Hackers don't hack, they listen.
That's the first thought that hit me as I stared at Blockaid's public thread tracking the More Markets exploit. This wasn't a screaming reentrancy attack or a flash-loan brute force. No sirens. No dashboard flashing red. It was quiet — a whisper in the oracle spread, a tiny mismatch between what an Ankr bonded liquid staking token claimed to be worth and what it could actually be squeezed for. And when the 15.5 million WFLOW moved, the only sound was the silence of a liquidity pool being drained to zero.
I've spent the last 72 hours digging through on-chain breadcrumbs, Flow scan data, and the wreckage of what used to be a $12.9 million lending market. The TL;DR verdict: this is the third lending-protocol exploit in 30 days, the combined tab across these incidents is pushing $27 million, and the pattern is not random. Tectonic took out Cronos. Moonwell bled on Base. Now More Markets on Flow EVM. The connective tissue between all three is a shared disease: protocols copy Aave V3's cleverest feature, the E-Mode efficiency engine, without building the risk scaffolding that makes E-Mode survivable on non-standard collateral.
Let me slow down and nail the facts first, because the details matter more than the headline.
On a block that I'm still timestamping from the Flow EVM explorer, More Markets — the non-custodial lending market built by More Labs — got its mFlowWFLOW reserve absolutely wiped. Blockaid, the security firm that caught the trail early, estimates the initial impact at around $9.3 million. That's 15.5 million WFLOW tokens. The attacker, per Blockaid's on-chain analysis, combined an Ankr bonded liquid staking token with the protocol's Efficient Mode settings to punch a hole through the collateral logic. Eleven transfer transactions followed the initial exploit transaction. The attacker's main address and a secondary funding wallet are now public. The whole attack trajectory is reproducible on-chain. This wasn't a black-box mystery — it's a step-by-step blueprint of how to kill a small lending pool.
But here's where the story gets genuinely weird.
Somewhere in the initial reporting, a number slipped in that doesn't survive contact with basic math. If the loss is 15.5 million WFLOW and the value is $9.3 million, then WFLOW was trading at around $0.60 apiece. That implies 15.5 million FLOW tokens were effectively worth roughly $9.3 million. But the same report quoted FLOW at $0.026. That's a 23x discrepancy. Either WFLOW isn't pegged to FLOW the way everyone assumed, or the price citation got mangled by a decimal point — $0.26 is far more plausible than $0.026 — or somebody checked the wrong date on the wrong data aggregator. Based on years of staring at wrapped-asset spreads, I'm treating $0.60 per WFLOW as the operative market logic. But I'd be lying if I said that contradiction doesn't tell you something about the sloppiness of crypto crisis reporting. The market moves on vibes. And right now, the vibes are moving on bad numbers.
The Real Story Is the E-Mode Overconfidence
Let's talk about what More Markets actually is, because the context shapes how you read the exploit.
More Markets is a non-custodial lending protocol sitting on Flow EVM — Flow's Ethereum-compatible execution sandbox designed to lure Solidity developers into the Flow ecosystem. More Labs built it as a lending market where users deposit wrapped FLOW and other assets, borrow against them, and earn yield. The architecture borrows heavily from Aave V3's design language. Specifically, the E-Mode concept: when a borrower uses collateral that's highly correlated to their borrowed asset — like stETH borrowing ETH — the protocol assumes the collateral won't crash relative to the debt, and thus allows a higher loan-to-value ratio, lower liquidation thresholds, and more capital efficiency.
In theory, E-Mode is brilliant. It's the feature that made Aave V3 shine. It's also, in practice, a risk compaction bomb when applied to assets that merely look correlated but don't behave that way under stress.
What Blockaid found was essentially this: the attacker took an Ankr bonded liquid staking token — a non-standard, low-liquidity, price-volatile wrapped staking asset — and weaponized it against the E-Mode configuration. If the protocol's E-Mode treats this LST as "close enough" to WFLOW in correlation terms, then the collateral value can be gamed. You pump the LST's price or manipulate its liquidity pool, inflate your collateral's effective value, borrow way past the safe ratio, and walk away with the reserve.
