Float Protocol has lost about $28,000, or 10.71 ETH, after an attacker used a flash loan to manipulate a Uniswap V3 spot price and exploit how its Hypervisor contracts calculated liquidity provider share values.

SlowMist said on Aug. 31 that the attacker distorted the Uniswap V3 slot0 spot price, causing affected Hypervisor contracts to calculate incorrect LP share values. The blockchain security firm traced the exploit to functions that lacked TWAP or oracle verification and slippage protection.

Using large swaps in the underlying V3 liquidity pool, the attacker manipulated the values returned by currentTick() and getTotalAmounts(). SlowMist said the attacker then repeatedly deposited and withdrew funds while the Hypervisor contracts were working with inflated share values.

The security firm identified the attacker address as 0xaea29218262dc6b0904ca077f6527c49dfd426d9 and the attack contract as 0xb46655eb5b77de277063a75586d1883e951b6c54.

Two vulnerable contracts were listed as 0x85cbed523459b7f6f81c11e710df969703a8a70c and 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153, while the underlying liquidity pool was identified as 0xe8c2036068fc3b0161ee1def0e8d01df4eac0ac.

Float Protocol exploit relied on Uniswap V3 spot price manipulation

The attack centered on how the affected contracts obtained pricing information from the underlying Uniswap V3 pool. SlowMist said large trades allowed the attacker to distort slot0, which contains the pool’s current price and tick information.

Once the pool price had been moved, the manipulation changed the values returned by currentTick() and getTotalAmounts(). The affected Hypervisor contracts used the altered data to calculate LP share values, which allowed the attacker to interact with the contracts while those shares were incorrectly priced.

Flash loans supplied the temporary capital needed to make the large trades. As crypto.news previously explained, a flash loan allows assets to be borrowed without upfront collateral as long as the loan and fees are repaid within the same blockchain transaction.

If repayment does not occur, the entire transaction reverts. The mechanism allows traders to access large amounts of temporary liquidity for arbitrage, collateral swaps and liquidations, but the same liquidity can be used to exploit vulnerable pricing or smart contract logic.

In its analysis of Float Protocol, SlowMist attributed the loss to the contracts relying on a manipulable spot price without checks that could verify it against a time weighted average price or another oracle. Critical functions lacked slippage protection as well, according to the security firm.

Attacker repeatedly used inflated LP share values

SlowMist said the attacker did not stop after changing the Uniswap V3 pool price. Once slot0 had been distorted, the attacker repeatedly deposited into and withdrew from the affected contracts using the inflated LP share calculations.

The sequence allowed value to be extracted while the contracts were relying on the manipulated pool state. SlowMist estimated the final loss at approximately 10.71 ETH, worth about $28,000 when it published the alert.

Similar methods have been used in other DeFi attacks where large temporary trades distort prices or pool ratios before another contract uses the manipulated values.

In July, Allbridge Core was halted after an attacker used a $1.12 million USDC flash loan from Kamino during an exploit that PeckShield estimated caused about $1.65 million in losses.

Onchain Lens said the Allbridge attacker made rapid USDC and USDT swaps to change the ratio inside a stablecoin pool. The attacker then withdrew liquidity at the distorted rate before repaying the flash loan in the same transaction.

Allbridge said some liquidity pools were left temporarily out of balance after the incident and asked users who had profited from unusual pricing to consider returning the funds. The protocol paused Core while investigators tracked assets that had been moved from Solana to Ethereum.

Price data has remained a target in DeFi attacks

Another July incident showed how manipulated pricing information can be used even when the weakness sits outside a protocol’s smart contracts.

Ostium concluded that its $23.75 million USDC exploit originated from compromised off-chain infrastructure. The decentralized trading protocol said an attacker submitted fraudulent BTC/USD price reports that allowed funds to be drained from its OLP liquidity vault.

Ostium said its smart contracts were not the source of that breach. Automated monitoring detected the attack, trading resumed on July 23, and the protocol reported that user collateral had not been affected.

Float Protocol’s incident involved a different mechanism described by SlowMist. The security firm’s analysis placed the weakness inside the affected Hypervisor contracts, where manipulated Uniswap V3 pool data could influence the calculations used to value LP shares.

Flash-loan capital has featured in other attacks this year. A July attack against Swan Treasury used a PancakeSwap flash loan after a compromised off-chain signer key allowed an attacker to purchase STY tokens at a large discount.

