An attacker has drained almost $9 million worth of deposits from DeFi lending platform Moonwell, on the Base network.

Blockchain security firm Blockaid flagged the attack approximately an hour after it began.

Moonwell later acknowledged the incident, informing users that all borrow caps and MAMO and WELL supply caps had been cut to one wei, “preventing new borrowing and limiting the potential for further impact.”

Read more: DeFi, meet Claude: Moonwell’s ‘vibe-coded’ oracle in $1.8M blowup

The simple price manipulation attack hinged on inflating the price of MAMO, a relatively illiquid token used for collateral on Moonwell, and borrowing against it.

The attacker reportedly spent $7 million on pumping MAMO’s price, selling it after the attack for an estimated loss of $3.8 million.

The “borrowed” assets include cbBTC, USDC, WETH, and wstETH.

While Blockaid’s alert initially put the damage at $4+ million, the losses continued to stack up. The attacker swapped the proceeds for non-freezable stablecoin DAI, 8.7 million of which sits in their Tornado Cash-funded Ethereum address.

All is not well at Moonwell

Today’s loss marks Moonwell’s fourth incident in less than a year, all pricing-related.

A price discrepancy during the October 10 market crash led to $12 million in liquidations and $1.7 million of bad debt.

The following month, fallout from the Balancer hack led to issues with the wrsETH/ETH oracle, resulting in $3.7 million of bad debt.

Most recently, in February, a “vibe-coded” Moonwell contract valued cbETH at $1.12 (instead of 1.12 ETH) when its true value was around $2,200.

The error led to sudden liquidations of cbETH-collateralized positions and saddled the market with $1.8 million worth of bad debt.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Postquant Labs announces the upcoming launch of QuipSwap, a bridgeless protocol designed for secure cross-chain asset swaps.

Postquant Labs, the developer behind quantum computing protocol quip.network, has announced the imminent public launch of QuipSwap, its Bridgeless Swap Protocol.

QuickSwap is aimed at addressing the dual challenges of cross-chain security vulnerabilities and the looming threat to current cryptographic standards posed by its own quantum computing network.

The protocol represents the first solution to enable trustless cross-chain transactions without bridges, oracles, or wrapped assets, components that have historically been the primary vectors for billions of dollars in losses from hacks and exploits.

Where traditional cross-chain solutions rely on centralized intermediaries or smart contract bridges to move assets between blockchains, Quip’s new protocol utilizes a peer-to-peer (P2P) mechanism that completely upsets the previous paradigm. The protocol enables two parties to agree to a swap and effectively exchange wallet access across chains in a synchronized, trustless manner. 

Colton Dillion, CEO and co-founder of Postquant Labs, said the company’s approach to cross-chain trading could help users participate in the Quip ecosystem without relying on intermediaries, bridges or oracles.

“If one party claims their side of the trade, the counterparty immediately receives their claim key too — no take-backs,” Dillion said. “You can be on any chain and treat it like a P2P swap.”

The timing of this launch addresses a key, often-overlooked vulnerability: quantum resistance. As quantum computing advances, the cryptographic foundations of current blockchains are becoming open to exploitation. The Quip team argues that simply upgrading a single chain is insufficient since, for a transaction to be truly quantum-resistant, every layer it traverses must also be immune to quantum attacks.

Commenting on the matter, Dr. Richard Carback, Chief Technology Officer and co-founder of Postquant Labs, said the company’s approach to quantum computing infrastructure is designed to address security challenges that arise when distributed networks rely on cryptographic systems vulnerable to quantum attacks.

“You can’t run a distributed computation network where your own miners can break your cryptography,” Carback said. “No chain supports quantum computation, so we had to build our own,” he added.

Following a successful demonstration of the live claim process at ETHDenver in February, the Quip team has completed the core codebase. The protocol has undergone rigorous testing and a formal security audit conducted by Oak Security, with results announced as part of today’s public launch.

Alongside QuipSwap, quip.network has successfully deployed quantum-resistant wallets across Bitcoin, Ethereum, and Solana, currently in beta testing, hardening blockchain infrastructure against the quantum threat before it arrives. All research underpinning quip.network is open-source, built with the goal of establishing a global quantum computing standard for the industry.

Hyperliquid Strategies has raised $647 million in equity capital and more than doubled its treasury to 29.3 million HYPE tokens, valued at $1.9 billion at the end of June.

