A vulnerability in Ankr’s ankrFLOW liquid-staking contract allowed an attacker to create approximately 8.6M unbacked ankrFLOW. The attacker supplied the unbacked tokens as collateral on MORE Markets and borrowed approximately 15.5M WFLOW from its lending reserve. MORE Markets’ contracts operated as designed; Flow identified the originating vulnerability as Ankr’s ankrFLOW contract

An attacker exploited a vulnerability in Ankr’s ankrFLOW liquid staking contract to mint approximately 8.6 million unbacked ankrFLOW tokens, then used them as collateral with More Markets’ E-mode to drain about 15.5 million WFLOW (~$410,000 at spot) from the lending reserve. The attacker realized roughly $246,000 after slippage. The Flow Foundation stated the root cause was in Ankr’s Solidity contract, not Flow EVM or More Markets.