Moonwell Drained of Nearly $9 Million in Price Manipulation Attack
Moonwell Hit by Nearly $9 Million Exploit on Base
An attacker has drained almost $9 million worth of deposits from Moonwell, a decentralized finance (DeFi) lending platform that lets users borrow and lend crypto assets. The attack took place on the Base network.
Blockchain security firm Blockaid flagged the suspicious activity approximately an hour after it began. Moonwell later confirmed the incident and said it had cut all borrowing and supply caps to nearly zero to stop further losses.
How the Price Manipulation Worked
The attack relied on inflating the price of MAMO, a relatively illiquid token used as collateral on Moonwell. The attacker increased MAMO’s reported value, then borrowed assets against it. Once the tokens were borrowed, the attacker sold them off.
According to reports, the attacker spent about $7 million to pump MAMO’s price. After the attack, they sold the tokens, taking an estimated loss of $3.8 million on the manipulation itself. The total damage, however, has grown since the initial alert.
The stolen assets included cbBTC, USDC, WETH, and wstETH. The attacker later swapped some of the proceeds into DAI, a non-freezable stablecoin. About 8.7 million DAI now sits in an Ethereum address funded through Tornado Cash, a privacy tool.
Key Numbers
- Total drained: nearly $9 million
- Initial confirmed drain: 50.6 cbBTC, worth more than $4 million
- Cost to manipulate MAMO price: roughly $7 million
- Estimated loss on token sales: about $3.8 million
- DAI moved to privacy mixer address: 8.7 million
What Moonwell Said
Moonwell informed users that all borrow caps and MAMO and WELL supply caps had been reduced to one wei. A wei is the smallest unit of ether, effectively preventing new borrowing and limiting further impact.
Moonwell’s Fourth Pricing Incident in Less Than a Year
This event marks the fourth pricing-related issue at Moonwell in under twelve months:
- In October, a price discrepancy during a market crash led to $12 million in liquidations and $1.7 million in bad debt.
- The following month, fallout from the Balancer hack caused oracle issues with wrsETH/ETH, resulting in $3.7 million of bad debt.
- In February, a contract error valued cbETH at $1.12 instead of its true value of around $2,200. This triggered sudden liquidations and $1.8 million in bad debt.
Why This Matters
The attack highlights ongoing risks with how decentralized lending platforms handle asset prices. Illiquid tokens can be manipulated easily, allowing attackers to borrow far more than the collateral is actually worth. Repeated pricing incidents at Moonwell suggest systemic vulnerabilities in its oracle or risk management setup.
What Is Confirmed
- Blockaid detected the attack on Moonwell on Base.
- The attacker manipulated MAMO pricing to borrow and drain assets.
- Moonwell acknowledged the incident and capped borrowing to prevent further loss.
- The total loss is now接近 $9 million, up from an initial $4 million estimate.
- 8.7 million DAI has been moved to a Tornado Cash-funded address.
What Is Still Unclear
- The identity of the attacker remains unknown.
- It is not yet clear if any of the stolen funds can be recovered.
- The full extent of the damage beyond the $9 million figure has not been independently verified.
