More Labs' lending protocol More Markets attacked on Flow EVM, nearly $9.3 million drained
Security company Blockaid detected that More Labs' lending protocol More Markets was attacked on Flow EVM. The attackers exploited liquid-staked tokens bound to Ankr and an efficiency model to deplete the WFLOW lending pool.
Monitoring showed that approximately 15.5 million WFLOW were transferred from the mFlowWFLOW reserve, valued at about $9.3 million. The related transaction cluster also included subsequent fund transfers. The final bad debt and recoverable assets are still being verified.
More Markets is a non-custodial lending platform deployed on Flow EVM, with architecture similar to Aave V3. Users can deposit assets, collateralize, and borrow, with WFLOW and ankrFLOW both supporting the market. The efficiency model enhances borrowing capacity for assets in the same direction, such as staking derivative tokens with their underlying assets.
After the incident, the protocol locked in value of about $3.64 million, with active loans around $3.67 million, both lower than the impact amount monitored. The underlying consensus of Flow was not identified as compromised; what was drained was the protocol's reserves. As of the report, the project team had not publicly confirmed user losses or whether operations would be suspended.
The amount of cryptocurrency stolen in August has been estimated to be around $139.7 million. The day before, another lending protocol on the Cronos chain, Tectonic, reportedly faced an incident of about $75 million and suspended its network.
In market mechanics, the buyers are the depositors who keep liquidity in the reserve, while the sellers are the over-borrowed WFLOW. The incident was driven by a combination of collateral and borrowing models, with funds flowing from the protocol reserves to the attack address and then being redirected; the beneficiaries were those who withdrew reserves first, while the remaining locked assets fell below the impact amount.
Source: Public information
ABAB AI Insight
The drained asset is not the entire Flow, but the efficiency model treating liquid-staked tokens and underlying assets as "same-direction varieties." The lending protocol used higher leverage for utilization, and the attack turned this assumption into a one-time withdrawal. The $9.3 million is greater than the remaining locked assets afterward, indicating that the reserves were emptied first, followed by a collapse on paper.
The capital path is that depositors exchange WFLOW for interest in the fund pool, while borrowers use certificates like ankrFLOW to amplify their limits. Money flows out of the reserves, through auxiliary addresses, and then seeks exchanges or cross-chain. If the project has not publicly suspended the pool, the remaining deposits are still exposed to the same parameters. Aave V3's efficiency model has been repeatedly replicated on the mainnet, copying both the parameters and the gaps when those parameters are fully utilized.
The benchmark is the excessive borrowing after the decoupling of various LSTs and underlying assets, as well as the lending pool of Tectonic being named in the same month. DeFi is at a stage where "forking Aave can open on-chain operations": deployment is fast, while oracles and correlation assumptions are slow. The chain itself is alive, but the pool can die first.
Structurally, it belongs to incomplete technical substitution. The mechanism is: when the protocol writes the price correlation of two tokens as a borrowing multiple, once the correlation is broken by the trading path, the multiple becomes a siphon. The efficiency model increases capital utilization, but also increases the radius of failure for a single assumption.
ABAB News · Cognitive Law
The leverage of same-direction assets can turn into a siphon at the moment of desynchronization
The chain is still there, but the pool can be empty first
Copied efficiency parameters, along with the gaps, are also replicated