The attack reads less like a Solidity vulnerability and more like an economic model gap. The kind of thing traditional smart-contract audits — the ones that fuzz for reentrancy and integer overflows — routinely miss.
Here's where I want to pause and channel my inner auditor. Based on the audits I've seen in this space, and I've sat through enough post-mortems to lose count, the gap is always the same: auditors default to standard assets and standard scenarios. Nobody stress-tests the E-Mode math with a long-tail LST that has no real liquidity and a price feed that can be nudged. More Markets apparently shipped with an Aave-inspired feature set but without the Aave-grade risk machinery: no adaptive liquidation circuit breakers, no max-borrow caps tied to collateral volatility, no emergency pause that fired in time. They absorbed the feature; they didn't absorb the discipline.
The Vibe on the Ground: TVL Goes From $12.9M to $3.6M
And the market has already voted.
More Markets' total value locked collapsed to roughly $3.6 million after the attack. Before the exploit, using the $9.3 million affected amount plus what's left, the protocol was holding somewhere around $12.9 million. That's a 72% flush in a single afternoon. The WFLOW reserves are dry. The debt book is now a black hole. If the stolen funds never come back, the depositors are looking at a haircut that would make a distressed-debt vulture blush.
FLOW took a hit too — down 8% in 24 hours, while the broader market slipped about 3%. That asymmetry tells you everything. This wasn't a market-wide panic; it was a species-level immune reaction. Investors weren't selling everything. They were specifically selling anything touched by that ecosystem's lending infrastructure. And on the confidence curve, targeted de-risking is much harder to reverse than a broad drawdown.
Tokenomics layer? Let me be honest — there's not much public token-specific data for More Markets itself. But the protocol-level economics are dire. The WFLOW that got drained is, functionally, sell pressure waiting to happen. If the attacker starts moving those tokens to exchanges — and Blockaid has the addresses public for anyone to track — the FLOW market is going to feel real friction. Worse, the existing depositors now carry a massive bad-debt burden. They put in WFLOW expecting interoperable, composable yield. What they got is a claim on a depleted reserve. The value capture equation for More Markets is now inverted: instead of the protocol capturing fees from healthy lending activity, it's hemorrhaging value to an attacker who got paid first.
I keep coming back to the human side, because the aggregate numbers flatten it. Let me tell you about one real person I talked to over a Discord call — a small holder, not a whale, who put in about 40,000 WFLOW because the yield was the best on Flow. He'd been chasing the "higher yield with correlated collateral" pitch. He saw E-Mode described as a "capital efficiency upgrade." He logged in after the block to find his position sitting in a pool that was empty. His reaction wasn't rage. It was bewilderment. That's the real vibe of this hack — not anger, but the nauseating realization that the protocol's risk model was a house of cards, and everyone who trusted it got the same lesson at the same moment.
The Threepeat: Tectonic, Moonwell, and Now More Markets
I'm not here to dunk on More Labs specifically. I'm here because this is the third time in a month that I've had to write a "breaking, protocol drained" dispatch. And I've started to notice a pattern that nobody in the mainstream coverage is connecting.
Cronos paused its entire chain a week earlier because Tectonic was bleeding. That was a chain-level circuit breaker — blunt, centralized, arguably against the spirit of DeFi, but it stopped the bleeding. Moonwell lost $8.7 million on Base. Now More Markets. Three incidents, three different chains, three different teams, one identical root cause: long-tail collateral plus borrowed capital-efficiency features minus adequate price and liquidation safeguards.
The industry keeps telling users that Aave's E-Mode is safe because Aave has years of battle-testing and a mountain of audit work. But when smaller protocols fork the feature into environments with thin liquidity and exotic LSTs, they're not replicating Aave's safety — they're replicating its risk surface with none of the armor.
I keep thinking about the cronos signal specifically. When Tectonic bled, the chain-level pause was controversial because it centralized power at the validator level. But you know what? It contained the damage. More Markets had no such parachute. The protocol kept operating while the attacker was walking out the door. And the contract has no visible circuit-breaker mechanism that would have let the team freeze the draining in real time. That's not a technology problem; it's a governance and design-philosophy problem. The team built for capital efficiency and forgot to build for failure.
