Moonwell Lost $8.7 Million Without a Single Line of Code Being Hacked

Lending protocol Moonwell lost an estimated $8.7 million to an exploit on Thursday. No smart contract was broken. An attacker simply made MAMO, a small Base token, look far more valuable than it is.

The inflated price let the attacker borrow real assets, including Coinbase Wrapped Bitcoin (cbBTC) and USD Coin (USDC). Security firm Blockaid caught the activity, and Moonwell froze new borrowing within hours. How the Moonwell Exploit Worked The trick was price, not code.

Blockaid reported that the attacker manipulated MAMO collateral pricing to drain cbBTC from Moonwell’s mCBTC market. Its first estimate showed 50.6 cbBTC gone, worth more than $4 million.

Blockaid’s Exploit Detection identified suspicious activity against @MoonwellDeFi on Base.An attacker manipulated MAMO collateral pricing to borrow cbBTC from the mCBTC market.Observed impact so far: 50.6 cbBTC ($4.0M+) drainedMore details to follow.