The Swan Treasury exploit caused an estimated $625,000 loss. Security analysis found that forged claim and transfer signatures had been created with the protocol’s compromised signer key, allowing roughly 687,000 STY to be purchased at around a 100 times discount before being sold into the STY/USDT pool.

The flash loan supplied capital for the transaction, while investigators attributed the underlying vulnerability to the leaked signer key instead of the protocol’s signature verification logic.

SlowMist points to missing price checks in Float Protocol contracts

For Float Protocol, SlowMist specifically identified the absence of TWAP or oracle validation as part of the attack path.

A TWAP uses observations collected across a period instead of relying solely on the price available at one moment. Spot prices inside liquidity pools can move when a sufficiently large trade changes the ratio of assets, which was the mechanism SlowMist said the Float Protocol attacker exploited.

Crypto.news’ flash loan guide described price manipulation as one of the common ways temporary liquidity can be used against a vulnerable DeFi application. The report noted that the flash loan provides the capital for an attack while the exploitable weakness can lie in price oracles, governance systems or contract logic.

In Float Protocol’s case, SlowMist said large trades were used to distort the Uniswap V3 pool’s slot0 value, which in turn changed currentTick() and getTotalAmounts(). The attacker repeatedly deposited and withdrew while the affected Hypervisor contracts calculated inflated LP share values, resulting in an estimated loss of 10.71 ETH.

By Ben Caselin, CMO at VALR

When crypto prices surge, market commentary tends to fixate on green candles and central bank policy.

Yet, looking beyond the immediate rally reveals a deeper structural shift taking place on-chain. Robinhood’s CEO, Vlad Tenev, skilfully drew global attention to this shift with the launch of the Robinhood Chain, joining a broader movement of major platforms bringing mainstream retail equity investors directly onto native on-chain execution.

Macroeconomic stress provides background fuel, but technological innovation provides the spark. Beneath the price action, four key trends are defining this cycle and reshaping how global wealth is owned, accessed, and stored.

Trend 1: The Retail Ownership Supercycle

At a recent White House summit, Vlad Tenev summarised his platform’s mission in a single word: ownership. Broad asset ownership is essential to a free and prosperous society, and the Robinhood Chain is putting that principle into practice.

Consider novel mechanics like The Index. Holding this single token automatically drops fractional tokenised equities directly into a user’s wallet. In a few clicks, crypto-native traders gain organic exposure to traditional stock portfolios, opening up meaningful diversification beyond crypto alone.

Crucially, this movement is propelled by retail culture. Memes like Popcat, Pepe, and Doge previously proved mass-market retail appetite on tier-one exchanges. Today, that energy is driving on-chain execution. On the Robinhood Chain, Cashcat has emerged as the primary runner and unofficial mascot. Meanwhile, Coinbase listing Basecat on Base, alongside community-led initiatives building around Cate on Solana, points to a broader, multi-chain “cat season.”

These community movements act as the primary onboarding engine for crypto and tokenised real-world asset ownership.

Trend 2: CeDeFi and Infrastructure Convergence

While the Robinhood Chain reignited retail attention on-chain, another milestone was taking shape at the infrastructure level. In previous cycles, centralised exchanges focused on building isolated, walled-garden blockchains and proprietary wallets. This cycle marks a fundamental pivot toward Centralised-Decentralised Finance (CeDeFi): direct liquidity integration.

We see this clearly in two parallel moves: Robinhood integrating Lighter, and VALR integrating Hyperliquid.

If Robinhood’s mandate is ownership for everyday retail investors, VALR’s mandate is global access. By directly plugging into Hyperliquid’s high-performance order book, VALR instantly gave over two million users across Africa and emerging markets seamless access to more than 200 liquid markets across crypto, equities, stock indices, commodities, precious metals, and foreign exchange. 

Trend 3: The Two-Phase Transformation of Money

This expanding global access lays the foundation for a much larger monetary transition. The evolution of money is unfolding in two distinct phases.

Phase 1 is happening right now through stablecoins. While the distant future of fiat currency looks bleak, stablecoins make storing, transferring, and spending value effortless. They are becoming the pragmatic rails for daily users, global enterprises, and international trade.

