More Markets, E-Mode, and the $9.3M Question DeFi Does Not Want to Answer

Over the past seven days, DeFi lending has had another one of those weeks that makes everyone want to look away. On the Flow EVM chain, More Markets — a non-custodial lending market built by More Labs — was hit by an exploit that Blockaid initially assessed at around $9.3 million. That is roughly 15.5 million WFLOW tokens leaving the protocol. The attacker reportedly combined Ankr's bonded liquid staking token with the protocol's E-Mode settings to drain the mFlowWFLOW reserve. Within hours, More Markets' total value locked slipped to about $3.6 million, while FLOW fell 8% in 24 hours as the broader crypto market dipped 3%. By the time the news hit mainstream feeds, the team was already saying the usual words: investigating, reviewing, updating. For those who have not followed Flow EVM closely, More Markets is not one of the giant names in lending. It sits in a smaller but ambitious ecosystem, trying to bring Aave-style borrowing to Flow. More Labs describes it as a non-custodial lending market, meaning users keep control of their assets through smart contracts rather than trusting a custodian. That is part of the appeal and also part of the problem. A non-custodial protocol is only as safe as the economic assumptions encoded in its contracts. What made this attack different is that it did not rely on a classic smart contract coding error like reentrancy or an integer overflow. Instead, it used a feature that has become fashionable in DeFi: E-Mode, or Efficiency Mode, introduced by Aave V3. E-Mode allows borrowers to get better collateral factors when their collateral and debt are highly correlated, such as ETH and liquid staking derivatives. The idea is elegant. If two assets move together, the liquidation risk is lower, so the protocol can be more capital efficient. But that efficiency comes with a hidden condition: the assets must actually be correlated, and their prices must come from trustworthy sources. Blockaid's public assessment points to the core weakness. The attacker took Ankr bonded liquid staking token, which is a non-standard, relatively illiquid, and highly volatile form of staking derivative, and combined it with More Markets' E-Mode settings. The combination created a mismatch in the collateral valuation process. In simple terms, the attack used a fragile asset as if it were a stable, highly correlated one, and then borrowed against that false assumption until the reserve was dry. This is not a random exploit. It is a structural failure. Before going deeper, there is one number in the coverage that never sat right with me. If 15.5 million WFLOW tokens represent a loss of $9.3 million, then the implied price of WFLOW is about $0.60. The same report quoted FLOW at roughly $0.026. If WFLOW is supposed to have a 1:1 anchor with FLOW, then 15.5 million tokens would be worth only about $403,000, not $9.3 million. That is a 23x gap. The most likely explanation is a decimal error in the original price report, probably $0.26 rather than $0.026, or a mismatch in the time period used for the quote. This matters because investors make decisions based on these numbers. A sloppy price feed becomes part of the panic. Based on the logic of the attack, I use an effective WFLOW price of around $0.60 in this analysis. Let me reconstruct what likely happened. The attacker opened a position using Ankr bonded LST as collateral. Because More Markets had adopted E-Mode, the protocol treated this collateral as more reliable than it actually was. The attacker then used the borrowed capacity to take out mFlowWFLOW, which is the reserve token representing WFLOW deposits. The drain was not necessarily a single instant transaction. Blockaid identified one attack transaction, a deployed contract, eleven subsequent transfers, and both the attacker address and auxiliary wallets. That level of on-chain transparency means the whole method is reproducible, and it also means the security community can learn from a confirmed path. In my experience auditing DeFi incidents, this pattern is all too familiar. Back in 2020, during the MakerDAO governance work, I saw how a small quirk in collateral assessment could trigger panic. But the difference is that Maker had months of community debate around risk parameters. More Markets appears to have imported Aave's innovative features without importing Aave's full risk scaffold. Aave has extensive price safeguards, liquidation controls, and borrowing capacity limits that are stress-tested across many asset types. More Markets seems to have taken the efficiency feature and left behind the safety rails. That is not a small oversight. It is the difference between a racing car with brakes and one without. The numbers underline the severity. Before the attack, More Markets had roughly $12.9 million in total value locked, based on the reported remaining $3.6 million plus the $9.3 million drained. Afterward, the protocol was down 72% in TVL. This is not a temporary dip. A lending protocol with $3.6 million left and a multi-million dollar bad debt hole is in an emergency state. Depositors cannot feel confident that their assets will be returned in full, and borrowers face uncertain collateral values. The ecosystem impact goes beyond one protocol. FLOW dropped 8% at a time when the broader market only fell 3%. That extra decline reflects a loss of trust, not just token math. When a small ecosystem suffers a pool-level incident, the whole chain feels the fear. The emotional tone in the community right now is not just cautious. It is wounded. We have seen three lending protocol attacks in August already: Tectonic on Cronos, Moonwell on Base, and now More Markets