More Markets Lending Reserve Drained $9.3M: How Ankr Liquid Staking and E-Mode Enabled the Attack

The More Markets exploit demonstrates how attackers systematically identify and chain multiple protocol features to drain funds. The attacker didn't exploit a single smart contract flaw but rather weaponized the interaction between two legitimate mechanisms: Ankr's liquid staking token and the lending protocol's E-mode (efficiency mode).

E-mode in decentralized lending platforms allows users to achieve higher loan-to-value (LTV) ratios when borrowing against correlated assets. This feature is designed to reduce liquidation risk for tightly coupled token pairs. However, when combined with liquid staking tokens that carry their own market risks, E-mode can become a vector for catastrophic loss.

Liquid staking tokens like Ankr's offering represent claims on staked assets. They introduce multiple layers of risk:

• Redemption Risk: The underlying staking position may become illiquid or devalue during market stress.
• Smart Contract Risk: Both the staking derivative and the original staking protocol carry execution risk.
• Oracle Dependency: Liquid staking token prices depend on reliable price feeds that can be manipulated or become stale.

The attacker likely identified that More Markets valued Ankr's liquid staking token too generously within E-mode, allowing the creation of oversized borrow positions backed by assets with degraded collateral quality.

The attack followed this operational chain:

1. Acquire Ankr liquid staking tokens through legitimate markets. 2. Deposit the tokens into More Markets' lending pool. 3. Enable E-mode to access elevated LTV ratios on the staked asset. 4. Borrow WFLOW (likely a Flow blockchain token) in amounts that exceed the actual collateral safety threshold. 5. Withdraw WFLOW from the lending reserve, draining approximately $9.3 million. 6. Exit the position before liquidation mechanisms could activate.

This sequence exploits the time lag between loan origination and risk assessment that exists in most DeFi lending protocols.

From a dirty crypto detection perspective, understanding these exploits is critical for three reasons:

• Tainted Coin Identification: WFLOW tokens that flow out of More Markets' reserves become associated with the exploit. Any wallet receiving these tokens may be flagged as receiving proceeds from criminal activity, depending on jurisdiction.
• Wallet Blacklisting: Exchanges and protocols that integrate with AML tools will identify and potentially freeze accounts holding the stolen WFLOW.
• Source Attribution: Tracking the flow of drained reserves backwards helps identify whether the attacker is a known actor or new threat group.

Tools that monitor Tron and other blockchain wallets for tainted coins can detect when stolen WFLOW enters mainstream liquidity pools or centralized exchanges.

More Markets' E-mode configuration demonstrates why lending protocols must implement strict controls:

• Correlation Matrices: E-mode should only activate for truly correlated assets with proven low liquidation risk. Liquid staking derivatives require higher scrutiny than spot tokens.
• Price Oracle Validation: Multi-source price feeds and staleness checks prevent single-point oracle failure.
• Reserve Buffer Limits: Protocols should cap borrow amounts against reserves, enforcing hard ceilings that prevent total reserve drainage.
• Liquidation Automation: Fast liquidation triggers reduce the time window for attackers to exit underwater positions.

E-mode offers efficiency but concentrates risk. Consider the differences:

| Feature | Standard Mode | E-Mode | |---------|---------------|--------| | LTV Ratio | Conservative (often 70-80%) | Elevated (often 90%+) | | Asset Correlation | Diverse | Correlated pairs only | | Liquidation Risk | Distributed | Concentrated | | Attack Surface | Narrow | Wider (relies on price accuracy) | | Suitable For | All users | Experienced, risk-aware participants |

How can users protect their deposits in lending protocols after an exploit like this?

Monitor your collateral composition and avoid concentrating deposits in protocols that accept highly leveraged liquid staking derivatives. Use multi-signature wallets to control withdrawal authority and enable alerts for unusual account activity.

Will the $9.3M in drained WFLOW be recoverable?

Recovery depends on protocol governance voting and whether the attacker is identified. Some protocols implement insurance pools or governance-backed recovery funds. However, if the attacker successfully laundered the tokens across multiple chains and wallets, recovery becomes legally and technically complex.

How does this relate to AML compliance and tainted coin detection?

Any wallet receiving WFLOW stolen from this exploit will be flagged by sophisticated blockchain monitoring tools. Users moving these tokens to centralized exchanges or regulated custodians face account freezes and regulatory reporting requirements.

Why didn't liquidation stop the attack?

The attacker likely executed the full drain transaction atomically within a single block, before liquidation mechanisms could activate. Liquidation in most protocols operates on multi-block or multi-transaction timescales.

The More Markets drain illustrates fundamental risks in composable DeFi protocols. Users should:

1. Avoid depositing illiquid staking derivatives into protocols with aggressive E-mode configurations. 2. Monitor which assets your collateral depends on and their redemption pathways. 3. Use blockchain monitoring tools to verify that tokens you receive are not associated with known exploits. 4. Diversify across multiple protocols and avoid concentration in single lending venues.

Protocol developers must implement stricter collateral eligibility rules and real-time reserve monitoring to prevent attacker-orchestrated drainage events.

Source: Cointelegraph