A DeFi exploit on Flow's More Markets protocol initially reported as a $9.3 million loss has been revised to approximately $410,000 in actual realized proceeds, exposing a critical gap between how security firms initially report hack damages and what attackers actually walk away with. The discrepancy highlights an often-overlooked reality in crypto security: the difference between a token's theoretical spot price and what an attacker can actually sell it for in real market conditions.

What Happened in the More Markets Exploit?

On August 31, 2026, an attacker exploited a vulnerability in Ankr's ankrFLOW liquid staking contract, a token designed to represent FLOW that users have deposited through Ankr's staking service. The attacker was able to create approximately 8.6 million ankrFLOW tokens without any actual FLOW backing them, according to Flow's official statement.

The attacker then supplied this unbacked ankrFLOW as collateral on More Markets, a lending protocol on Flow, and borrowed 15.5 million WFLOW (wrapped FLOW tokens) against it. More Markets' E-Mode, or Efficiency Mode, a lending feature that allows higher borrowing capacity for correlated assets, treated the fake ankrFLOW as legitimate collateral because it appeared valid on the blockchain.

The core issue was a broken assumption: ankrFLOW and WFLOW should be economically connected because ankrFLOW represents staked FLOW while WFLOW is simply FLOW wrapped for use in DeFi applications. But the attacker's ankrFLOW had no backing, making the collateral worthless despite appearing legitimate to the lending system's automated checks.

Why Did Initial Damage Reports Get the Numbers So Wrong?

Blockaid, a blockchain security firm, initially reported the exploit as a $9.3 million loss based on the 15.5 million WFLOW tokens removed from the protocol. However, this figure was based on an early detector estimate rather than a verified calculation of the tokens' actual market value.

When Blockaid recalculated using FLOW's spot market price, the 15.5 million WFLOW was worth only approximately $410,000. But even that figure doesn't reflect what the attacker actually obtained. After selling the tokens into limited liquidity, the attacker realized approximately $246,000 to $250,000 in proceeds, according to Flow's statement and Blockaid's corrected assessment.

This creates three distinct figures that security researchers and news outlets must carefully distinguish:

• Tokens Removed: 15.5 million WFLOW was drained from the More Markets reserve.
• Theoretical Value: Those tokens had a spot market value of approximately $410,000 based on FLOW's price at the time.
• Realized Proceeds: The attacker actually obtained approximately $246,000 to $250,000 after selling into limited liquidity.

The gap between theoretical and realized value exists because crypto markets, especially for less liquid tokens, cannot absorb large sell orders at the listed price. When an attacker dumps millions of tokens at once, the price drops significantly, and they receive far less than the spot price would suggest.

How Do Liquid Staking Tokens Create These Vulnerabilities?

Liquid staking tokens like ankrFLOW are designed to improve capital efficiency in DeFi. Normally, when users stake FLOW through Ankr, they receive ankrFLOW representing their staked position. They can then use ankrFLOW as collateral in lending markets or liquidity pools while their underlying FLOW continues earning staking rewards.

This composability depends on one critical assumption: the liquid staking token must remain properly backed by the underlying asset. In this case, the Ankr contract had a vulnerability that allowed an attacker to mint ankrFLOW without depositing the FLOW that should have supported it. The attacker exploited this to create unbacked tokens that appeared legitimate to other protocols.

Similar dependency failures have affected other DeFi protocols. During the Tectonic exploit on Cronos, an illiquid token's manipulated price became central to the reported impact. The Rhea Finance exploit demonstrated how misleading liquidity and pricing information can spread losses across connected protocols.

Steps to Understand DeFi Exploit Reporting and Risk

• Distinguish Token Movements from Financial Proceeds: When a security firm reports tokens removed from a protocol, verify the actual market value and consider how much liquidity exists to sell those tokens. A large token dump into thin liquidity will realize far less than the spot price suggests.
• Check Whether the Underlying Network Was Compromised: Flow emphasized that the incident was not an exploit of the Flow blockchain, Flow EVM, or Flow's tokenomics. The vulnerability was in Ankr's Solidity smart contract. This distinction matters because it affects whether the entire network's security is in question or just a single application.
• Evaluate Collateral Assumptions in Lending Protocols: Lending systems like More Markets rely on the assumption that collateral represents real economic value. When a dependency like a liquid staking token fails, the collateral can become worthless even if the lending protocol's code executes perfectly.
• Monitor Liquidity Conditions for Affected Tokens: Protocols accepting tokens as collateral should verify not just that the tokens exist on-chain, but that they have sufficient liquidity to be converted to stable value if needed.

What Happens Next for Affected Users?

Flow has committed to replacing the funds removed from the More Markets WFLOW reserve and will work with Ankr to restore balance to the affected ankrFLOW/WFLOW liquidity pool. ankrFLOW staking and More Markets lending will remain paused until Ankr deploys a contract upgrade addressing the root cause.

Flow stated that no FLOW holders were affected and that neither More Markets depositors nor ankrFLOW depositors had lost funds. Users with assets in either protocol do not need to take immediate action; their assets are expected to become retrievable after the protocols safely resume operations.

This response could prevent the incident from becoming a long-term solvency problem for More Markets. However, previous exploits have shown that technical containment is only the first stage of recovery. Protocols must also restore liquidity, compensate affected positions, and rebuild user confidence. Drift's recovery plan with Tether focused on recapitalization and user compensation after a major exploit, while Radiant Capital eventually began sunsetting operations after struggling to recover from the longer-term consequences of its security incident.

Why Do These Dependency Failures Keep Happening?

DeFi applications are composed of interconnected contracts, tokens, price feeds, liquidity pools, bridges, and external protocols. A failure in one dependency can move through the system even when the receiving application executes exactly as programmed. The KelpDAO rsETH crisis showed how risks connected to a liquid staking asset can spread into lending markets and create bad debt concerns.

The wider industry has already seen how oracle manipulation, fake liquidity, and weak collateral assumptions can produce losses without directly breaking a protocol's core contracts. Attackers increasingly target the economic assumptions connecting protocols rather than searching only for conventional coding errors.

Onchain tracing remains essential for separating token movements from actual financial proceeds. Investigators can reconstruct contract calls, state changes, and fund movements to determine how an attack unfolded and what value the attacker ultimately retained. This detailed analysis is what revealed the gap between the initial $9.3 million estimate and the actual $246,000 to $250,000 in proceeds.

The incident was contained without affecting the Flow network itself, and Flow has committed to restoring the drained reserve. The next critical step will be Ankr's contract upgrade and a detailed post-mortem explaining how the unbacked ankrFLOW was created, why existing controls did not stop it, and what safeguards will prevent the same dependency failure from spreading to other protocols.