$9.3M Gone in Minutes: The More Markets Exploit That Should Scare Every DeFi User
An attacker just weaponized a liquid staking token and a lending protocol's own risk feature to walk away with $9.3 million in WFLOW, and Blockaid says the mechanics were surgical.
How the Attacker Did It
Blockaid confirmed the exploit targeted More Markets, a DeFi lending protocol built on the Flow blockchain. The attacker used an Ankr liquid staking token as collateral, then activated E-mode, a high-efficiency borrowing feature designed to let users maximize capital against correlated assets.
That feature, meant to help sophisticated users, became the weapon. By combining the Ankr liquid staking token with E-mode, the attacker was able to overborrow far beyond what the collateral should have allowed. The lending reserve didn't hold. Roughly $9.3 million in WFLOW was drained.
This is not a brute-force hack. This is someone who read the documentation, found the gap between two interacting systems, and quietly pulled the thread until the whole thing unraveled.
Why This Hits Different
Liquid staking tokens have become a backbone of DeFi collateral strategies. Protocols accept them because they represent staked assets with yield, making them attractive and widely held. But that same liquidity and yield profile makes them powerful leverage tools when a lending protocol's risk parameters aren't calibrated tightly enough.
E-mode, popularized by Aave, is now appearing across multiple lending forks and derivatives. Every protocol that implements it without airtight collateral vetting is carrying a version of this risk right now.
The More Markets exploit is not an isolated edge case. It is a template.
What the Numbers Mean
$9.3 million is not a protocol-ending number for the broader DeFi ecosystem, but for a lending reserve on Flow, it represents a significant liquidity hit. Users who had funds deposited in that specific reserve are the ones absorbing the damage. WFLOW holders on the platform need to check their positions immediately.
What to Watch Right Now
If you are using any lending protocol that accepts liquid staking tokens as collateral and offers an efficiency or E-mode feature, you are carrying correlated risk. This is the moment to audit your collateral types, check borrow limits, and verify whether the protocol has published any response or pause on affected pools.
Blockaid flagged this, which means on-chain security infrastructure is catching these moves, but detection after the fact does not recover funds.
Watch for More Markets to release a post-mortem. Watch for other protocols to quietly tighten their E-mode collateral lists in the next 48 hours. The smart money is already reading the fine print.