Decentralized lending protocol Moonwell lost between $8.7 million and $9 million on August 27, 2026, after an attacker manipulated the price of the illiquid MAMO token on the Base network. The attacker spent $7 million to pump MAMO's price eightfold, using the inflated collateral to borrow high-value assets like cbBTC and USDC before converting the proceeds to DAI. In response, Moonwell froze borrowing by slashing borrow caps to 1 wei. This marks Moonwell's fourth pricing-related exploit in ten months.
Moonwell MAMO price manipulation exploit
- ▪The AI-powered personal finance application Mamo stated that its own smart contracts were not compromised or hacked during the August 27, 2026 exploit
- ▪Blockchain security firm Blockaid first flagged the suspicious activity against Moonwell's mCBTC market, observing an initial drain of 50.6 cbBTC worth over $4 million
- ▪The decentralized lending protocol Moonwell lost approximately $8.7 million to $9 million on August 27, 2026, after an attacker manipulated the price of the MAMO collateral token on the Base network
- ▪The exploit drained high-value assets from Moonwell's depositor liquidity, including Coinbase Wrapped Bitcoin (cbBTC), USD Coin (USDC), Wrapped Ether (WETH), and Wrapped Staked Ether (wstETH)
Oracle vulnerability thin markets
- ▪The MAMO token had a market capitalization of about $6 million to $7.6 million and a low 24-hour trading volume of roughly $1.18 million before the August 27, 2026 attack
- ▪Prior to the exploit, Moonwell's MAMO market operated with a borrow cap of 3 million tokens, a supply cap of 20 million tokens, and a collateral factor of 50%
- ▪The attacker manipulated the price of the illiquid MAMO token on Base, driving its value up nearly eightfold from approximately $0.0105 to around $0.088
- ▪The exploit succeeded because Moonwell's price oracle read the artificially inflated spot price of MAMO from thin underlying trading pools rather than detecting the manipulation
Attacker profit mechanics
- ▪Security firm ExVul reported that the attacker spent $7 million buying MAMO to pump its price and later sold back $3.2 million, incurring a $3.8 million loss on the token trades
- ▪The attacker consolidated the stolen proceeds into 8,728,318 DAI at an Ethereum address that was originally funded on August 21, 2026, with 0.1 ETH from Tornado Cash
- ▪The attacker used the inflated MAMO collateral to borrow roughly $10 million in real assets from Moonwell, securing a net profit of approximately $6 million
Emergency one wei borrow caps
- ▪Moonwell set the supply caps for both MAMO and its native governance token, WELL, to 1 wei to prevent users from depositing more of those tokens
- ▪Following the exploit, Moonwell's native governance token, WELL, fell by approximately 13% over a 24-hour period, trading around $0.0032
- ▪In response to the exploit, Moonwell set the borrow caps for all core markets on Base to 1 wei, effectively freezing new borrowing across the entire deployment
Moonwell recurring security incidents
- ▪Moonwell suffered a pricing discrepancy during an October 10, 2025 market crash that led to $12 million in liquidations and $1.7 million in bad debt
- ▪The August 27, 2026 exploit marks Moonwell's fourth pricing-related security incident within a ten-month period, totaling over $14 million in cumulative losses
- ▪In November 2025, a spot-price oracle manipulation involving the wrsETH/ETH oracle following a Balancer hack resulted in $3.7 million of bad debt for Moonwell
- ▪On February 15, 2026, a misconfigured cbETH oracle that listed Anthropic's Claude Opus 4.6 as a commit co-author priced cbETH at $1.12 instead of $2,200, causing $1.78 million in bad debt for Moonwell
Story comments
Loading comments…