Moonwell Exploit Linked to $8.7M Loss and MAMO Price Pump

• PeckShield estimates $8.7 million in losses after an attacker manipulated MAMO collateral pricing.
• Moonwell cut borrowing caps across Base Core Markets to 1 wei, effectively stopping new loans.
• Earlier wrsETH and cbETH pricing failures caused $3.7 million and $1.78 million in bad debt.

The Moonwell exploit drained an estimated $8.7 million from lending markets on Base on August 27, according to PeckShield. Security researchers linked the attack to inflated MAMO collateral prices.

Moonwell responded by restricting new borrowing across its Base Core Markets. The attacker reportedly borrowed cbBTC, USDC, wstETH, and ETH against the overvalued token, then consolidated proceeds on Ethereum.

Moonwell Exploit Uses Inflated MAMO Collateral on Base

Blockaid’s initial assessment of the Moonwell exploit identified 50.6 cbBTC moved from the protocol, worth more than $4 million. That early estimate did not cover every affected lending market.

MAMO trades in relatively thin markets, where concentrated buying can sharply move prices. Researchers said the attacker inflated its quoted value before using the tokens as collateral.

Oracles provide the external price data that lending protocols use to value collateral. Moonwell’s oracle accepted the higher price, increasing the amount the account could borrow. The collateral’s apparent valuation exceeded the liquidity available to support it.

Initial reports describe price manipulation, rather than an identified breach of the core smart contracts. PeckShield traced the proceeds to DAI at an Ethereum address beginning 0xD71d.

Borrowing Restrictions Follow Earlier Oracle Failures

Supply caps for MAMO and the WELL governance token also fell to 1 wei. Moonwell said other supply caps were unchanged and promised further updates.

The reported $8.7 million is a preliminary loss estimate, not a final accounting of unrecoverable debt. Any recovery and remaining collateral value will affect the protocol’s ultimate shortfall.