Security · Developing
Efficiency Mode Did Exactly What It Was Built to Do
On Flow EVM, an attacker posted Ankr's liquid-staked FLOW as collateral, switched on the setting that rewards correlated assets with a thinner safety margin, and left with 15.5 million WFLOW. A day later, nobody has said which part of that sentence was the broken one.
More Markets, a lending protocol on Flow EVM, lost its wrapped-FLOW reserve on Monday. The security firm Blockaid put the figure at roughly $9.3 million — 15.5 million WFLOW out of the mFlowWFLOW reserve — and described the method in a single sentence that is worth reading slowly: "the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, alongside E-mode to overborrow from the reserve."
There is no exotic component in that sentence. Both things named are features. Both were switched on deliberately, by people, in advance. The interesting question is not how the attacker found them — they were documented — but why the combination was left standing.
What efficiency mode is, and what it costs
E-mode is inherited from Aave V3, the codebase most lending protocols including this one are adapted from. Its premise is a reasonable one: if two assets are genuinely pegged to each other, a lender does not need to hold back much of a cushion between them, because they are not going to drift apart. So the protocol offers a bargain. Group correlated assets into a category, and borrowers inside that category get a much higher loan-to-value ratio than they would otherwise.
The size of that bargain is the whole story. CryptoTicker's walkthrough uses the canonical illustration: ordinary Ethereum collateral supports borrowing around 80% of its deposited value, while staked Ethereum inside an E-mode category supports up to 93%. Thirteen points of extra credit sounds modest. Read it from the other end and it is not — the buffer between solvency and insolvency falls from twenty percent to seven. Everything E-mode does, it does by spending that margin.
The catch is stated plainly in the design and gets forgotten in the deployment: the mode assumes correlated assets stay correlated. Each category carries its own borrowing limits, liquidation thresholds and liquidator incentives, set independently. They are parameters somebody chooses.
The awkward property of a staked token
Which brings us to what was actually posted. ankrFLOW is a liquid staking token: a claim on FLOW that has been staked and cannot be immediately retrieved. CryptoTicker's framing of the general problem is the one to keep: an LST's value "is derived from a position that can only be unwound after a waiting period. How a protocol sets that derived value is a decision each protocol makes for itself."
That is the seam. A staked token has two prices at all times — the exchange rate the staking contract says it is worth, and whatever someone will actually pay for it right now, in the size you need, before the unbonding period is over. In calm conditions those numbers sit close together, which is exactly why a protocol feels safe treating one as a proxy for the other. In the moment that matters they are different numbers, and only one of them can be sold.
Blockaid's account is that the deposited ankrFLOW was valued inside the protocol above what it was actually worth, and that real WFLOW was borrowed against that number until the reserve was empty. Nobody outside the protocol has yet established why the valuation was wrong — whether it was pushed there, or was simply configured that way.
What is not established
CryptoTicker is direct about the limits of what anyone can currently say, and we will borrow the honesty rather than paper over it: nobody has evidenced whether the fault lay in More Markets' adaptation of the Aave code, in the parameters of the E-mode category, in the price source for ankrFLOW, or in some combination.
Those are meaningfully different failures. A bad fork is a bug. A mispriced oracle is an integration failure. An E-mode category that was configured to treat ankrFLOW as tightly correlated to WFLOW is not a failure at all in the technical sense — it is a risk decision that turned out to be wrong, taken by whoever set the parameter. Only the first of those gets fixed by an audit.
Three lending protocols, five days, one recurring question
The silence, which is its own data point
As of Monday afternoon, per crypto.news, More Markets had published no statement and had not paused borrowing. Cointelegraph reported the same absence: no public confirmation of the incident, no disclosure of user losses. Blockaid said it was still tracing the post-exploit transaction cluster to work out where the money went, and labelled its own $9.3 million figure an initial assessment with the investigation ongoing.
So every number in this story is a stranger's read of a public ledger, published by a firm that says it is not finished looking. That is the normal condition of day one and we would rather say it than let repetition harden an estimate into a fact.
The other thing worth flagging: the month's running total does not agree with itself. Cointelegraph's report puts August's crypto hack losses at $139.7 million, third-largest month of 2026, down from $254 million in July. CertiK, summarising the same month on the same day, put confirmed losses at about $215 million with roughly $41.5 million of that phishing. Those two counts are not reconcilable by subtracting phishing, and they are not measuring the same thing. Treat any single August figure you see quoted this week as a methodology, not a fact.
The Take
Three lending protocols in five days, on three unrelated chains, running unrelated code, all lost money to the same question: what is this collateral worth, and who decided? Moonwell trusted a thin market. Tectonic trusted its own governance token. More Markets trusted a derived exchange rate on an asset that cannot be sold on demand, and then spent most of its own safety margin on the assumption that the derivation would hold. Not one of these is a coding error, which is why not one of them was going to be caught by another audit. E-mode is the sharpest example because it is not a flaw at all — it is a feature that converts a correlation assumption directly into borrowing capacity, and it works perfectly right up until the assumption is the thing under attack. Any protocol that ships it is stating, in public and in numbers, how confident it is that two prices will not diverge. That is a bet worth making sometimes. It should be described as a bet in the documentation, and it should have a name attached to whoever placed it.