Hyperliquid Strategies builds a $1.9 billion HYPE treasury

Hyperliquid Strategies said in its fiscal-year results that its HYPE holdings increased from an initial 12.5 million tokens to approximately 29.28 million by June 30. At the token’s fiscal year-end price of $65.04, the position carried a value of $1.90 billion.

Alongside the token reserve, the company reported $149.9 million in cash and cash-like assets, including $12 million held in USDC. Total assets reached $2.06 billion, while stockholders’ equity stood at $1.87 billion.

No debt remained on the balance sheet at the end of the period, according to the results. The company also said substantially all its HYPE tokens were staked and generating income.

“This was the year we built the platform,” CEO David Schamis said. He added that the company had doubled its treasury, launched a validator with Unit, and completed its exit from legacy biotechnology operations.

Operating the Hyperliquid Strategies x Unit validator produced another source of income tied to the network. The company described it as Hyperliquid’s third-largest validator when excluding wallets connected to the Hyper Foundation.

During the 12 months ended June 30, the company recorded $9.5 million in staking revenue and validator commissions. Interest income added $2.7 million, while selling, general, administrative, and research and development expenses totaled $14 million.

Net income reached $305.5 million for the fiscal year. According to the company, $709.9 million in unrealized gains on its HYPE holdings accounted for a large part of the result.

Several charges reduced the benefit of the token appreciation. Hyperliquid Strategies recorded a one-time $169.2 million loss related to HYPE contributed when its business combination closed, a $35.6 million write-off tied to the former Sonnet operation and $183.5 million in deferred tax expenses.

$647 million equity facility funds token purchases

Since the business combination closed on Dec. 2, 2025, Hyperliquid Strategies has deployed $773.4 million to buy approximately 16.5 million HYPE at an average price of $46.77 per token. The purchases brought its total position to 29.3 million tokens as of Aug. 19.

Funding came mainly through a committed equity facility, which generated $646.6 million at an average issue price of $8.70 per PURR share. Issuing stock through the facility provided capital for token purchases but also increased the number of shares outstanding.

Part of the available capital went back into the company’s stock. Hyperliquid Strategies spent $27.8 million repurchasing approximately 5.8 million PURR shares at an average price of $4.80.

After the HYPE purchases and share repurchases, cash stood at $132.6 million on Aug. 19, including $12 million in USDC. The company continued to report no debt.

Earlier accumulation had already made the firm one of the largest identified corporate HYPE holders. In February, crypto.news reported that a five-million-token purchase cost about $129.5 million at an average of $25.90, raising the treasury to 17.6 million HYPE at the time.

The company’s exposure later attracted outside institutions seeking access through a U.S.-listed security. Duquesne Family Office disclosed a $23 million PURR position in its second-quarter Form 13F, giving Stanley Druckenmiller’s investment firm indirect exposure to the token.

Wyoming also reported an indirect HYPE investment through PURR shares in its second-quarter filing. Neither disclosure showed the institutions purchasing or holding HYPE directly.

For U.S. investors, PURR provides stock-market exposure to a company whose asset value and earnings are heavily tied to HYPE. The shares trade on Nasdaq, while options on PURR began trading through the Nasdaq Options Market in March.

Hyperliquid activity supports treasury income

Hyperliquid Strategies said that about $945 million in value accrued to the Hyperliquid ecosystem during the 12 months through June. The figure came from public ecosystem data that the company said it had not independently verified.

According to the results, Hyperliquid’s share of global perpetual futures volume, including centralized exchanges, reached about 9.4% on June 30. By Aug. 23, the protocol accounted for roughly 63% of open interest across decentralized perpetual markets, more than five times the share of its nearest competitor.

Activity expanded beyond crypto perpetual contracts during the summer. Real-world asset markets accounted for more than half of weekly platform volume for two consecutive weeks in July, while open interest across HIP-3 markets exceeded $4 billion for the first time in August.

A recent policy submission has placed that activity within the U.S. regulatory debate. The Hyperliquid Policy Center asked federal regulators to treat qualifying equity perpetual contracts as security futures jointly supervised by the SEC and CFTC. The group said HIP-3 markets had processed more than $480 billion in notional volume over their first 10 months.

President Donald Trump said on Aug. 19 that CFTC Chairman Michael Selig was working to bring Hyperliquid into the United States “in a fully compliant and legal fashion.” However, Hyperliquid Strategies stated in a footnote to its results that the CFTC had not granted an application, registration, exemption or rulemaking involving the protocol.

