Blockaid said the attacker used the liquid staking token ankrFLOW and E-mode to overborrow from a lending pool.