The Ankr ankrFLOW Exploit: From Counterfeit Collateral to Railgun

EXECUTIVE SUMMARY

On 31 August 2026, a mint-ratio failure in Ankr’s Flow liquid-staking system allowed an attacker to create economically unbacked ankrFLOW and use it as collateral inside MORE Markets. The exploit was executed through one atomic Flow EVM transaction and removed 15,488,124.15 WFLOW from the lending reserve.

The first public alert valued the incident at roughly $9.3 million. That number was a stale detector valuation, not the confirmed loss. Flow later described the reserve loss as approximately $410,000, while on-chain tracing shows that the attacker ultimately consolidated and shielded 246,694.037262 USDC on Ethereum.

The most important finding is therefore not simply the amount. MORE Markets’ oracle could price ankrFLOW correctly and still underwrite counterfeit collateral, because the issuer-side mint invariant had already failed. Collateral risk includes the integrity of the asset’s issuance mechanism, not only market price.

INCIDENT MECHANICS

The exploit transaction was submitted at 06:18:52 UTC from 0xa1E4B05F9A0425136045D8fC8A4978B25bB6A7Cc to the helper contract 0xA0C2fe72aD9b640994A9c4252F25Fb058DDb3702.

Independent transaction reconstruction reports that the helper minted 51,942,364.75 ankrFLOW under an incorrect conversion path. Approximately 8.65 million of that output was economically unbacked. The attacker swapped part of the minted position for WFLOW, deposited 13.3076 million ankrFLOW as collateral, and borrowed 15,488,124.15 WFLOW from MORE Markets.

The chain-level call path is consistent with a single atomic strategy: create the mispriced collateral, have the lending market accept it, and remove the reserve before any intervening control can react.

WHAT THE FLOW EVM TRANSACTION PROVES

The public Flow EVM transaction record directly confirms the sender, helper contract, block 76986328, timestamp, and the WFLOW and ankrFLOW transfer logs. It also identifies the ankrFLOW/WFLOW pool at 0xbB577ac54E4641a7e2b38Ce39e794096CD11A639, the ankrFLOW token at 0x1b97100eA1D7126C4d60027e231EA4CB25314bdb, and the bond token at 0xd6Fd021662B83bb1aAbC2006583A62Ad2Efb8d4A.

Exploit transaction:

0x2b2e6ea6cc7dabeec83941abfdc22dd7fa53a58f327af0fccb73a0ed8a3f66c9

Attacker EOA:

0xa1E4B05F9A0425136045D8fC8A4978B25bB6A7Cc

Helper contract:

0xA0C2fe72aD9b640994A9c4252F25Fb058DDb3702

The $9.3M, $410K and $246.7K figures measure different layers. The first was an automated gross valuation of the reserve movement. The second is the corrected protocol-level reserve loss. The third is the amount that can be followed into a completed Ethereum laundering path. They should not be added together or presented as competing estimates of the same quantity.

EVIDENCE LEDGER

The following ledger keeps the incident mechanics separate from the later proceeds trail. Full identifiers are listed in the article so each anchor can be checked independently.

THE REALIZED-PROCEEDS TRAIL

SentinelTX traced the attacker’s realized proceeds across Flow EVM and Ethereum. The same attacker address was used as the destination on Ethereum.

A Relay/LiFi route converted 89,125.770791 PYUSD0 on Flow EVM into 88,373.568536 DAI on Ethereum. Additional receipts delivered 96,647.730149 USDC through Relay.link and 37,851.215317 plus 23,821.523260 USDC through StargatePoolUSDC.

The attacker then used the Velora smart contract at 0x6a000f20005980200259b80c5102003040001068 to convert the 88,373.568536 DAI into USDC. The four Ethereum receipts consequently reconciled to exactly 246,694.037262 USDC.

That entire amount moved in transaction 0xfc0878bf80cd9353ddda9974364582086f4a5558ea9638b960ea8882313b7d36 to the previously unfunded relay wallet 0x28ed3280d0689456e349b68a62cf00eaa0715b4d. The attacker also supplied that wallet with 0.002933 ETH for gas.

The relay wallet then sent 616.735093 USDC and 246,077.302169 USDC—again totaling exactly 246,694.037262 USDC—to the Railgun proxy at 0xfa7093cdd9ee6932b4eb2c9e1cde7ce00b1fa4b9 in transaction 0xd60d3264e07add714933cdb004f090f4559f64297fda64a7978fb35fcb7dd6bf.

No centralized-exchange deposit was observed. The trace ends at Railgun shielding. Any recipient or withdrawal after that point is unknown and should not be inferred.

WHAT THE MECHANICS DIAGRAM MEANS

The diagram above shows why the lending market could fail even if its oracle feed was functioning as designed. Once the issuer produced unbacked ankrFLOW, a correct market price became the wrong economic value for that specific collateral. E-mode then magnified the amount that could be borrowed against it.

ATTRIBUTION BOUNDARY

SentinelTX found no reliable identity label for the attacker EOA, the helper contract, the relay wallet, or 0xac9f360ae85469b27aeddeafc579ef2d052ad405, which received 0.002194 ETH left over from the relay wallet. The EOA and relay wallet are operationally linked because the attacker supplied both the full USDC amount and gas, but this does not identify a person or organization.

The current observed balances are effectively empty: the attacker EOA retains only 0.000346 USDC on Ethereum, and the relay wallet retains approximately 0.000521 ETH. A later 1 CAT transfer was classified as spam and excluded from the proceeds graph.

RESPONSE AND RECOVERY

The most useful investigative leads are off-chain bridge records and future privacy-pool exits. Relay, LiFi and Stargate may retain routing, solver, API or session records tied to the bridge transactions. Investigators should also preserve the Flow EVM deployer and initial gas-funding history for the attacker and helper contract. A future Railgun unshield event with correlated size, timing and gas behavior could provide a new cluster lead.

No CEX deposit means there is no presently identified custodial account to freeze. Recovery prospects are therefore low unless bridge metadata or a later unshield creates an attributable endpoint.

EVIDENCE LIMITS

Confirmed on-chain facts in this report are anchored to the Flow EVM exploit record and the Ethereum receipts, swap, relay-wallet transfer and Railgun deposit. The exact composition of the difference between the ~$410K reserve loss and the $246,694 realized proceeds remains unresolved. No natural person, company or country has been attributed to the attacker.

CONCLUSION

This was a compact, pre-planned laundering path: atomic collateral creation and borrowing on Flow EVM, multiple bridge routes into Ethereum, immediate asset consolidation, one burner wallet and full privacy shielding. The protocol lesson is equally compact. A lending market must validate the issuance integrity of accepted collateral, because a healthy oracle cannot repair a broken mint invariant.

SOURCES

Flow EVM transaction record:

https://evm.flow.com/api/v2/transactions/0x2b2e6ea6cc7dabeec83941abfdc22dd7fa53a58f327af0fccb73a0ed8a3f66c9

Technical reconstruction:

https://sigintzero.com/blog/more-markets-15-5m-wflow-ankrflow-mint-ratio-flaw

Reporting cross-check:

https://beincrypto.com/more-markets-exploit-flow-evm-wflow/

SentinelTX case: CASE-20260902-0001, investigated 3 September 2026.