The lending protocol More Markets on Flow EVM appears to have experienced a security incident. Chain security firm Blockaid reported that 15.5 million WFLOW from the protocol’s lending reserves have been transferred, estimated at approximately $9.3 million based on prevailing market prices at the time. More Markets has not yet confirmed the final loss, stating that the incident is still under investigation.
The attack targeted LST and E-Mode.
Blockaid stated that the attacker exploited a vulnerability in the protocol's handling of liquid staking tokens (LSTs) and leveraged E-Mode to amplify borrowing capacity. As a result, the attacker was able to borrow assets based on manipulated collateral and repeatedly withdraw WFLOW from the mFlowWFLOW reserve.
Current public information indicates that the transferred assets primarily came from the protocol’s WFLOW lending reserve. More Markets has not yet disclosed more detailed technical information or confirmed the loss amount reported by Blockaid.
Funds have been transferred to an external wallet.
On-chain records show that the related assets began moving to external addresses shortly after the incident, with some funds already bridged out of the Flow EVM ecosystem. This may increase the difficulty of subsequent tracking and recovery.
To date, the project team has not disclosed a clear recovery plan, nor has it indicated whether any funds have been frozen or whether relevant infrastructure providers have been contacted for assistance.
WFLOW and FLOW both declined at one point.
The security incident quickly spread to the secondary market. WFLOW dropped by approximately 9% within an hour, and FLOW also fell by about 8.7%, briefly touching $0.0262.
Based on disclosed information, this downturn was primarily triggered by a protocol security incident rather than a broad-based decline across the broader crypto market. For the Flow ecosystem, subsequent focus will center on loss confirmation, fund movements, and whether the protocol implements remedial measures.