More Markets Exploit: How a Liquid Staking Token and E-Mode Pulled $9.3 Million Out of a Lending Market

Around 15.5 million WFLOW drained from the lending market More Markets on August 31, 2026, worth roughly $9.3 million according to the security firm Blockaid. The attacker needed no stolen keys and no gap in the blockchain underneath. They used two building blocks that are wired into almost every larger lending market: a liquid staking token as collateral, and the so-called E-Mode, which treats both sides of a loan as equivalent. That is precisely why this incident can concern you beyond one small chain. If you have borrowed against staked Ethereum somewhere, or one stablecoin against another, your position is very likely running in the same mode. This article sets out what is established as of today, what remains open, how E-Mode works, and which four details you can look up in your own lending market. More Markets Exploit: What Happened on Flow EVM on August 31, 2026 More Markets is a non-custodial lending market from More Labs that builds on the Aave V3 codebase and runs on Flow EVM. Users deposit assets there to earn interest, or post them as collateral to borrow against. WFLOW and ankrFLOW are among the supported markets. According to Blockaid, the incident began on August 31,...