However, stablecoins merely digitise fiat; they do not protect against chronic currency debasement. When it becomes obvious to everyone that inflation is indeed not transitory, but long-lasting and ever-worsening, Phase 2 will surely take hold. The transition to sound money will be swift and violent, and stablecoins will provide the off-ramp.

Tokenised gold like XAUt and, fundamentally, Bitcoin are natural destinations for this transfer of capital. We are still early.

Trend 4: Agentic Finance and Human Purpose

Alongside monetary evolution sits the rise of agentic finance. Autonomous AI agents and algorithmic execution will soon handle complex market mechanics, liquidity deployment, and execution strategies.

What AI will do to our economies is still unfolding. Personally, I would rather focus on painting and tending a rose garden, letting the world figure out the question of AI and robots. Optimistically, that is the true promise of technology anyway: outsourcing the mundane to machines so humans can focus on service, kindness, creativity, and contemplation.

Beyond Rotation: The Conviction Cycle

Speculative token-hopping and short-term player-versus-player trading have defined much of recent crypto culture. Yet, set against this culture of endless rotation, a simple phrase is taking root: believe in something.

The platforms, protocols, and participants that endure in this next cycle will not be those chasing fleeting market trends. In addition to ownership and access, this cycle will belong to conviction.

About the author

Ben Caselin is Chief Marketing Officer at VALR.com, Africa’s largest crypto exchange and infrastructure provider by trade volume. Headquartered in Johannesburg, VALR serves over 1900 corporate and institutional clients and more than 1.9 million traders worldwide. Drawing on years of experience in the digital asset space, mostly in Hong Kong, the UAE and now South Africa, Ben focuses primarily on driving the adoption of bitcoin in emerging markets and advocates for an approach to innovation on the basis of spiritual principles. 

Decentralized exchange Hyperliquid and memecoin launchpad Pump.fun reportedly accounted for nearly 90% of the record $638 million in token buybacks carried out by cryptocurrency projects so far in 2026.

Crypto projects spent a record $638 million to repurchase their own cryptocurrencies year-to-date, up from $545 million during the same period in 2025 and $366,000 in 2024, according to Allium Labs data cited by the Financial Times in a Monday report. Of the $638 million, Hyperliquid accounted for roughly $370 million and Pump.fun for nearly $200 million.

Token buybacks are similar to share buybacks by publicly listed companies, which buy back their own stock to support their share prices and increase returns for existing shareholders.

While token buybacks are still rare in the crypto industry, more companies are taking advantage of the move. On Thursday, the Ethena Foundation opened a vote on a fee-switch proposal under which 95% of the net revenue paid to it from Ethena’s core business lines would be used to repurchase Ethena (ENA) tokens. The ENA token rose 10.7% on the day after the proposal.

Crypto project spend on token buybacks, year-to-date leading up to Aug. 25. Source: Allium Labs, Financial Times.

HYPE, PUMP outperform crypto market as buybacks boost token valuations

The Hyperliquid (HYPE) and Pump.fun (PUMP) tokens have outperformed the broader cryptocurrency market decline so far in 2026.

HYPE rose 145% and PUMP rose 109% year-to-date, while Bitcoin’s (BTC) price fell 10% and the total crypto market capitalization declined by 11.9% during the same period, according to TradingView data.

HYPE, PUMP, BTC, Total Crypto Market Cap, year-to-date chart. Source: Cointelegraph/TradingView

Hyperliquid spends about 99% of its revenue on token buybacks. Hyperliquid reported $169 million in second-quarter revenue on Aug. 6 and directed $141 million toward HYPE buybacks. 

Related: Crypto generated about 1% of Webull’s record $198M Q2 revenue

Pump.Fun allocates about 50% of its net protocol revenue for token repurchases. The memecoin launchpad currently boasts $420 million in annualized revenue, based on the average daily revenue of the past 90 days.

Crypto valuations could double in the next two years as protocols increasingly use revenue to fund token buybacks and burns, hence returning more value to investors, said Bitwise chief investment officer Matt Hougan earlier in August.  

Magazine: Why Ray Dalio says Bitcoin can’t replace gold

Bitcoin (BTC) heads into September still battling key resistance as markets flip hawkish on Federal Reserve policy.

Key points:

• Markets see a 60% chance of the Fed hiking interest rates in September, with jobs data due this week.
• Oil has experienced renewed volatility amid fresh US strikes on Iran and an unprecedented US-Venezuela oil-supply deal.
• Bitcoin remains under a crucial patch of resistance below $86,000 heading into the August monthly candle close.

