Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH Attackers manipulate MAMO prices to borrow real assets from Moonwell
On Wednesday, an attacker manipulated the price of MAMO tokens on the Moonwell Base lending market, borrowing real assets using elevated collateral and never repaid them. Damage is estimated at between $4 million and $9 million. The attack extracted cbBTC, USDC, wstETH and ETH from the liquidity of real depositors.
Who attacked Moonwell?
Moonwell, a decentralized lending agreement, suffered its third security incident in nine months. The attackers manipulated the price of illiquid MAMO tokens on the Moonwell Base lending market, pushing their value nearly eightfold from approximately US$0.0105 to nearly US$0.088, and used elevated collateral to borrow real crypto assets such as cbBTC, USDC, wstETH and ETH, which were never repaid.
Security company ExVul said the attackers spent about $7 million on MAMO to push up the price, and then sold about $3.2 million of MAMO, losing nearly $3.8 million in token transactions alone. The loss was a calculated cost that allowed the attacker to borrow about $10 million in real assets from Moonwell, resulting in a net profit of about $6 million.
Security company Blockaid first flagged suspicious activity against the mCBTC market, reporting that 50.6 cbBTC (worth more than $4 million) were initially withdrawn. The attacker's wallet then moved most of the stolen funds, holding only about $4600 a few hours later. As the attack is still ongoing, damage estimates change in real time. Blockaid's early estimate was just over $4 million, the lowest valuation; while ExVul put the loss at approximately 71.36 cbBTC, worth approximately $5.7 million. CertiK said nearly $8.7 million had been collected from the attacker's address, while other reports said $9 million had been withdrawn.
Meanwhile, Moonwell's native governance token WELL initially surged about 25%, but then fell back about 13% to about $0.0032. According to DeFiLlama, the total locked value of the agreement is approximately $72.77 million, and the attack is a major blow to both the agreement and depositors.
Moonwell's team acted quickly after the attack to reduce the borrowing limit on the MAMO market to the lowest possible value (1 wei), which basically prevented anyone from using the token to borrow further. They also lowered the supply caps for MAMO and WELL. The attack is currently under investigation.
Is this the first time a security issue has occurred to Moonwell?
Prior to this incident, Moonwell had encountered two oractor-related failures. The first occurred in November 2025, when a spot price manipulation incident classified as oracle manipulation occurred. On February 15, 2026, due to a misconfiguration of the cbETH oracle, the asset price was reported to be approximately US$1.12 instead of approximately US$2200, resulting in an independent bad debt incident of US$1.78 million. The second incident attracted more attention because the related code change listed Anthropic's Claude Opus 4.6 as a co-author of the submission, which sparked discussions about AI-assisted "atmosphere programming" in DeFi.