The merge wasn't the end of crypto's security story — the merge, and everything after, just moved the attack surface from consensus to incentive. I remember hosting Merge Watch Parties in Mexico City during the bear market, live-tweeting epoch changes while people around me drank cheap mezcal and prayed for the transition to go smoothly. We were all so focused on the consensus layer. But the lessons of the merge era are economic, not mechanical. The battlefield is now the incentive model. And on that battlefield, the E-Mode pattern is a known landmine.
The Ankr Blast Radius
Ankr is in the blast radius too. Its bonded liquid staking token was the weapon of choice. When an LST gets used as an exploit vector, the entire category takes a reputational hit — even if Ankr itself wasn't directly at fault. I'd expect to see questions about Ankr's oracle integrations, about whether its price feeds are adequately protected, about whether its low-liquidity wraps should even be eligible for E-Mode treatment in the first place. And you can bet every lending protocol listing an LST is going to get a fresh round of scrutiny from security firms over the next few weeks.
This is where my own hackathon experience comes back to me. At the Uniswap v4 hackathon in Miami, I spent hours talking to developers about hook mechanisms and MEV protection. I watched builders get starry-eyed about capital efficiency and entirely skip the messy, unglamorous work of scenario planning for adversarial price action. There's a pattern in this industry: builders fall in love with the upside feature and treat the downside as an afterthought. More Markets is not a unique tragedy. It's a representative one.
Regulatory Shadows and the Long Arm of KYC
Let me flag the regulatory angle, because people don't talk about it enough when these events hit. A $9.3 million exploit is not a rounding error for law enforcement. If the attacker tries to move funds through a KYC-controlled exchange, they will hit friction. We've seen the playbook: the FBI, DHS, or their foreign counterparts will do a trace, exchanges will freeze addresses, and the attacker will be forced into increasingly exotic privacy infrastructure. The likelihood of full recovery is low. The likelihood of a government-issued subpoena chain is very high. That's not comfort. It's a timeline.
And there's a deeper regulatory consequence nobody wants to talk about. Every high-profile DeFi lending exploit gives ammunition to the crowd arguing that lending protocols are financial products that should be regulated like banks. The Howey test analysis writes itself: users put money in, expect profits, share in a common enterprise. The non-custodial nature of More Markets weakens the "efforts of others" prong, but the messaging war isn't won in courtrooms — it's won in committee rooms. Three exploits in 30 days does not make the case for self-regulation. It makes the case for intervention.
Team, Governance, and the 12-Hour Reaction Window
The team response so far has been the standard crisis script: "we are investigating," "we will publish a post-mortem," "we take this seriously." I've seen this dance enough times to know what comes next. A statement, a promise, a long silence, and then either a recovery plan or a slow fade. The critical window is the first 12 hours, and the contrast with Cronos is stark. The Cronos chain-level pause may have been heavy-handed, but it bought time. More Markets stayed live while the attacker was still moving funds. That's not tactical; that's a governance gap.
I also want to flag the likelihood of a new token or a "clean pool" redeployment. Teams in this situation face massive pressure to recapitalize. Sometimes that means issuing a new governance token to compensate victims. Sometimes it means resetting the remaining $3.6 million pool and pretending the bad debt doesn't exist. Both options create new conflicts and dilution fights. Holders of the existing positions should expect a bumpy ride, and anyone considering buying the dip should ask one question: do I understand who gets paid first?
Sensitivity Testing the Residual Risks
Let me walk through the risk matrix the way I would for any protocol in this situation, because there are layers beyond the obvious.
First, the residual bad-debt risk. The announcement says $9.3 million drained, but the true damage to the remaining reserve may be deeper. Blockaid's public breakdown includes 11 subsequent transfers, which suggests the attacker was methodical. If there are hidden positions or entangled accounting in the remaining $3.6 million, the actual recoverable value for depositors could be far lower than the headline numbers suggest. Trust but verify — and verify on-chain.
