated ~$9.3M impact but revised it to ~$410K based on FLOW's spot price; the attacker realized ~$246K-$250K after slippage. Flow confirmed the incident was not an exploit of the Flow blockchain or tokenomics — the vulnerability was in Ankr's Solidity contract. The Flow Foundation committed to replacing the drained reserve; ankrFLOW staking and More Markets lending remain paused pending Ankr's contract upgrade.
Fund Flow & Laundering Analysis
The drained WFLOW was moved onward through post-exploit transfers traced by Blockaid; the attacker realized ~$250K after selling into limited liquidity.