Sunday, February 15, 2026

Moonwell

Funds lost

$1.8M

Attack type

Oracle Issue

Network

Base

Category

Borrowing and Lending

Summary

On February 15, 2026, Moonwell DeFi lending protocol on Base suffered a $1.78M loss when a cbETH price oracle was incorrectly configured to show $1.12 instead of $2,200, triggering mass liquidations where bots repaid minimal debt to receive 1,096.317 cbETH per transaction. The vulnerable code was reportedly co-authored with Claude Opus 4.6 AI, marking potentially the first major exploit of "vibe-coded" Solidity smart contracts.

Details of the Exploit

The oracle configuration error occurred in the cbETH price feed formula, where instead of multiplying the cbETH/ETH exchange rate by the ETH/USD price to determine the dollar value, the system only transmitted the token ratio. This resulted in the oracle reporting cbETH at approximately $1.12 rather than its actual market price of ~$2,200, an error of over 99.9%. The drastically undervalued collateral triggered automatic liquidations across the protocol.

Trading bots exploited the mispricing by repaying approximately $1 worth of debt and receiving 1,096.317 cbETH in return for each liquidation, wiping out borrowers' collateral while leaving significant debt on their positions. Simultaneously, other users deposited minimal collateral to borrow cbETH at the artificially low price. The incident affected users holding cbETH, cbBTC, tBTC, and ETH as collateral, with many maintaining healthy loan-to-value ratios prior to liquidation.

Upon discovery, Moonwell's risk manager immediately reduced the cbETH borrowing limit to 0.01 to prevent further exploitation. The code commits were co-authored with Claude Opus 4.6 AI, raising questions about AI-assisted "vibe coding" in smart contract development, though experts noted human developers and auditors ultimately bear responsibility for reviewing AI-generated code.

Source: De.Fi REKT Database. Data as of November 1, 2026.