Ankr (ankrFLOW Collateral Exploit)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5jbCa1…NHxzSummary
Ankr is a multi-chain Web3 infrastructure and liquid staking protocol that has experienced two significant security incidents: a December 2022 insider-enabled infinite-mint exploit of its aBNBc token on BNB Chain (approximately $5 million drained directly, with a secondary $15 million oracle attack on Helio Protocol), and an August 2026 ankrFLOW contract vulnerability that enabled an attacker to mint approximately 8.6 million unbacked ankrFLOW tokens and drain roughly $410,000 in WFLOW (corrected from an initially reported $9.3 million) from the More Markets lending protocol on Flow EVM. In both incidents Ankr's own smart contracts were identified as the vulnerable component, though in the 2026 incident no depositors ultimately lost funds and Flow Foundation committed to replacing the drained reserves.
Connected Entities
7 entities · 60 linked investigations- Ankr→mentioned with→Binance(65%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→Flow(70%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→Uniswap(60%)
- More Markets→mentioned with→Flow(70%)
- More Markets→mentioned with→Aave(70%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→More Markets(80%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→Aave(65%)
- Aave→mentioned with→Uniswap(60%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→Ankr(70%)
- Ankr (ankrFLOW Collateral Exploit)→mentioned with→Binance(70%)
Connected Through
6 shared actors · 585 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Binanceorganization
- ⌂Uniswapprotocol
- □Aaveorganization
- □Floworganization
Timeline(8 events)
1 March 2022
Ankr commissions Beosin audit of FTM Liquid Staking contracts.
Ankr Audit Reports Documentation2 December 2022
aBNBc infinite-mint exploit on BNB Chain: a former Ankr employee allegedly compromised the deployer private key via a supply-chain attack, enabling unrestricted minting of aBNBc tokens. Approximately $5 million in USDC extracted. aBNBc token price collapses ~99.5%.
CoinDesk; Ankr Official Blog2 December 2022
Helio Protocol oracle attack: a separate attacker exploits stale oracle pricing of aBNBc on Helio to borrow approximately $16 million in HAY stablecoin, swapping for ~$15 million BUSD. The attack was enabled by but separate from the Ankr exploit.
CoinDesk; Helio Protocol Exploit — Crypto Times20 December 2022
Ankr publishes after-action report attributing the exploit to a former team member and announcing security improvements including multi-sig upgrade controls and enhanced employee background checks.
Ankr Official Blog — After-Action Report1 May 2023
Ankr commissions Salus security audit of ETH Liquid Staking contracts.
Ankr Audit Reports Documentation1 August 2024
Ankr commissions Halborn security audit of FLOW Liquid Staking (Cadence and EVM) contracts, covering StakingManager, FlowStakingConfig, and AnkrRatioFeed.
Ankr — Liquid Staking Cadence & EVM Audit PDF31 August 2026
ankrFLOW collateral exploit on Flow EVM: attacker exploits vulnerability in Ankr's ankrFLOW Solidity contract to mint approximately 8.6 million unbacked ankrFLOW. Tokens used as collateral on More Markets via Aave V3 E-mode to drain 15.5 million WFLOW (approximately $410,000 at spot price; attacker realizes ~$246,000 after slippage). Blockaid detects and discloses incident. Both Ankr and More Markets pause affected contracts.
Crypto Times; SpendNode; Crypto.news; Metaverse Post31 August 2026
Flow Foundation corrects Blockaid's initial $9.3 million estimate, confirming actual WFLOW value at spot price was approximately $410,000. Foundation commits to replacing drained WFLOW and rebalancing affected liquidity pool. No depositor losses reported.
SpendNode; Crypto.newsDecision Log
- slot 446765140 · hash BmkxJbbZ6kqi5otde4Euuaa6s8RAQTEopKy9tbYGZe34
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 17 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/13/2026, 5:55:40 PM
last updated: 9/13/2026, 5:55:40 PM
5 viewsavoid.net — verified advice for a post-truth world