Moonwell Loses About $8.7M to a Manipulated MAMO Collateral Price

An attacker pushed up the price of a thinly traded token on Base, posted it as collateral at that price, and borrowed real assets against it from the lending protocol Moonwell. Two security firms, PeckShield and CertiK, each put the loss at about $8.7 million. Moonwell said on Thursday that it was investigating and had cut borrow caps across its Base core markets to 1 wei, the smallest unit of ether, which stops new borrowing. No contract was broken open. The prices the contracts read did the damage.

How the collateral was inflated

MAMO trades in thin markets, so a modest amount of buying moves its quoted price a long way. The attacker bought it, drove that price up, and Moonwell's oracle, the price feed a lending protocol uses to value what borrowers post, took the new number at face value. Against that valuation the attacker drew cbBTC, Coinbase's wrapped bitcoin, out of the mCBTC market. CertiK put the sequence in one line on Thursday: "Attacker manipulated relatively illiquid MAMO's collateral price, then borrowed real cbBTC." Coinpedia alone adds USDC, wstETH and ether to the assets taken, and puts the largest single transaction at 14.34 cbBTC, about $1.15 million.

Moonwell's public response was short.

"We are aware of an issue affecting the MAMO Core Market on Base and are actively investigating. As a precaution, borrow caps for all Core Markets on Base have been set to 1 wei, preventing new borrowing," the protocol said.

Supply caps for MAMO and for WELL, the governance token, were set to the same figure. The Block reported that Moonwell had not answered its request for comment.

Three counts of the same loss

The size depends on when it was measured. PeckShield and CertiK both arrived at $8.7 million. Blockaid's earlier alert, cited by BeInCrypto, counted 50.6 cbBTC worth more than $4 million, an early figure. Coinpedia published "over $9 million" on Thursday morning while writing "$8.7 million confirmed drained" inside the same piece. We could not establish a final tally, because none had been published at the time of writing. Four days earlier Term Labs lost an estimated $8.5 million to a governance exploit, which puts the week's two lending losses in one bracket.

How far MAMO went is disputed as well. The Crypto Times timestamps the move at 09:35 UTC and takes the token from about $0.01 to $0.43. Coinpedia describes a move from roughly $0.0105 to $0.088 and calls it eightfold. One of those is a fortyfold jump and the other is not. Neither names its price source. They do not reconcile.

Moonwell has misread a price before

This is the third pricing failure at the protocol in ten months. On 18 February a governance-approved oracle change valued cbETH off its ether ratio alone, printing about $1.12 for a token worth roughly $2,200. Liquidation bots, the automated traders that close underwater loans, took 1,096.317 cbETH and left roughly $1.8 million in bad debt; Cointelegraph put that figure at $1.78 million. The malfunction lasted minutes. In November 2025 a wrsETH feed misfired on Base and Optimism at a cost reported near $1 million. BeInCrypto adds the two earlier cases to $5.48 million, a total no other account reproduces. It stands unverified.

No postmortem, no attacker

Moonwell's lending markets held $53.59 million on Thursday, according to DefiLlama, with $50.3 million of that on Base. WELL fell about 13% over 24 hours and MAMO about 9% on The Block's reading, while The Crypto Times, watching the incident window itself, saw WELL briefly rise around 25%. BeInCrypto reports MAMO's entire market capitalization at roughly $7.6 million, which would put the amount borrowed above the token's whole value. That is one outlet's figure.

The proceeds were converted to DAI and sat at a single address on Thursday, unmoved. Nobody has been identified. August has already produced an $8 million drain at the payments firm Coinsbuy, and the shape here is older than both: thin collateral meeting a trusting price feed. What Moonwell's depositors do not have is a postmortem, a count of the bad debt left behind, or a decision on who absorbs it.