Thursday, August 27, 2026

Moonwell

Funds lost

$8.7M

Attack type

Oracle Issue

Network

Base

Category

Borrowing and Lending

Summary

On August 27, 2026, Moonwell’s MAMO lending market on Base was exploited through a combination of collateral-accounting manipulation and DEX oracle manipulation. The attacker deployed roughly $1.95 million in starting capital, inflated their collateral value to borrow over $11 million in mixed crypto assets, and extracted $8.73 million via Circle CCTP to Ethereum, leaving the protocol with around $9.13 million in bad debt.

Details of the Exploit

The attack began when the exploiter withdrew 800 ETH from Tornado Cash, swapped most of it into about $1.95 million USDC, and bridged those funds to Base to accumulate MAMO tokens. They first deposited 15 million MAMO into Moonwell to mint receipt tokens (mMAMO). Next, instead of using the normal deposit route, they transferred another 53.4 million MAMO directly into the mMAMO contract address.

Because this direct transfer bypassed the protocol's minting function and supply caps, it artificially increased the underlying token backing behind every existing mMAMO share by nearly 3.7 times. Holding three-quarters of all receipt tokens, the attacker captured almost all of this sudden collateral equity boost. At the same time, the attacker used aggressive DEX trades across low-liquidity pools to inflate the market price of MAMO from around $0.01 to over $0.40.

With both the share backing ratio and the oracle price drastically spiked, Moonwell valued the attacker’s collateral at over $22 million, allowing them to draw 18 separate loans totaling $11.03 million in WETH, cbBTC, USDC, and wstETH. The attacker quickly converted these assets, burned $8.73 million USDC through Circle's cross-chain bridge to Ethereum, and swapped it into DAI. Liquidators stepped in seconds after the final borrow and seized the attacker's remaining collateral shares, but the steep price drop left Moonwell with a net shortfall of roughly $9.13 million.

Source: De.Fi REKT Database. Data as of November 1, 2026.