on Flow EVM. Combined losses are close to $27 million. Each incident chips away at the same narrative: that DeFi can be secure if the code is good. The truth is more uncomfortable. Security is not only about code. It is about the economic model, the oracle dependency, and the willingness to say no to an attractive feature when the underlying asset is too fragile. That is the ethical pulse of the decentralized economy. We cannot keep pretending that risk parameters are just technical details. Now for the contrarian angle. The most dangerous part of this attack is not that More Markets was exploited. The most dangerous part is that the same design pattern is probably running in dozens of smaller lending protocols right now. E-Mode is an attractive default because it increases capital efficiency. Ankr LST or similar bonded derivatives are attractive to list because they bring TVL and yield. Combine the two without deep stress testing, and you have a bomb. The fact that Blockaid published the attack path means copycats can recreate it. The next target might not even involve Flow. It could be any protocol that lists a long-tail liquid staking token with an E-Mode that assumes correlation. The response should be a pause, not just a patch. The comparison with Tectonic is instructive. When Tectonic hit trouble, the Cronos chain took the drastic step of pausing the entire chain. That was a centralization flag, but it also contained the damage. More Markets did not pause its contracts during the attack. It kept operating until external monitors flagged the issue. I am not arguing that chain-level pauses are the ideal future of DeFi. But in a moment of crisis, an emergency brake can mean the difference between the reserve being half empty and completely dry. The absence of such a brake is not a decentralization win. It is a user protection failure. Building bridges in a fragmented digital frontier means making sure protocols can disconnect quickly when a bridge is burning. There is another blind spot in this story that has not received enough attention. The real accomplice may not be the E-Mode code or the More Markets team. It may be the oracle pricing layer for Ankr bonded LST. In much of my own security work, I have argued that oracle latency and liquidity assumptions are DeFi's Achilles' heel. An asset that trades rarely or in small pools is easy to manipulate. If a protocol relies on a spot price for such an asset, the collateral value can be swayed with just a few trades. The attacker likely understood this and used the temporary price distortion to borrow far more than the underlying value supported. This is not a wild theory. It is the logical result of combining an illiquid asset with a leverage-friendly mode. The protocol needed a circuit breaker. It needed a limitation on how much could be borrowed against Ankr LST. It needed a liquidation mechanism that did not depend on a price that could be moved. None of those safeguards appear to have been in place. The market impact is likely to continue. In the short term, I expect more downward pressure on FLOW as the stolen WFLOW tokens are progressively sold or moved. One of the first signals to watch is any large transfer from the attacker addresses to a centralized exchange. If that happens, it suggests the attacker is preparing to cash out, and the sell pressure will intensify. Another signal is the liquidity depth of WFLOW pools on Flow's native DEX. If the depth drops more than 20% within 48 hours, market makers are leaving and the floor below FLOW becomes softer. The team's response also matters. A clear commitment to freeze stolen funds and publish a compensation plan could rebuild some trust. But if the answer stays in the realm of vague statements, the exodus will continue. There is also a regulatory angle. Attacks of this size do not go unnoticed by authorities. In the United States, agencies like the FBI and DHS routinely track major crypto thefts, especially when funds move into regulated exchanges. Even if More Markets is a non-custodial protocol, the attackers will face friction when trying to off-ramp through KYC-controlled services. That gives the project a narrow but real window to work with exchanges on freezing funds. The longer the stolen assets remain in anonymous or privacy-focused channels, the harder recovery becomes. A coordinated freeze is not just a security operation. It is also a signal to users that someone is watching and willing to act. I have been in this industry long enough to know that events like this feel terminal for the project but avoidable in hindsight. More Markets may survive only if it can isolate the damage, prove that remaining pools are safe, and find a way to compensate victims. That path is steep. The trust deficit is enormous. A protocol that was designed to be non-custodial now has to explain why its custody model failed at the economic layer. The answer is not easy. It requires admitting that innovation without risk modeling is not truly innovation. It is an experiment conducted with other people's money. The broader DeFi ecosystem should treat this as a lesson, not just a headline. If a protocol only copies the most advanced features of Aave without copying the years of risk engineering behind them, it is not building a better bridge. It is building a more fragile one. The next time a small lending market lists an exotic token and turns on E-Mode, the community should ask one simple question: where is the brake? If there is no answer, the safest move is to walk away. The ethical pulse of the decentralized economy depends on that kind of discipline. And the only way forward is to build bridges that are strong enough to hold the weight of trust.