Nothing Was Hacked. Moonwell Still Lost $8.7 Million

Moonwell, a lending protocol on Base, lost roughly $8.7 million on Thursday to an attacker who never found a bug. There was no reentrancy, no unchecked call, no forgotten access modifier. The contracts behaved correctly from the first block to the last. The attacker simply took a token almost nobody trades, made it briefly expensive, walked it into the lending market as collateral, and borrowed real assets against the number the protocol read back.

The Block first reported the incident on Aug 27, as PeckShield, CertiK and Blockaid independently flagged the same mechanism. Moonwell said it was investigating an issue affecting the MAMO market on Base and, as a precaution, set borrow caps for every Core Market on Base to "1 wei" — a value so small it functionally halts new borrowing across the whole deployment. Supply caps for MAMO and WELL were set to the same. Moonwell did not respond to The Block's request for comment.

How you rob a lending market without touching its code

Every lending protocol runs on one question asked continuously: what is the borrower's collateral worth right now? Answer honestly and the system is solvent. The attack here was not to make the protocol answer dishonestly. It was to pick an asset where the honest answer is easy to move.

MAMO is that asset. Its entire supply is worth somewhere around $7.6 million, per one analysis of the incident, against roughly $1 million in daily volume across thin pools, The Defiant reports. On the day of the attack it traded between $0.0101 and $0.4739 — a spread of roughly 47x inside a single 24-hour window. That is not a market discovering a price. That is a market being pushed.

With MAMO briefly marked up, the attacker posted it as collateral and drew down assets that are emphatically not thin: cbBTC from Moonwell's mCBTC market, plus ether and stablecoins. CertiK described the sequence as manipulating the collateral value of an illiquid token and then using the inflated valuation to borrow real cbBTC. The collateral was then worth what illiquid collateral is always worth once the pressure comes off — very little. The borrowed bitcoin stayed borrowed.

The numbers the security firms don't agree on

Worth flagging, because the retelling is already smoothing it over: the firms tracking this do not yet agree on what came out. Blockaid's initial assessment, relayed by crypto.news, counted about 50.6 cbBTC worth roughly $4 million. The Defiant's on-chain trace describes a different basket: 14.33 cbBTC (about $1.15 million), 560 ETH (about $1.42 million), and USDC bridged to Ethereum. Those are not the same event described twice; they are two partial views of a still-open ledger.

What both agree on is the destination. PeckShield put the aggregate near $8.7 million, and the proceeds were consolidated into a single address as 8,728,318 DAI. At the time of first publication Moonwell had not said whether that estimate was final, or whether anything was recoverable.

The post-mortem, and three numbers that are all correct

Added Sep 10, 2026. Moonwell published its own account on Aug 28, and it does not contradict the security firms so much as measure something different. The protocol's finding, in its own words, is that "the attacker manipulated MAMO collateral accounting and its oracle price" — note the two objects of that verb. Not just the price feed, but the collateral accounting alongside it.

The post-mortem's numbers, as reported by CryptoDaily, are harder than anything available on the day. The attacker executed 18 transactions and borrowed a gross value of roughly $11.03 million across four markets: cbBTC, WETH, USDC and wstETH. Liquidations began 32 seconds after the final successful borrow. What was left standing afterwards — the obligations sitting open in the protocol against collateral that had reverted to being nearly worthless — came to $9.131 million.

So there are now three figures in circulation, and the temptation is to decide which is the real one. All three are real; they answer different questions.

The gap between the top and bottom rows is the system working — liquidators did fire, and they recovered roughly $1.9 million of what went out. The gap that matters is the middle row. That $9.131 million is not a number the attacker holds; it is a hole in the protocol, owed by a borrower who has no incentive to ever return and collateral that cannot cover it. Somebody eventually absorbs it: the treasury, the depositors, or a governance vote that decides which.

The 32-second detail is the one worth sitting with. Moonwell's liquidation machinery was not slow, asleep or missing. It engaged almost immediately after the last borrow and still could not prevent an eight-figure shortfall, because by the time a liquidation is profitable to execute, the collateral backing the loan has already stopped being worth what the loan is. Liquidation is a mechanism for recovering value from collateral that fell. It has nothing to offer against collateral that was never really there.

Third time on the same fault line

This is the part that should worry Moonwell's depositors more than the headline number. One tally of the protocol's history counts three pricing-related losses inside ten months, totalling more than $14 million: a wrsETH oracle malfunction at $3.7 million, a cbETH misconfiguration at $1.78 million, and now MAMO at $8.7 million. In the cbETH case, described by The Defiant, a Chainlink OEV wrapper error priced the asset at $1.12 instead of roughly $2,200, and 1,096.317 cbETH were liquidated against that fiction. Remediation there is still unresolved. Accounts of that incident's date differ between outlets, which is itself a small indictment of how these events get filed and forgotten.

Three failures of the same category is no longer bad luck. Analysts quoted in that review put it as economic design failure rather than broken code, and the distinction matters for who is supposed to catch it. A code audit reads the contract and tells you the logic is sound. It was. Nobody's audit scope includes the sentence "and also, do not accept a $7.6 million token as collateral for eight-figure loans."

Related Minting out of thin air: the LayerZero delegate hijack, explained

The money is still sitting there

The attacker's wallet has a tidy provenance, per The Defiant's trace: an Ethereum address received about 0.1 ETH from Tornado Cash on Aug 21, then accumulated roughly 99 ETH through bridges before the attack. Six days of preparation, in the open, for anyone who had been watching that address — which is to say nobody was.

Since the conversion to DAI, the funds have not moved. That is not unusual and it is not encouraging. Stationary funds in a single labelled address mean the attacker is waiting — for attention to fade, for a laundering route, or for a negotiation. Protocols in this position often open a public bounty offer. Moonwell has not, yet.