The company also said it was unaware of any pending CFTC process and warned that no U.S. regulatory route could be assured. Hyperliquid users in the United States currently remain unable to access the protocol, according to the Policy Center’s filing.

PURR gains as HYPE extends monthly rally

Following the earnings release, PURR shares rose nearly 18% to around $13.59 during Thursday’s trading session. The move placed the Nasdaq-listed company’s market capitalization near $1.8 billion.

PURR’s multiple to adjusted net asset value, or mNAV, reached about 1.35 times, its highest level since May. The company calculates adjusted net asset value using factors that include cash, its HYPE holdings, and the number of shares outstanding.

HYPE gained about 77% during the quarter ended June 30, while total crypto market capitalization fell approximately 13% over the same period, according to figures included in the company’s release. More recently, the token has risen over 50% during the past month.

By Aug. 23, total open interest on Hyperliquid had climbed to a record of approximately $13 billion. The company also reported that HYPE became one of the five largest constituents in the S&P Pantera Digital Asset Index when the benchmark launched on July 21.

Charles Schwab has announced plans to add Solana, Avalanche and Chainlink to its crypto platform in the coming months, extending direct trading beyond Bitcoin and Ethereum for its U.S. retail clients.

Charles Schwab selects three established altcoins

Charles Schwab said in an Aug. 27 announcement that clients will be able to buy and sell Solana (SOL), Avalanche (AVAX), and Chainlink (LINK) through Schwab Crypto in the coming months.

A launch date was not disclosed. Schwab also did not say whether all three assets would become available at the same time or whether access would follow the phased approach used for its first crypto products.

The additions will take Schwab Crypto’s planned selection from two assets to five. Bitcoin and Ethereum were the only cryptocurrencies available when direct trading began earlier in 2026.

Schwab said it chose the three tokens after considering customer interest and focusing on established digital assets. The company did not publish its selection criteria or provide details about trading limits for the incoming assets.

“With this expansion, clients will have more choices to build a digital asset allocation alongside the investing and banking experience they know and trust at Schwab,” Joe Vietri, Schwab’s head of digital assets, said in the announcement.

Demand will continue to guide which cryptocurrencies are listed, according to Schwab. The firm confirmed that it expects to add other assets over time, although it did not name the next tokens under consideration.

XRP, Hyperliquid, and Zcash were not included in the announcement despite public requests from some crypto users. Schwab has not said whether regulatory concerns, liquidity requirements, or other factors affected their exclusion.

Schwab Crypto builds on its Bitcoin and Ethereum launch

In August, crypto.news reported on Schwab’s rollout of direct Bitcoin and Ethereum trading at a fee of 75 basis points, or 0.75% of the dollar value of each transaction.

Charles Schwab Premier Bank holds customer assets, while Paxos provides trade execution and sub-custody. Clients can view their crypto holdings alongside stocks, bonds, exchange-traded funds, and other investments through Schwab.com, Schwab Mobile, and thinkorswim.

At the end of the second quarter, Schwab reported $13.1 trillion in total client assets and 39.8 million active brokerage accounts. The firm also recorded $7.1 billion in quarterly revenue, up 21% from a year earlier, while daily average trades increased 57% to 11.9 million.

Such figures describe the size of Schwab’s existing business rather than the amount available for cryptocurrency purchases. Still, the account base gives the firm a large pool of customers who can access crypto without opening an account at a separate exchange.

Before Schwab introduced direct trading, its customers could gain crypto exposure through exchange-traded funds, futures, and the Schwab Crypto Thematic ETF. Chief executive Rick Wurster previously said clients held about $25 billion in crypto exchange-traded products through the company.

The retail service began without support for external deposits and withdrawals. During its July earnings update, Schwab said it had started testing crypto transfers, which could eventually let clients move eligible assets between the brokerage and external platforms.

Pricing places Schwab between several financial competitors. Its 0.75% transaction fee sits below Fidelity’s reported charge of about 1% but above the 0.5% fee attached to Morgan Stanley’s E*Trade crypto service.

E*Trade included Solana alongside Bitcoin and Ethereum during its pilot, giving Schwab another reason to add support for assets outside the two largest cryptocurrencies. Zerohash provides infrastructure for Morgan Stanley’s offering, while Schwab relies on Paxos for execution and sub-custody.

