Ankr ankrFLOW (More Markets reserve) hack — August 2026

At about 06:18 UTC on 31 August 2026 an attacker emptied 15.5 million WFLOW from the mFlowWFLOW lending reserve of More Markets, a lending protocol on Flow EVM. The tokens were worth roughly $410,000 at spot, and after slippage the attacker realised somewhere around $246,000 to $250,000. The amount removed is what this entry records; the smaller realised sum is noted because the two differ.

The defect was in neither the chain nor the lending protocol. Flow stated at 19:24 UTC the same day that the root cause was a vulnerability in Ankr's ankrFLOW Solidity contract, and that this was not an exploit of Flow EVM, the Flow protocol, or More Markets. The attacker used that flaw to create about 8.6 million unbacked ankrFLOW — liquid staking tokens representing staked FLOW that no staked FLOW stood behind — then supplied them as collateral on More Markets. Because E-Mode lets closely correlated assets be borrowed against each other at generous ratios, and because ankrFLOW is meant to track FLOW, the unbacked collateral unlocked borrowing capacity nothing actually backed.

The incident was first reported at $9.3m, a figure that circulated widely and appears in much of the coverage. That was a detector estimate, and the security firm that issued it withdrew it at 20:12 UTC on 31 August in favour of the spot valuation recorded here. The gap between the two is a factor of twenty-two, and this registry corrected downward rather than leave the larger number standing.

This is a different incident from the December 2025 Flow blockchain entry, and from the December 2022 Ankr entry, both recorded elsewhere in this registry.