More Markets exploit analysis

On 31 August 2026, DeFi lending project More Markets lost $9.3 million after an attacker tricked the lending protocol logic and emptied the project's reserve. The attack was first noticed by blockchain security researchers at Blockaid. More Labs later confirmed they were investigating.

The protocol's public messaging was unusual. While acknowledging the theft, the team wrote in its statement that "Our initial investigation reveals that MORE was not exploited. MORE's contracts are secure. MORE is solvent. The protocol is paused." More Labs also claimed that only 5% of the assets had been moved off the Flow blockchain, without explaining how they planned to prevent the attacker from liquidating more or moving tokens across other bridges. The combination of "we were exploited, and also we were not" was noted by outside researchers. A $9.3 million drain is a drain, regardless of the framing around the cause.

The mechanism itself was not disclosed in detail in the public statements. Blockaid's tweet thread identified the attack but did not publish a step-by-step breakdown. The description "tricked the lending protocol logic" suggests a flaw in how the lending market priced or valued positions, allowing positions to be opened against collateral that the protocol should have rejected or undervalued. The framing of the attack as an exploit of logic rather than an oracle manipulation or a flash loan points toward a business-logic bug in the lending market's accounting. More Markets sits in a small group of 2026 lending exploits — Moonwell, Term Finance, More Markets, Triple-A — where the protocol's own statements and the public experience have diverged.

The figure is the project's own. $9.3 million is the loss attributed by More Labs. No external outlet has produced a contradicting number. The 5% bridged out figure is the project's own framing.

The response was a pause of the protocol and a public statement. No recovery plan has been published, no bounty for returned funds has been offered, and no attacker has been identified by the team. The continued operations of More Labs beyond the pause, and whether the protocol will reopen, has not been publicly disclosed.

Compared with the other DeFi lending exploits in the corpus, the More Markets case sits with Moonwell's $8.7 million MAMO manipulation on Base, Term Finance's $8.5 million governance capture on Ethereum, and Triple-A's $11.8 million wallet drain as another instance of a lending product or payments company losing funds through a business-logic attack in 2026. The common theme is that the affected protocols were active and used, not abandoned or low-liquidity. Three of the four (More Markets, Moonwell, Triple-A) involved centralised or quasi-centralised components where a project could halt operations, and the fourth (Term Finance) was a fully on-chain governance manipulation that played out in public.