U.S. clients face access and custody limits

For American investors, the announcement adds another route to buy SOL, AVAX, and LINK through a regulated banking subsidiary connected to a major brokerage. It does not give Schwab users access to the tokens immediately, as availability remains subject to the company’s rollout schedule.

Schwab Crypto was initially unavailable to customers in New York, Louisiana, U.S. territories, and international markets. The company’s latest announcement did not say whether geographic availability will change when the three assets are introduced.

Customers also need a separate Schwab Crypto account linked to their existing relationship with the brokerage. Unlike a self-custody wallet, the service leaves asset custody with Schwab Premier Bank and its infrastructure provider.

The arrangement can simplify access for investors who already hold stocks and funds at Schwab, but it does not currently offer the same transfer functions as a conventional crypto exchange. Schwab has not disclosed whether staking, on-chain withdrawals or deposits will be available for SOL, AVAX, and LINK at launch.

The company is separately preparing to bring digital-asset services to registered investment advisers. A mid-2027 advisor rollout is under consideration for spot trading, transfers and custody, although Schwab managing director Jalina Kerr has said the timing may change.

Advisers still use exchange-traded products for much of their clients’ crypto exposure, according to Kerr. Demand for direct holdings has grown among customers who already keep digital assets on other platforms, creating interest in custody and transfer services inside Schwab’s adviser system.

SOL, AVAX and LINK rise after the announcement

Solana traded at about $104.84 after the announcement, gaining more than 9% over 24 hours. Its intraday range stretched from $95.23 to $105.55, while reported trading volume climbed almost 70%.

SOL recorded the strongest daily performance among the three selected assets. The token’s advance also followed a rally across several large cryptocurrencies, making it difficult to attribute the full move to Schwab’s announcement alone.

Avalanche rose about 2% within an hour of the news, according to market data cited in the original report. Chainlink also gained more than 2% during the same period and extended its 24-hour increase beyond 5%.

Alongside crypto trading, Schwab is adding other products tied to markets and digital finance. Cboe introduced binary options based on the Mini-S&P 500 Index in June, with Interactive Brokers providing initial access and Schwab expected to follow.

The Cboe Predicts contracts trade as security options under the rules governing U.S.-listed options. Cboe launched them under the XSPBW and XSPBX tickers, allowing investors to take yes-or-no positions on where the Mini-S&P 500 Index will finish.

Ripple Prime has launched a Delta One business that lets institutional clients trade total return swaps tied to U.S.-listed equities, indexes and digital assets through its multi-asset prime brokerage platform.

Ripple said Thursday that the service is live for hedge funds, asset managers and other financial institutions, extending Ripple Prime further into U.S. equity derivatives while retaining digital assets within the same brokerage framework.

Clients can use a single counterparty for the transactions and cross-margin positions across supported asset classes. Ripple Prime said the setup operates around the clock, allowing institutions to manage collateral and exposures across traditional and digital markets through one relationship.

Total return swaps give investors exposure to the economic performance of an underlying asset without requiring them to own it directly. Under the structure, payments between counterparties are generally based on the return of the referenced asset and financing terms agreed under the swap.

“The launch of our Delta One business is an important development for Ripple Prime and a natural extension of the platform we’ve built,” Ripple Prime President Noel Kimmel said.

Ripple Prime Delta One brings US equities into its multi-asset platform

With Delta One, Ripple Prime is extending a business that already covers foreign exchange, derivatives, fixed income and digital assets into swaps linked to U.S. equities and indexes.

The firm said the product can be structured around different investment horizons, risk requirements and reporting needs. Institutional clients can execute total return swaps across the supported markets while managing the resulting exposures under Ripple Prime’s existing prime brokerage relationship.

Ripple Prime operates with more than $1 billion in regulatory net capital, according to Ripple. The firm provides clearing, financing and prime brokerage services for institutional investors across several asset classes.

The equity derivatives launch follows several additions to its institutional trading infrastructure this year. In May, Ripple Prime integrated with EDX Markets, giving clients access to EDX spot liquidity and perpetual futures offered by EDXM International through a unified brokerage arrangement. crypto.news previously reported that RLUSD was expected to serve a settlement and collateral role within the integration.

Through the arrangement, Ripple Prime provides credit intermediation, collateral management and net settlement while institutions access EDX liquidity. The integration followed several months of expansion across both centralized and decentralized digital asset markets.