September rate hike bets return after Jackson Hole

The coming week will bring the release of multiple US employment indexes, each likely to shape expectations for policy changes from the Federal Reserve.

The Fed is already in the spotlight after last week’s Jackson Hole economic symposium, which featured its first keynote speech from new chair Kevin Warsh. Warsh remained characteristically tight-lipped on policy cues, describing forward guidance — a fixture of Fed PR for decades — as having “overstayed its welcome.”

On inflation, Warsh described current data as too high, despite July’s lower-than-expected results for the Consumer Price Index (CPI) and Personal Consumption Expenditures (PCE) index.

“Each of these broad inflation measures have fallen significantly from their highs of a few years ago, but progress through the past couple of years has been more modest, and while this summer’s PCE and CPI readings were better than expected, they do not tell me that underlying trends have meaningfully improved,” he said.

Markets responded with increased expectations of interest-rate hikes, reverting to majority odds for a 0.25% hike at the Fed’s September meeting, per data from CME Group’s FedWatch Tool. At the time of writing, these odds stand at just below 60%, up from 41.4% last week.

Fed target-rate probability comparison for September FOMC meeting (screenshot). Source: CME Group

Rates expectations could be tempered, however, by labor-market numbers. Friday will see August nonfarm payrolls data released. The economy is expected to have added 50,000 jobs last month, compared to a loss of 23,000 in June.

Private-sector employment numbers will precede nonfarm payrolls on Wednesday, followed by initial jobless claims on Thursday. 

“All eyes are on the labor market,” trading resource The Kobeissi Letter summarized in commentary on X, noting that this would form the last slew of jobs data before the September rate decision.

Kobeissi flagged major downward revisions to employment numbers, with weak labor-market conditions forming a potential hurdle to Fed policy tightening. Citing data from the Bureau of Labor Statistics (BLS), it reported another 79,000 jobs removed in the 12 months through March this year.

“This follows last year’s record -911,000 revision and marks the 4th consecutive annual downward adjustment, matching the streak that ended in 2010 after the 2008 Financial Crisis,” it added, describing the labor market as being “weaker than initially reported for years.”

US employment data revisions. Source: The Kobeissi Letter on X.com

Oil spikes on US-Iran escalation

Oil markets are at the forefront of macro volatility as the week begins thanks to a combination of geopolitical catalysts.

Renewed US strikes on Iran sent Brent crude back above $90 per barrel on Monday, nearing its highest levels in a week. US WTI crude passed $85 per barrel, and was up 2.5% on the day at the time of writing.

CFDs on Brent crude oil one-day chart. Source: Cointelegraph/TradingView

European stocks came under pressure as a result of the events, with Germany’s DAX down 0.7%. US president Donald Trump implied that Iran’s Kharg Island oil hub was once more a target. In a post on Truth Social, Trump uploaded an AI-generated video that appeared to show the bombing of oil infrastructure, describing the island as “being blown to smithereens.”

DAX one-day chart. Source: Cointelegraph/TradingView

The strikes followed news of a major energy deal granting the US significant control of Venezuela’s oil reserves. Numbers from Venezuela’s interim president Delcy Rodriguez quoted by CNBC and others referenced a daily oil-output target of 1.5 million barrels, with total reserves involved at 65 billion barrels, currently worth around $5.4 trillion.

In a Truth Social post, Trump described the takeover as the “biggest oil deal in history.”

Bitcoin battles multiple 50-week trend lines

Bitcoin saw late sell pressure into Sunday’s weekly close, with a brief trip below its 50-week exponential moving average (EMA) at $77,269, per data from TradingView. 

Price defended the trend line, which we had previously flagged as important support, for a second consecutive week. In the wake of its recent rally, BTC had managed to reclaim the moving average with a weekly close for the first time since November 2025.

BTC/USD one-week chart with 50 EMA. Source: Cointelegraph/TradingView

In his latest market observations on X, Rafael Schultze-Kraft, cofounder of crypto analytics platform Glassnode, drew attention to the equivalent simple moving average (SMA) at $80,307. Here, BTC/USD still lacks a reclaim on the weekly time frame — something which has preceded additional price upside in the past, he showed.

