Blockaid’s $9.3 M WFLOW Heist Exposes More Markets’ Liquidity Vulnerability

Blockaid’s latest statement reveals that an attacker leveraged an Ankr liquid staking token and E‑mode feature to overborrow from More Markets’ lending reserve, draining $9.3 M worth of WFLOW.

Mechanism of the Breach

■Ankr liquid staking token turns staked assets into liquid positions, enabling high‑leverage trades.

■E‑mode (Earn Mode) boosts borrowing limits for specific asset classes, allowing users to borrow more with less collateral.

■The attacker combined these two features to overborrow and siphon off $9.3 M of WFLOW from More Markets’ reserve.

Liquidity Shockwave

■Prior to the incident, More Markets’ total liquidity pool hovered around $12 M.

■The extracted $9.3 M represents roughly 77% of that pool, dramatically curtailing market liquidity.

■WFLOW’s price plummeted over 35% immediately following the theft.

The Security Gap

■The protocol inadequately capped E‑mode usage, inflating high‑leverage borrowing risk.

■Ankr’s liquid staking mechanism enabled the attacker to execute rapid, anonymous transfers.

■A similar breach at Yearn Finance in 2023 resulted in a $4 M loss.

Market Reactions

■The crypto community called for a reassessment of protocol security, especially around high‑leverage mechanisms.

■More Markets announced an in‑depth security audit post‑incident.

■Regulators urged tighter risk‑management standards for liquid staking protocols.

The market is reminded that such attacks not only undermine a single protocol but also erode trust in the entire liquid‑staking ecosystem. The tactics employed—combining liquid staking tokens with high‑leverage borrowing—highlight the potential devastation of poorly guarded mechanisms. For investors, it’s essential to evaluate not just liquidity, but also the robustness of a protocol’s security and risk‑management layers.