Institutional derivatives access has expanded during 2026

Earlier in February, Ripple Prime added Hyperliquid access, allowing institutional clients to trade through the decentralized derivatives venue while cross-margining those positions against other assets held through the prime brokerage platform.

Ripple said at the time that supported exposures included digital assets, foreign exchange, fixed income, over-the-counter swaps and cleared derivatives. Clients retained a single counterparty relationship while accessing liquidity available through Hyperliquid.

The Delta One rollout applies a similar multi-asset structure to U.S.-listed equities and indexes, with Ripple Prime handling the swap relationship while clients receive the economic return of the referenced instruments.

Ripple Prime’s expansion into equity derivatives follows the company’s move into U.S. digital asset spot brokerage late last year. In November 2025, it launched spot prime brokerage for U.S. institutional customers, supporting over-the-counter digital asset transactions after Ripple completed the Hidden Road acquisition.

The original Hidden Road business had already operated across traditional and digital markets, including foreign exchange, derivatives, fixed income and cryptocurrency products.

Hidden Road deal created Ripple Prime

Ripple completed its $1.25 billion purchase of Hidden Road in October 2025 and renamed the institutional brokerage operation Ripple Prime.

The Hidden Road acquisition gave Ripple ownership of a global multi-asset prime broker providing institutions with clearing, financing and brokerage services across foreign exchange, derivatives, fixed income and digital assets.

Ripple had announced the transaction in April 2025 before closing it roughly six months later. The company said when the deal was completed that Ripple Prime would continue integrating Ripple’s digital asset infrastructure with the brokerage business, including the use of its RLUSD stablecoin within certain prime brokerage products.

Since the acquisition, Ripple Prime has also expanded the amount of financing available to support institutional client activity.

In May, the brokerage secured a $200 million debt facility from funds managed by Neuberger Specialty Finance. The facility was structured to increase Ripple Prime’s capacity to provide financing as institutional borrowing demand increased across crypto, equities, fixed income and foreign exchange.

Ripple said at the time that Ripple Prime’s revenue had tripled year over year since the acquisition, while client demand had increased across both traditional and digital markets. The Neuberger financing facility could be drawn according to institutional borrowing demand and was intended to support margin services offered through the platform.

Ripple Prime has raised more capital for expansion

Financing continued this month when Ripple Prime closed a $275 million private placement of senior unsecured notes on Aug. 18.

Ripple said the offering had been increased from its original size following demand from institutional investors. The notes received a BBB investment-grade rating from KBRA, while Piper Sandler acted as the lead placement agent.

Proceeds were designated for working capital and general corporate purposes within the regulated entity, including investment in technology and personnel supporting the brokerage operation.

Kimmel said after the placement that the financing provided Ripple Prime with another source of capital as it expanded its multi-asset clearing, prime brokerage and financing business.

The debt placement followed the $200 million Neuberger facility secured in May, giving Ripple Prime separate sources of capital for financing institutional activity and funding its own operations.

Ripple Prime currently provides services across digital assets, foreign exchange, precious metals, exchange-traded derivatives, over-the-counter swaps and fixed income repo markets. Ripple says the platform clears more than $3 trillion annually across markets and serves more than 300 institutional customers.

The Delta One service is now live for total return swaps tied to U.S.-listed equities, indexes and digital assets, with Ripple Prime serving as the counterparty and providing cross-margining across supported positions.

Moonwell has halted new borrowing across its Core Markets on Base after an apparent MAMO collateral price manipulation exploit drained about $8.7 million from the decentralized lending protocol.

Moonwell said in an Aug. 27 post on X that it was investigating an issue affecting the MAMO Core Market and had lowered borrow caps across all Core Markets on Base to 1 wei as a precaution, effectively preventing users from opening new borrowing positions while the investigation continues.

“As a precaution, borrow caps for all Core Markets on Base have been set to 1 wei, preventing new borrowing and limiting the potential for further impact,” Moonwell said.

Supply caps for MAMO and WELL were also reduced to 1 wei, while supply limits for other assets were left unchanged, according to the protocol. Moonwell said it would provide further updates once more information became available.

Blockchain security firms PeckShield and CertiK separately estimated that approximately $8.7 million had been taken, while Blockaid traced the apparent attack to manipulation of the MAMO token’s collateral price.

Moonwell exploit used MAMO collateral price to borrow cbBTC

According to CertiK, the attacker manipulated the collateral value of MAMO, a relatively illiquid token, before using the inflated collateral to borrow real cbBTC from Moonwell’s mCBTC market.

