Security · Developing
Nothing Was Hacked. Moonwell Still Lost $8.7 Million
The attacker didn't break a line of code. They inflated a thinly traded token, posted it as collateral, and borrowed real bitcoin against it. Moonwell's pricing did exactly what it was built to do — and that was the problem.
Moonwell, a lending protocol on Base, lost roughly $8.7 million on Thursday to an attacker who never found a bug. There was no reentrancy, no unchecked call, no forgotten access modifier. The contracts behaved correctly from the first block to the last. The attacker simply took a token almost nobody trades, made it briefly expensive, walked it into the lending market as collateral, and borrowed real assets against the number the protocol read back.
The Block first reported the incident on Aug 27, as PeckShield, CertiK and Blockaid independently flagged the same mechanism. Moonwell said it was investigating an issue affecting the MAMO market on Base and, as a precaution, set borrow caps for every Core Market on Base to "1 wei" — a value so small it functionally halts new borrowing across the whole deployment. Supply caps for MAMO and WELL were set to the same. Moonwell did not respond to The Block's request for comment.
How you rob a lending market without touching its code
Every lending protocol runs on one question asked continuously: what is the borrower's collateral worth right now? Answer honestly and the system is solvent. The attack here was not to make the protocol answer dishonestly. It was to pick an asset where the honest answer is easy to move.
MAMO is that asset. Its entire supply is worth somewhere around $7.6 million, per one analysis of the incident, against roughly $1 million in daily volume across thin pools, The Defiant reports. On the day of the attack it traded between $0.0101 and $0.4739 — a spread of roughly 47x inside a single 24-hour window. That is not a market discovering a price. That is a market being pushed.
With MAMO briefly marked up, the attacker posted it as collateral and drew down assets that are emphatically not thin: cbBTC from Moonwell's mCBTC market, plus ether and stablecoins. CertiK described the sequence as manipulating the collateral value of an illiquid token and then using the inflated valuation to borrow real cbBTC. The collateral was then worth what illiquid collateral is always worth once the pressure comes off — very little. The borrowed bitcoin stayed borrowed.
The numbers the security firms don't agree on
Worth flagging, because the retelling is already smoothing it over: the firms tracking this do not yet agree on what came out. Blockaid's initial assessment, relayed by crypto.news, counted about 50.6 cbBTC worth roughly $4 million. The Defiant's on-chain trace describes a different basket: 14.33 cbBTC (about $1.15 million), 560 ETH (about $1.42 million), and USDC bridged to Ethereum. Those are not the same event described twice; they are two partial views of a still-open ledger.
What both agree on is the destination. PeckShield put the aggregate near $8.7 million, and the proceeds were consolidated into a single address as 8,728,318 DAI. Moonwell has not said whether that estimate is final, or whether anything is recoverable.
Three pricing failures, ten months, one protocol
Third time on the same fault line
This is the part that should worry Moonwell's depositors more than the headline number. One tally of the protocol's history counts three pricing-related losses inside ten months, totalling more than $14 million: a wrsETH oracle malfunction at $3.7 million, a cbETH misconfiguration at $1.78 million, and now MAMO at $8.7 million. In the cbETH case, described by The Defiant, a Chainlink OEV wrapper error priced the asset at $1.12 instead of roughly $2,200, and 1,096.317 cbETH were liquidated against that fiction. Remediation there is still unresolved. Accounts of that incident's date differ between outlets, which is itself a small indictment of how these events get filed and forgotten.
Three failures of the same category is no longer bad luck. Analysts quoted in that review put it as economic design failure rather than broken code, and the distinction matters for who is supposed to catch it. A code audit reads the contract and tells you the logic is sound. It was. Nobody's audit scope includes the sentence "and also, do not accept a $7.6 million token as collateral for eight-figure loans."
The money is still sitting there
The attacker's wallet has a tidy provenance, per The Defiant's trace: an Ethereum address received about 0.1 ETH from Tornado Cash on Aug 21, then accumulated roughly 99 ETH through bridges before the attack. Six days of preparation, in the open, for anyone who had been watching that address — which is to say nobody was.
Since the conversion to DAI, the funds have not moved. That is not unusual and it is not encouraging. Stationary funds in a single labelled address mean the attacker is waiting — for attention to fade, for a laundering route, or for a negotiation. Protocols in this position often open a public bounty offer. Moonwell has not, yet.
The Take
Stop calling these oracle failures. The oracle did its job: it reported what MAMO cost, and MAMO really did cost that, for a few minutes, because somebody paid it. The failure happened earlier and higher up, in a governance decision that admitted a token with a $7.6 million supply into a market that would lend real bitcoin against it. That is a risk-parameter question, and risk parameters are exactly the thing that gets waved through when a protocol wants a longer asset list. Moonwell has now paid three times to learn one lesson. The rest of DeFi gets to learn it for free: the cheapest asset on your collateral list is the price of your whole protocol.