BTC/USD chart with periods above and below 50-week SMA. Source: Rafael Schultze-Kraft on X.com

Monthly close faces stiff resistance

Heading into the August monthly close, Bitcoin bulls face a key test as monthly gains for BTC/USD hover near 25%.

BTC/USD monthly returns (screenshot). Source: CoinGlass

Despite the biggest crypto short liquidation event ever recorded, buyers have so far failed to reclaim key resistance above $80,000, analysis warns. 

“Bitcoin is still hovering beneath the Macro Downtrending resistance, having upside wicked briefly beyond it,” trader and analyst Rekt Capital summarized about the current status quo in his latest analysis on X. 

“Still the pivotal resistance and by staying below it, Bitcoin continues its series of Macro Lower Highs.”

BTC/USD one-month chart. Source: Rekt Capital on X.com

Rekt Capital argued that a breakout above this resistance would have major implications for the four-year BTC price cycle, as it would mean that its latest bear market would be shorter than those before it.

Beyond the trend line, however, additional resistance has already formed thanks to thickening ask liquidity on exchange order books. As Cointelegraph reported, this extends to $86,000, thus requiring even more buy-side momentum to effect a lasting breakout.

“Every overhead structure we track now sits between $81K and $86K; that band is where the recovery’s demand meets its test,” Glassnode wrote in research last week.

Larger buyers seen as pivotal to BTC price upside 

Glassnode calculated that 1.05 million BTC owned by long-term holders have a cost basis between $83,000 and $86,000. Long-term holders refer to wallets holding a given amount of BTC without selling for six months or more.

Related: Supply absorption ‘key question’ as Bitcoin fails to reclaim $80K: Analysis

BTC supply distribution by wallet cohort. Source: Glassnode

In additional findings this week, onchain analytics platform CryptoQuant drew attention to the potential impact of large-volume investors going into September. These entities, its data showed, were behind buyer appetite this month, while smaller investors took profit or exited the market after their holdings returned to breakeven.

“From 1–30 August, wallets with 100+ BTC added about 60,000 BTC. Wallets with 1–100 BTC sold about 33,000. Wallets under 1 BTC sold about 14,000,” it wrote in a blog post on Monday. 

“That split is the month. Large holders absorbed the breakout. Smaller holders used the rally as an exit.”

Bitcoin accumulation data by wallet cohort (screenshot). Source: CryptoQuant

CryptoQuant added that the view of large-investor accumulation would require reassessment should those entities start selling recently acquired supply below $80,000.

Polymarket has strengthened its trade surveillance and investigation systems ahead of the U.S. midterm elections, as the prediction market operator faces scrutiny over insider trading and American access to its international platform.

Reuters reported on Aug. 31 that Polymarket’s new global head of investigations and intelligence, Shana Bautista, said the company has systems capable of identifying unusual trading activity as election-related markets attract closer attention.

“I’m confident that I’m able to get the resources and the support I need,” Bautista told Reuters in her first interview since joining Polymarket in June. “I can tell you that we have the systems in place to be able to identify anomalous activity when the midterms do come.”

Polymarket prepares surveillance systems for U.S. midterms

Bautista, a former FBI investigator and Coinbase analyst, is overseeing Polymarket’s investigative work as U.S. lawmakers examine whether prediction markets could provide a venue for trading based on sensitive government or political information.

Congress has already moved toward restricting lawmakers from participating in such markets. Crypto.news previously reported that Rep. Bryan Steil was seeking to include a prediction market trading ban in a proposal that would restrict stock trading by members of Congress and their families.

Steil said lawmakers should not be trading contracts tied to elections or public policy. His proposal followed a unanimous Senate vote in April barring senators and their staff from trading on prediction markets such as Polymarket and Kalshi.

Questions over insider access have extended beyond lawmakers. A study published earlier this year examined how restrictions could affect the information produced by prediction market prices, arguing that enforcement should distinguish between traders who possess private information and participants who can influence the outcome of an event.

The research found that a blanket ban could reduce the information available in market prices, while recommending stronger penalties for participants capable of changing an outcome themselves. The findings came as Polymarket and Kalshi faced increased insider trading scrutiny from regulators and lawmakers.

Polymarket says its surveillance program uses several sources of information to detect potentially malicious activity. Bautista said the company combines machine learning, blockchain analytics, trade surveillance, open-source research and third-party services.

A new webpage will provide more public information about those controls and explain how the company works with law enforcement, according to a Polymarket spokesperson cited by Reuters.