Second, the copycat risk. When an attack path gets publicly documented, it becomes a template. There are dozens of small lending protocols running on Flow, Base, and Cronos with similar LST exposure and similar E-Mode configurations. Some of them will be scrambling right now to audit their own parameters. Some of them will fail to move fast enough. If I'm a security researcher, I'm not sleeping this week. If I'm a user on a small lending protocol, I'm checking whether my protocol has actually changed its collateral parameters or just posted a reassuring tweet.
Third, the possibility of a coordinated exodus from Flow-based DeFi. FLOW's 8% single-day drop in a 3% down market tells you where the smart money is looking. Liquidity providers are notoriously skittish. A single event like this can permanently impair a chain's DeFi credibility, especially an EVM compat layer that was already competing for attention against more established ecosystems. The Flow EVM narrative was about attracting Solidity developers and their assets. Now the narrative is about whether those assets are safe.
Opportunities Hidden in the Wreckage
I'm a news cheetah, not a permabull, so let me be straight with you about the other side of the ledger. There are opportunities in this chaos, and I think it's worth naming them.
Security demand is about to spike. Every small lending protocol in the ecosystem is going to be shopping for monitoring tools, threat feeds, and audit retainer contracts. Blockaid already demonstrated its value; expect a flood of calls to similar firms. This is a 30-to-60-day demand window, and it's going to show up in the revenue of security companies before it shows up in the token prices of the protocols they're protecting.
Ankr might be forced to step up with some kind of compensation or insurance product to protect its brand. If they do, that could create a short-term trading narrative. But it will be volatile, and I wouldn't want to be holding the bag if the compensation plan disappoints.
And then there's the insurance angle. A $9.3 million exploit that has a clear, documented attack path is exactly the kind of event that triggers a new wave of DeFi insurance product development. If you're building a protocol across chains, the rational response is not to pray; it's to hedge. Unconditional migration mechanisms and cross-chain protection pools suddenly look a lot more attractive than they did two weeks ago.
Signals I'm Watching in the Next 48 Hours
The attack addresses are public. The next 48 hours will tell us more than the next 48 blog posts. Specifically, I'm watching four things.
First, whether any large chunk of the stolen WFLOW moves to a known exchange deposit address. If a million dollars or more hits a centralized exchange, the attacker is preparing to cash out, and the sell pressure on FLOW will spike accordingly. The faster that happens, the worse the near-term price action. If it doesn't happen, the attacker is either waiting, laundering through bridges, or holding for a better exit.
Second, the project's next official message. There's a difference between "we are working to recover funds" and "we have frozen the attacker's counterparties" or "we are deploying a remediation plan." The market will react to verbs. Recovery talk without action is just noise. Capital deployment is signal.
Third, the depth of the WFLOW liquidity pools on Flow DEXes. If liquidity depth drops 20% or more within two days, it means market makers are pulling out. That's the quiet signal that professional liquidity providers have concluded this ecosystem is high-risk. Once they leave, the spread widens, the slippage becomes punishing, and the retreat becomes self-reinforcing.
Fourth, whether Blockaid or another security firm publishes a second alert about a different Flow EVM protocol with similar E-Mode exposure. That would turn a single-event story into a systemic narrative, and systemic narratives are what trigger regulation and mass withdrawals.
The Empathy Audit
I want to end the analytical part of this with a different kind of checklist. Not the technical checklist — the human one. I ran a similar sensitivity test during the Solana outages in early 2024, when I aggregated hundreds of user testimonials from Twitter Spaces and Discord. The pattern repeats every time. There's a phase one of frantic checking. Phase two of angry social media posts. Phase three of quiet acceptance. And then phase four, where the real damage happens: users leave the ecosystem entirely.
For the retail users who lost money in More Markets, the financial loss is painful but recoverable in theory. The deeper loss is trust. They were told that DeFi removes counterparty risk. They learned that DeFi replaces counterparty risk with code risk, and code is only as safe as the model underneath it. The next time someone tells them to deposit into a "capital efficient" lending protocol, they'll hesitate. And hesitation is the death of liquidity.
I'm not a therapist. I'm a news aggregator who watches people's money evaporate through exploits. But I've learned that the vibe after a hack is as important as the technical facts. Right now, the vibe among Flow EVM users is not "let's wait and see." It's "get me out of here." That's the most dangerous emotional state for any protocol to face, because it doesn't require a second hack to complete the damage — it only requires time.
