Moonwell’s latest $9M attack marks four incidents in a year

An attacker has drained almost $9 million worth of deposits from DeFi lending platform Moonwell, on the Base network.

Blockchain security firm Blockaid flagged the attack approximately an hour after it began.

Moonwell later acknowledged the incident, informing users that all borrow caps and MAMO and WELL supply caps had been cut to one wei, “preventing new borrowing and limiting the potential for further impact.”

Read more: DeFi, meet Claude: Moonwell’s ‘vibe-coded’ oracle in $1.8M blowup

The simple price manipulation attack hinged on inflating the price of MAMO, a relatively illiquid token used for collateral on Moonwell, and borrowing against it.

The attacker reportedly spent $7 million on pumping MAMO’s price, selling it after the attack for an estimated loss of $3.8 million.

The “borrowed” assets include cbBTC, USDC, WETH, and wstETH.

While Blockaid’s alert initially put the damage at $4+ million, the losses continued to stack up. The attacker swapped the proceeds for non-freezable stablecoin DAI, 8.7 million of which sits in their Tornado Cash-funded Ethereum address.

All is not well at Moonwell

Today’s loss marks Moonwell’s fourth incident in less than a year, all pricing-related.

A price discrepancy during the October 10 market crash led to $12 million in liquidations and $1.7 million of bad debt.

The following month, fallout from the Balancer hack led to issues with the wrsETH/ETH oracle, resulting in $3.7 million of bad debt.

Most recently, in February, a “vibe-coded” Moonwell contract valued cbETH at $1.12 (instead of 1.12 ETH) when its true value was around $2,200.

The error led to sudden liquidations of cbETH-collateralized positions and saddled the market with $1.8 million worth of bad debt.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.