A pricing error that lasted only minutes has left DeFi lender Moonwell with nearly $1.8 million in bad debt after a software glitch caused the value of Coinbase Wrapped ETH (cbETH) to drop to $1, instead of roughly $2,200, on the platform.

The technical glitch happened because a system update caused the platform to value cbETH based only on its relationship to ETH (about 1.12), forgetting to factor in the actual USD price of ether.

As a result, the protocol interpreted cbETH as being worth around $1.12, per an incident summary.

The issue began when a governance proposal enabled new Chainlink oracle configurations across Moonwell markets on Base and Optimism networks. An oracle is a tool that fetches real-time data before it is added to a blockchain.

In lending protocols such as Moonwell, users deposit assets like cbETH as collateral and borrow other tokens against them. If collateral falls below required thresholds, positions are automatically liquidated by bots that repay debt and seize collateral at a discount.

Once cbETH appeared to collapse from over $2,000 to just above $1, liquidation bots moved quickly. Because the protocol believed the token was nearly worthless, liquidators were able to repay roughly $1 of debt to seize one cbETH.

Risk manager Anthias Labs said 1,096.317 cbETH ($2.44 million) was seized, wiping out borrower collateral while leaving the protocol with bad debt across several markets.

The distorted pricing also allowed a smaller group of users to deposit minimal collateral and borrow cbETH at the artificially low valuation, further increasing losses.

Moonwell reduced supply and borrow caps within minutes to contain damage. However, correcting the oracle required a governance vote and a five day timelock, preventing an immediate fix.

The episode is the latest reminder that price oracles are foundational infrastructure and a key point of failure for DeFi applications. When they misfire, the smart contracts do exactly what they are programmed to do, but the balance sheet absorbs the consequences.

Meanwhile, security auditor Krum Pashov noted that GitHub commits tied to the proposal were co-authored by Claude Opus 4.6, an AI coding assistant, prompting debate over whether automated “vibe coding” contributed to the faulty oracle logic.

Moonwell, a decentralized finance (DeFi) lending protocol deployed on Base and Optimism, was exploited for about $1.78 million after a pricing oracle for Coinbase Wrapped Staked ETH (cbETH) returned a value of about $1.12 instead of $2,200, creating a mispricing that attackers were able to use for profit.

Moonwell said in an incident post-mortem that a governance proposal executed on Sunday misconfigured the cbETH oracle by using the cbETH/ETH exchange rate alone, causing the system to report cbETH at about $1.12. The protocol said liquidation bots and opportunistic borrowers exploited the mispricing, leaving roughly $1.78 million in bad debt.

The pull requests for the affected contracts show multiple commits co-authored by Anthropic’s Claude Opus 4.6, prompting security auditor Pashov to publicly flag the incident as an example of artificial intelligence-written or AI-assisted Solidity backfiring. 

Speaking to Cointelegraph about the incident, he said that he had linked the case to Claude because there were multiple commits in the pull requests that were co-authored by Claude, meaning that “the developer was using Claude to write the code, and this has led to the vulnerability.”

Pashov cautioned, however, against treating the flaw as uniquely AI-driven. He described the oracle issue as the kind of mistake “even a senior Solidity developer could have made,” arguing that the real problem was a lack of sufficiently rigorous checks and end-to-end validation.

Initially, he said that he believed there had been no testing or audit at all, but later acknowledged that the team said it had unit and integration tests in a separate pull request and had commissioned an audit from Halborn. 

In his view, the mispricing “could have been caught with an integration test, a proper one, integrating with the blockchain,” but he declined to criticise other security firms directly.

Related: How South Korea is using AI to detect crypto market manipulation

Small loss, big governance questions

The dollar amount of the exploit is small compared to some of DeFi’s largest incidents, such as the Ronin bridge exploit in March 2022, where attackers stole more than $600 million, or other nine-figure bridge and lending protocol hacks. 

What makes Moonwell notable is the mix of AI co-authorship, a basic-seeming price configuration failure on a major asset, and existing audits and tests that failed to catch it. 

Pashov said his own company would not fundamentally change its process, but if code appeared “vibe coded,” his team would “have a bit more wide open eyes” and expect a higher density of low-hanging issues, even though this particular oracle bug “was not that easy” to spot.

“Vibe coding” vs disciplined AI use

Fraser Edwards, co-founder and CEO of cheqd, a decentralized identity infrastructure provider, told Cointelegraph that the debate around vibe coding masks “two very different interpretations” of how AI is used. 

Related: How AI crypto trading will make and break human roles

On one side, he said, are non-technical founders prompting AI to generate code they cannot independently review; on the other, experienced developers using AI to accelerate refactors, pattern exploration and testing inside a mature engineering process.

AI-assisted development “can be valuable, particularly at the MVP [minimal viable product] stage,” he noted, but “should not be treated as a shortcut to production-ready infrastructure,” especially in capital-intensive systems like DeFi.

Edwards argued that all AI-generated smart contract code should be treated as untrusted input, subject to strict version control, clear code ownership, multi-person peer review and advanced testing, especially around high-risk areas such as access controls, oracle and pricing logic, and upgrade mechanisms.

“Ultimately, responsible AI integration comes down to governance and discipline,” he said, with clear review gates, separation between code generation and validation, and an assumption that any contract deployed in an adversarial environment may contain latent risk.

Magazine: South Korea gets rich from crypto… North Korea gets weapons