Moonwell investigates $8.7 million vulnerability affecting MAMO market…

What happened to Moonwell's MAMO market?

Decentralized lending agreement Moonwell is investigating an incident that affected its MAMO core market on the Base Chain. Blockchain security companies estimate that attackers stole approximately $8.7 million by manipulating the price of the relatively illiquid MAMO token.

Moonwell responded by effectively freezing its new lending functions in its core markets on the Base Chain during the investigation. The agreement reduces borrowing limits in core markets on all Base Chain to 1 wei, thereby preventing new loans from being generated and limiting potential additional losses. "As a precautionary measure, borrowing caps have been set at 1 wei for all core markets on the Base Chain to prevent new lending behavior and limit the possibility of further losses," Moonwell said. "The supply caps for MAMO and WELL have also been set to 1 wei. All other supply caps remain unchanged." These measures allow Moonwell to restrict further trading activity without completely shutting down all markets on the Base chain. Setting the cap to 1 wei (the minimum denomination commonly used for Ethereum assets) effectively makes it impossible to make meaningful borrowing or deposits in affected markets. Moonwell said it will continue to investigate and release more information in a timely manner as it receives it.

How did attackers steal $8.7 million?

Security companies CertiK and PeckShield independently estimated the damage at approximately $8.7 million. PeckShield said the stolen funds were eventually consolidated into DAI stablecoins on a single blockchain address. The attack apparently revolved around evaluating the price of MAMO as collateral. CertiK alleged that the attackers manipulated the price of MAMO tokens, which had relatively limited liquidity, and then used the inflated collateral value to borrow real cbBTC from Moonwell's mCBTC market. Blockaid also independently identified the same mechanism, further confirming that collateral price manipulation was at the heart of the attack. The attack exposed recurring loopholes in decentralized lending markets when accepting thinly traded tokens as collateral. If an attacker can manipulate the market price used in the loan agreement without investing the same amount of capital, the agreement may temporarily treat the manipulated asset as well above its actual realizable value. This allows borrowers to withdraw higher-quality collateral (such as bitcoin-backed assets or stablecoins) before the price of the manipulated token returns to normal. The value of the collateral left by the agreement may be much lower than the assets lent.

Investor Revelation

The Moonwell incident has turned attention to the quality of collateral rather than just the smart contract code itself. When low-liquidity tokens are accepted as collateral and their pricing mechanisms change faster than risk control responses, lending agreements may face huge losses.

Why did WELL and MAMO fall?

After the incident was reported, Moonwell's WELL token fell by approximately 13% in the past 24 hours, while MAMO fell by approximately 9% over the same period. This response reflects two different risks. WELL holders face concerns about Moonwell itself, including the size of any irrecoverable losses and whether other markets are affected. MAMO holders face an additional problem: the token appears to be directly involved in collateral price manipulation. Moonwell's decision to reduce both MAMO and WELL supply caps also suggests that the agreement is limiting additional exposure to these assets until the cause of the incident is ascertained. Other supply caps remained unchanged, indicating that the restrictions immediately imposed by the agreement focused on borrowing activity and the two tokens most closely related to the incident. For users who have deposited funds in Moonwell, subsequent updates will be critical to determine whether losses are limited to the exploited market, how existing positions will be handled, and whether the agreement can recover some of the transferred assets.

What does this attack mean for DeFi lending?

This incident comes at another difficult time for decentralized financial security. Since April, multiple protocols have suffered attacks totaling more than $600 million, the largest of which involved Kelp DAO, with a loss of approximately $292 million. Moonwell's case is particularly relevant for lending agreements because the collateral market relies on accurate prices and sufficient liquidity under stressful conditions. Accepting smaller tokens can increase lending options and attract more users, but it also widens the gap between the value of the offered collateral and the amount that can actually be sold without causing market fluctuations. Risk control measures such as conservative loan-to-value ratios, borrowing limits and supply caps are designed to reduce this exposure. Its effectiveness depends on whether these restrictions are strict enough to prevent attackers before they attempt to manipulate the underlying market. Moonwell's immediate lowering of the borrowing limit may have prevented further losses, but the focus will now turn to its ex post facto assessment. Investors and depositors will pay close attention to the confirmation of final losses, any recovery efforts, and whether collateral or oracle parameters will be revised before normal lending activity resumes.