“The market integrity program itself is not new, but what we’re putting on the record now is considerably more detail about how it operates,” Bautista said.

Blockchain activity gives Polymarket investigators a trading trail

Trades on Polymarket’s international platform settle on a blockchain, leaving transaction records publicly visible even when the people controlling individual wallets remain anonymous.

Critics have argued that pseudonymous wallet-based trading can create opportunities for misconduct. Bautista told Reuters that blockchain records can provide investigators with useful information about trading behavior and movements of funds between addresses.

Polymarket says it has referred more than 100 cases to law enforcement.

One involved a wallet linked to a U.S. soldier who prosecutors say used classified information to trade contracts concerning the capture of Venezuela’s Nicolás Maduro.

A federal judge in August paused the Commodity Futures Trading Commission’s civil case tied to the soldier while a related criminal proceeding continues. Prosecutors allege that about $409,881 was earned through 13 Venezuela-related Polymarket trades, according to the CFTC case proceedings.

The defendant has pleaded not guilty and challenged whether the prediction contracts involved in the case legally qualify as swaps.

Bautista said other referrals involved possible insider wagers concerning U.S. military actions in Iran. Reuters reported earlier in August that several trades linked to military developments had raised questions over whether some participants possessed information that was not publicly available.

Political concern has extended to federal employees with access to sensitive information. More than 40 Democratic lawmakers previously asked the CFTC and the U.S. Office of Government Ethics for guidance restricting federal employees from using nonpublic information to trade prediction contracts.

Their letter raised concerns involving political events, military developments and other contracts where government employees could have access to information before the public.

Polymarket says controls block most U.S. users

Keeping American users away from Polymarket’s international platform remains another enforcement issue for the company.

The CFTC reached a settlement with Polymarket in 2022 after finding that it had offered event-based binary options contracts without registering with the regulator. Polymarket agreed to pay a $1.4 million civil penalty and wind down markets that did not comply with U.S. law.

The settlement required the company to prevent U.S. customers from using its international operation.

Bautista told Reuters that she believes Polymarket’s current systems are sufficient to stop the vast majority of American users from accessing the international platform.

“It is difficult at scale to be able to consistently and always evade all of the guardrails we have,” Bautista said. “I do not see it being a really prevalent issue.”

Blockchain research has raised questions over how effectively those restrictions work.

On-chain research firm Allium estimated that U.S.-linked wallets traded about $571 million in political contracts on Polymarket over a one-year period despite the restrictions. The United States represented the largest national group identified in its analysis.

Allium cautioned that it could assign country labels to only a small share of political-market wallets and described its estimates as directional because blockchain activity cannot establish the identity or physical location of every trader.

The findings renewed attention on U.S. wallet activity on Polymarket’s international venue.

Federal scrutiny of the company has changed under President Donald Trump’s administration. Regulators dropped an investigation into whether Polymarket had breached its 2022 settlement, and CEO Shayne Coplan said at the time that the company had been cleared of wrongdoing.

Polymarket has taken a separate route to serve American customers through a regulated exchange.

The company returned to the U.S. market after acquiring a CFTC-registered exchange last year, creating an operation separate from the international blockchain platform that remains closed to U.S. users.

State lawsuits target prediction market sports contracts

While federal regulators oversee event contracts under commodities law, prediction market companies are fighting a separate series of disputes with state authorities over sports-related contracts.

Several states have argued that sports event contracts offered by prediction market platforms amount to gambling products that require state licenses.

Prediction market companies have disputed that position, maintaining that qualifying event contracts fall under federal commodities regulation and CFTC jurisdiction.

The conflict has produced lawsuits seeking to stop prediction market operators from offering sports contracts without state gambling licenses.

Polymarket’s regulated U.S. operation and its international platform remain separate. The international service uses blockchain-based settlement and wallet trading, while the U.S. exchange operates within the CFTC regulatory framework.

Bautista told Reuters that Polymarket intends to provide more public detail about its surveillance program as the midterm elections approach, including how the company uses blockchain analytics, machine learning and trade monitoring to identify suspicious activity and refer cases to law enforcement.

Flow-based DeFi lending protocol More Markets suffered a reserve drainage of about $9.3 million in digital assets, according to security firm Blockaid. Blockaid said the attacker extracted roughly 15.5 million Wrapped Flow (WFLOW) tokens from the protocol’s mFlowWFLOW lending reserve on the Flow EVM network.

