EN ▼
Favorites
My Favorites
View All
Market Cap Price 24h%

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

Moonwell suffered a $9 million oracle attack on Base chain

2026-08-28 00:25:28
Bookmark

Moonwell suffered an approximately $9 million Oracle Manipulation Attack on Base

Attackers used illiquid MAMO collateral to artificially inflate its price and then lend out higher value assets through lending agreements. The attack cost Moonwell about $9 million.

Attackers pushed the MAMO price from about $0.01 to nearly $0.47 via illiquid markets, and this inflated price was then incorporated into Moonwell's collateral valuation calculations. Early trades drew cbBTC, USDC, wsteTH, and ETH-backed assets from the shared lending pool.

During the attack, at least 50.6 cbBTC pieces worth more than US$4 million were extracted from the cbBTC market alone. As investigators continue to track transaction records on Base, additional borrowing behavior in affected markets has brought preliminary estimates of total withdrawals closer to $9 million.

MAMO prices soar, and lending capacity is inflated.

Moonwell allows MAMO to be used as collateral on Base with a collateral factor of 50%, a supply limit of 20 million MAMOs and a loan limit of 3 million MAMOs.

This configuration means that a sharp increase in the price of the MAMO oracle immediately increases the dollar value of the attacker's collateral. Once MAMO's valuation changes from about $0.01 to nearly $0.47, the same coin position can support much larger loans.

The assets lent come from liquidity provided by other Moonwell users. Instead of cracking the private key or breaking the Base consensus, an attacker can simply manipulate the price used to evaluate collateral and use this inflated valuation to borrow money before the market corrects it.

MAMO has previously been one of the markets where Moonwell has a high usage of Base. For the week ended August 20, MAMO's borrowing accounted for an average of 84.86% of its 3 million token cap.

Moonwell has previously encountered oracle problems

Earlier this year, Moonwell suffered a valuation error due to the cbETH oracle configuration and triggered a mandatory liquidation on Base. The agreement subsequently restored the previous cbETH pricing model and discussed compensation options for affected borrowers.

In 2026, other lending markets have also encountered oracle manipulation attacks. In July, Bonzo Lend's SAUCE price was manipulated, causing attackers to lend millions of dollars in USDC and wrapped HBAR based on just a few dollars worth of collateral, resulting in a loss of approximately $9.05 million.

In addition, the 42DAO suffered a $915,000 oracle attack. The attacker took advantage of abnormal BTCB prices to trigger liquidation without the protocol setting up sufficient deviation control mechanisms.

The Base lending pool absorbs withdrawn funds

Moonwell is one of the largest lending apps on Base, with a separate market for USDC, WETH, cbBTC, wstETH and other mortgage and lending assets. The attack affected the available liquidity in these shared markets rather than directly attacking user wallets.

The cbBTC portion alone removed more than $4 million in bitcoin-backed liquidity, while the remaining transactions targeted USDC and Ethereum-related assets while the inflated MAMO valuation remained in effect.

The incident occurred four days after KiiChain suspended its network due to another EVM module vulnerability. This major loss was added to the continuous protocol attacks in August.

The Base configuration announced by Moonwell shows that the mortgage factor of MAMO is 50%, the market supply limit is 20 million MAMOs, and the loan limit is 3 million MAMOs.

Disclaimer:

All content published on this website, including hyperlinks, related applications, forums, blogs, and other media accounts, originates from third-party platforms and their users. CoinMarketInsight makes no representations or warranties of any kind regarding the website or its content. All blockchain-related data and materials are provided for informational and research purposes only and do not constitute financial, legal, or investment advice. Users and third parties are solely responsible for the content they publish. CoinMarketInsight shall not be liable for any losses arising from the use of this website. You should exercise caution and conduct your own independent research, review, analysis, and verification before making any decisions.

Read Full Article
More News
TOP

TOP