What happened
At about 06:18 UTC on 31 August 2026, an attacker exploited a flaw in Ankr's ankrFLOW liquid staking contract on Flow EVM and created about 8.6 million ankrFLOW with no backing. The attacker posted that ankrFLOW as collateral on the MORE Markets lending protocol and drained about 15.5 million WFLOW from its reserve, worth roughly $410,000. The attacker realized about $246,000 after slippage.
Early reports put the loss at $9.3 million, but that figure came from Blockaid's first detector estimate, which Blockaid later corrected. Ankr and MORE Markets paused the affected contracts within hours. The Flow Foundation said Flow EVM itself was not exploited, that no MORE Markets or ankrFLOW depositor lost funds, and that it would replace the WFLOW drained from the MORE Markets reserve.
How it happened
- When a user staked into Ankr's
FlowStakingPool, it minted the ankrFLOW certificate for a new bond using the bond's share count instead of the certificate's share count. According to the DeFiHackLabs PoC, this gave about 20% more certificate value than had been deposited. - From attacker EOA
0xa1E4B05F9A0425136045D8fC8A4978B25bB6A7Cc, the attack contract0xA0C2fe72aD9b640994A9c4252F25Fb058DDb3702staked FLOW and received the extra ankrFLOW. - It supplied the ankrFLOW to MORE Markets. There, an E-mode category for wrapped native assets allowed up to 97% LTV, and the attacker borrowed WFLOW against it.
- Each round of stake, supply and borrow returned more WFLOW than it cost, because 0.97 times about 1.2 is greater than 1. The attacker repeated the loop until about 8.6 million unbacked ankrFLOW had been minted and about 15.5 million WFLOW had been taken from the reserve (exploit tx
0x2b2e6ea6cc7dabeec83941abfdc22dd7fa53a58f327af0fccb73a0ed8a3f66c9).
Protocol details
Security review history
- Beosin View report
Evidence
- code Add PoC: AnkrMORE ankrFLOW certificate over-mint via bond staking (DeFiHackLabs PR #1229) github.com
- analysis DeFiLlama defillama.com
- analysis Statement on the Ankr Liquid Staking Exploit (Flow Foundation) flow.com
- analysis Ankr ankrFLOW Exploit Drains $410K From MORE Markets Reserve (SpendNode) spendnode.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
