Ankr’s ankrFLOW Token Linked to $9.3M More Markets Exploit

On August 31, 2026, the ANKR token experienced a 1.66% increase within a 24-hour period, reaching a price of $0.003981. Despite this short-term gain, the asset recorded a 1.41% decline over the preceding week, while maintaining a 17.87% rise over the last month. Conversely, the token has suffered a significant 35.85% drop over the past year. This market activity coincides with a major security incident on the Flow EVM network that directly implicated Ankr’s liquid staking infrastructure, creating immediate volatility for ecosystem tokens.

Security Breach on More Markets

More Markets, a decentralized lending protocol developed by More Labs and deployed on the Flow blockchain’s Ethereum Virtual Machine-compatible layer, suffered a critical security exploit on August 31, 2026. The incident resulted in the drainage of approximately 15.5 million Wrapped Flow (WFLOW) tokens from the protocol’s mFlowWFLOW lending reserve. Blockchain security firm Blockaid conducted an initial on-chain assessment, pegging the financial impact at roughly $9.3 million.

The exploit leveraged a combination of an Ankr-issued bonded liquid staking token (ankrFLOW) and the protocol’s Efficiency Mode borrowing feature. Efficiency Mode, a feature of the Aave V3 architecture underlying More Markets, allows users to unlock higher capital efficiency by borrowing against economically correlated assets. In this instance, the attacker utilized the correlation between FLOW and ankrFLOW to manipulate loan-to-value (LTV) ratios, pushing borrowing limits beyond safe thresholds.

Technical Mechanisms of the Exploit

Blockaid’s disclosure indicated that the attack transaction cluster included post-exploit exfiltration transactions, meaning the attacker began moving funds away from the origin address before the incident was publicly flagged. The security firm identified the primary exploit transaction by the hash starting with 0x2b2e6ea6c and traced the attacker’s contract deployment to a hash beginning with 0xca9cf3f46.

The investigation linked two specific wallets to the fund movement: the primary exploiter address at 0xa1E…6A7Cc and a helper wallet at 0xA0C…b3702. The victim contract was identified as the More Markets Pool at 0xbC92…F2c8d. While Blockaid’s detector estimated the impact at $9.3 million, the firm clarified that this figure represented an internal metric rather than a final confirmed loss, as the destination of the drained assets remained under investigation.

Impact on Ankr and Flow Ecosystem

The incident specifically highlighted vulnerabilities in how Ankr’s ankrFLOW token was integrated into lending markets. Ankr describes ankrFLOW as a reward-bearing liquid staking token issued when users stake native FLOW. The value of ankrFLOW increases relative to FLOW as staking rewards accumulate, a model that relies on accurate on-chain ratio feeds for pricing.

Although Blockaid did not state that Ankr’s core protocol was compromised, the incident raised questions about the interaction between bonded liquid staking tokens and Aave V3’s Efficiency Mode. More Markets reported approximately $3.99 million in total value locked across the Flow chain at the time of the exploit, with about $3.48 million in active loans. The drained 15.5 million WFLOW exceeded the reported TVL snapshot because the pool’s gross supply and borrow positions were considerably larger than the net collateral figure, particularly in a market supporting leveraged looping through Efficiency Mode.

Market Reaction and Broader Context

Following the disclosure, the Flow ecosystem experienced immediate price corrections. Wrapped Flow (WFLOW) dropped approximately 9% within an hour, while the native FLOW token fell about 8.7% to $0.0262. These declines were attributed to trader reaction to the exploit rather than a broad crypto market sell-off.

This event adds to a challenging year for decentralized finance security. Data indicated that crypto losses exceeded $1.1 billion across 212 verified incidents in the first half of 2026. The More Markets incident is distinct from previous protocol-level breaches on Flow, such as the December 2025 attack on the Cadence execution layer, as it targets a single application-layer contract rather than the base blockchain.

As of the report date, More Markets had not published a full technical reconstruction or a definitive post-mortem. Users were advised to monitor official communication channels for updates on remediation and potential fund recovery. The investigation into the transaction cluster and the ultimate fate of the stolen assets remained ongoing.