Blockaid identified the same mechanism, initially reporting that 50.6 cbBTC worth more than $4 million had been drained as it monitored the transactions. PeckShield later estimated total losses at about $8.7 million and said the attacker had consolidated the proceeds into DAI at a single address.

The use of a thinly traded asset as collateral was central to the attack described by the security firms. By changing MAMO’s market price, the attacker was able to increase the value assigned to the collateral position before borrowing assets with deeper liquidity.

MAMO has previously experienced sharp price swings. The token fell after its Coinbase debut in August 2025 after gaining more than 120% during the preceding week. At the time, crypto.news reported that MAMO had reached an all-time high of $0.227 before losing nearly 20% as selling activity increased.

Price pressure returned following Thursday’s security incident. Moonwell’s WELL token was down about 13% over the preceding 24 hours, according to CoinGecko data cited in the initial report, while MAMO had fallen roughly 9% over the same period, according to DEX Screener.

The restrictions imposed by Moonwell cover borrowing across its Base Core Markets, not only the MAMO market where the issue was identified. Existing supply caps for assets other than MAMO and WELL remained unchanged while the team investigated the incident.

Moonwell has faced previous oracle and governance problems

Thursday’s incident follows other security problems at Moonwell during 2026, including a pricing failure that left its lending markets with about $1.78 million in bad debt.

In February, an oracle calculation error mispriced Coinbase Wrapped ETH, or cbETH, at roughly $1.12 when the asset was trading near $2,200. The incorrect price allowed liquidators and automated bots to repay positions at the distorted valuation and seize cbETH collateral, according to the protocol’s disclosure cited by crypto.news.

The faulty oracle logic reportedly included code generated with Anthropic’s Claude Opus 4.6 model. Moonwell said at the time that an incorrect scaling factor in the calculation caused the large difference between the oracle value and the market price.

Another Moonwell security issue surfaced the following month when an unknown party acquired about $1,800 worth of MFAM tokens and used the holdings to push a malicious governance proposal through quorum on the protocol’s Moonriver deployment.

The March proposal sought control of seven lending markets, Moonwell’s comptroller and its oracle through an attacker-controlled contract, putting about $1.08 million of assets at risk. Moonwell’s Break Glass Guardian multisig provided an emergency mechanism capable of stopping the proposal before execution, while subsequent votes moved against it.

Unlike the February pricing failure, security firms assessing the Aug. 27 incident have described the latest attack as active manipulation of the market price used for MAMO collateral. Moonwell has not yet published a detailed post-mortem identifying the exact contracts, oracle structure or transaction sequence involved.

DeFi exploits have remained elevated since April

The Moonwell exploit comes after a series of large DeFi attacks during the second quarter of 2026, with April accounting for several of the year’s biggest losses.

CertiK warned in April that AI misuse and infrastructure weaknesses were becoming significant parts of crypto security risk. The firm said attackers were using social engineering, infrastructure vulnerabilities and more advanced automated tools, including AI-assisted phishing, deepfakes and exploit techniques.

By April 18, crypto protocols had lost more than $606 million across at least 12 incidents during the month, according to DefiLlama data cited by crypto.news. The total exceeded losses recorded during the entire first quarter of 2026.

Kelp DAO accounted for one of the largest incidents after attackers drained roughly 116,500 rsETH worth about $292 million from its cross-chain setup on April 18.

LayerZero later said the Kelp DAO exploit involved compromised RPC infrastructure used by its decentralized verifier network and affected Kelp DAO’s single-DVN rsETH configuration. The company said preliminary evidence pointed to North Korea-linked TraderTraitor, which it associated with the Lazarus Group.

The incident also affected lending markets holding rsETH. Aave experienced large withdrawals and was left with substantial bad debt after stolen rsETH was used as collateral to borrow other assets, while SparkLend and Fluid restricted affected markets.

In June, Binance Research said April’s DeFi exploits had contributed to about $13 billion in total value locked outflows from on-chain protocols. Its May market report put DeFi TVL at $82.7 billion at the end of April, down 10.7% from the previous month, while exploit losses for the month totaled $635.24 million.

Moonwell has not yet disclosed whether the $8.7 million estimate represents its final loss from the MAMO Core Market incident or whether any of the affected assets can be recovered. The protocol said its investigation remains active and that further information will be released when available.