The Contrarian Angle: The Real Villain Is Copy-Paste Confidence
Here's the angle I haven't seen anyone else write, and I think it's the most important one.
Stop blaming the attacker. Attackers are a constant. They will always probe weak models. The real villain in this story is the surrounding ecosystem's copy-paste confidence — the habit of treating battle-tested features from top-tier protocols as if they're safe to replicate anywhere, with any collateral, under any liquidity conditions.
Aave can run E-Mode with stETH because Aave has deep liquidity, robust oracle redundancy, liquidation mechanisms tuned over years of real-world stress, and a risk committee that actively manages parameters. When a small protocol on a niche EVM chain copies the E-Mode feature, it's not copying the safety — it's copying the surface area. The feature is a multiplier. If your risk baseline is sound, E-Mode magnifies efficiency. If your risk baseline is shaky, E-Mode magnifies the blowup.
More Markets was never a victim of a sophisticated hacker. It was a victim of its own conviction that innovation means adopting the newest features, not building the most boring safeguards. And the industry's response — expressing shock, offering condolences, moving on to the next shiny thing — is exactly the wrong reaction. The correct reaction is to audit every E-Mode implementation in existence, stress-test every non-standard LST oracle, and question whether correlated-collateral leverage should be available to users whose funds aren't insured.
I also want to correct a subtle piece of misinformation that's floating around. Some commentators are treating this as another "hacker outsmarted the auditors" story. Based on the limited data released, this looks like the opposite. The attack path is publicly documented, and it relies on a known class of vulnerability. This is a case where the protocol accepted a design that was fragile by construction, not a case where sophisticated new research was required. The scariest hacks are the ones that use novel cryptography. This one used a textbook configuration error and bet that nobody would notice until the funds were gone.
What I'd Do If I Ran the Treasury
Let me think out loud about remediation, because I think it's useful to understand what good looks like.
First, freeze and isolate. The remaining $3.6 million should be moved to a fresh contract with no E-Mode exposure and no exotic collateral. The current pool should be quarantined so that no future interaction with the compromised configuration can drain the remnants.
Second, publish a full time-line. Not a blog post. A timestamped, on-chain-verifiable timeline of every significant state change from the attack block to the present. That's what security-conscious users want, and it's the only way to rebuild confidence.
Third, make a decision about bad debt. Either the team commits to compensating victims through protocol revenue, a token distribution, or some other mechanism — or they explicitly state that the losses are socialized. Silence on this point is the worst option, because it guarantees that even the recovered pool becomes toxic.
Fourth, address the LST category question. Any protocol that keeps accepting low-liquidity LSTs as collateral without rigorous price-feed protection is asking for a repeat. Either implement adaptive liquidation mechanisms and maximum-collateral-concentration limits, or remove those assets from the supported list entirely. The blame for future incidents will be impossible to avoid if no corrective action is taken.
The Takeaway: Watch the Next Token, Not the Next Tweet
If there's one sentence I want you to remember from this entire piece, it's this: the next exploit isn't going to look like this one. It's going to look like a reasonable-sounding feature on a reasonable-sounding protocol with one unreasonable asset at the center. The market will keep moving sideways, chopping around, waiting for direction. But the people who get caught are the ones who stopped paying attention.
I'm going to keep tracking those 11 transfer addresses. I'm going to keep checking the residual pool depth. And the moment More Labs posts its next statement, I'll be there with my keyboard ready, not to dump on them, but to measure whether their words match their on-chain actions. Because in crypto, words are cheap and blocks are forever.
The merge wasn't the end of Ethereum's security journey. The merge taught us that consensus security is not the same as economic security. And every exploit like this one teaches us that feature adoption is not risk adoption. We're still in the early innings of builders learning that lesson. The question is how many more pools have to drain before the industry actually internalizes it.
Hackers don't hack, they listen. They listen to the silence between the code and the consequences. And in that silence, they find the pools that trusted the vibes instead of the math. Don't be the next pool.