The incident, outlined in a Monday post on X by Blockaid (see Blockaid’s report), highlights how lending platforms that support liquid staking tokens can be vulnerable when borrowing mechanics are combined with liquidity and efficiency-mode features.

Key takeaways

• $9.3 million worth of WFLOW was reportedly drained from More Markets’ mFlowWFLOW lending reserve on Flow EVM.
• Blockaid attributes the attack to the use of ankrFLOW (Ankr Staked FLOW) and Aave V3 E-mode overborrowing conditions.
• The exploitation contributed to total crypto hack losses of $139.7 million in August 2026, per DefiLlama.
• While August thefts remain the third-largest month of 2026 so far, they are far below $254 million stolen in July, according to DefiLlama data.
• More Markets has not publicly confirmed the incident or disclosed potential user losses as of publication.

How Blockaid says the Flow EVM exploit worked

In its analysis, Blockaid linked the theft to the borrowing and collateral logic used inside the protocol. The security firm said the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, together with E-mode—a feature associated with Aave V3.

E-mode (short for efficiency mode) is designed to increase borrowing power for certain asset pairs when their prices are expected to move together. Blockaid’s explanation focuses on the relationship between a liquid staking token and its underlying asset: if the tokenized staking position (ankrFLOW) behaves closely to the underlying FLOW, then the protocol may assign more favorable risk parameters under E-mode.

According to Blockaid, the attacker leveraged those assumptions to overborrow from the mFlowWFLOW reserve and drain liquidity. Blockaid’s public figures point to 15.5 million WFLOW tokens being pulled from the reserve and valued at about $9.3 million in the incident.

What the reserve drainage means for DeFi risk management

Incidents like this tend to raise a difficult question for DeFi lenders: how to balance the capital efficiency benefits of supporting liquid staking derivatives against the edge cases that can emerge when borrowing rules are pushed to their limits.

E-mode is meant to reflect a correlation between assets, but the way correlation is enforced on-chain can be exploited if attackers can find a path where collateral valuation, liquidity availability, or borrowed asset dynamics allow them to extract value faster than the system can correct risk exposure. In this case, Blockaid specifically cited E-mode plus the use of a liquid staking token to achieve an outcome that resulted in reserve depletion.

For users, the immediate practical takeaway is less about the specific tokens involved and more about the mechanics. When a lending market supports efficiency-mode pairings between liquid staking tokens and their underlying assets, traders and depositors should watch for whether the platform can demonstrate robust controls under volatile or abnormal borrowing conditions.

Hack totals for August remain elevated—yet down from July

The Flow EVM theft adds to the broader picture of crypto security losses in 2026. Blockaid’s report comes as overall monthly totals have remained high.

DefiLlama data shows that losses from cryptocurrency hacks reached $139.7 million in August, making it the third-largest month by value stolen so far in 2026. Even so, August’s total represents a substantial drop from $254 million stolen during July, according to the same DefiLlama dataset on hacks (see DefiLlama’s hacks dashboard).

That comparison matters for risk perceptions. A decline from one peak month does not imply fewer vulnerabilities overall—it may instead reflect differences in the types of exploits that surfaced, the speed of mitigation once attacks begin, or the particular concentration of high-value DeFi targets in each month.

Other network disruption: Cronos pauses after Tectonic exploit

Blockaid’s account of the More Markets drainage arrives amid other DeFi-related security actions. On Sunday, Cronos halted its network after a reported $75 million exploit targeting the DeFi lending protocol Tectonic, according to earlier coverage from Cointelegraph (see that report).

Taken together, the two incidents underscore how quickly lending infrastructures can draw attention from attackers and how governance and incident response—whether pausing a chain or adjusting protocol controls—can become a determining factor in whether additional losses are contained.

Unanswered questions for More Markets users

As of the time of publication, More Markets had not publicly confirmed the incident or disclosed whether any user losses occurred. Cointelegraph attempted to obtain additional details by contacting Blockaid, but received no response by publication. The outlet also was unable to reach More Markets for comment.

Readers should watch for a formal More Markets statement, any post-mortem describing which reserve controls were bypassed, and whether the platform (and related integrations) plans to adjust E-mode or liquid staking collateral parameters to reduce the chance of a repeat.