Moonwell Hit by $9M Oracle Manipulation Attack on Base

164 views
Moonwell Hit by $9M Oracle Manipulation Attack on Base

Moonwell was hit by an estimated $9 million oracle manipulation attack on Base after exploiters inflated the price of thinly traded MAMO collateral and used the artificial valuation to borrow higher-value assets from the lending protocol.

The attack pushed MAMO from around $0.01 to nearly $0.47 through low-liquidity markets before the elevated price reached Moonwell’s collateral calculations. Early transactions extracted cbBTC, USDC, wstETH and ETH-backed assets from shared lending pools.

At least 50.6 cbBTC worth more than $4 million was removed from the cbBTC market during the attack. Additional borrowing across the affected markets pushed early estimates of the total extraction toward $9 million as investigators continued tracing the Base transactions.

MAMO Price Spike Inflated Borrowing Power

Moonwell allows MAMO to be used as collateral on Base with a 50% collateral factor, a 20 million MAMO supply cap and a 3 million MAMO borrow cap.

That configuration meant a sharp increase in MAMO’s oracle price immediately increased the dollar value assigned to attacker collateral. Once MAMO was valued near $0.47 instead of roughly $0.01, the same token position could support vastly larger loans.

The borrowed assets came from liquidity supplied by other Moonwell users. The attacker did not need to compromise private keys or break Base consensus. The extraction depended on manipulating the price used to value collateral and borrowing against that distorted valuation before the market could correct.

MAMO was already one of Moonwell’s more heavily utilized Base markets. During the week ending August 20, MAMO borrowing averaged 84.86% of its 3 million-token cap.

Moonwell Has Faced Oracle Problems Before

Moonwell dealt with a separate pricing failure earlier this year after a cbETH oracle configuration produced incorrect valuations and forced liquidations on Base. The protocol later moved to restore its previous cbETH pricing model while discussing compensation for affected borrowers.

Oracle manipulation has also hit other lending markets in 2026. Bonzo Lend lost about $9.05 million in July after a manipulated SAUCE price allowed an attacker to borrow millions of dollars in USDC and wrapped HBAR against collateral worth only a few dollars.

A separate $915,000 oracle exploit at 42DAO used an abnormal BTCB price to trigger liquidations after the protocol accepted the value without sufficient deviation controls.

Base Lending Pools Absorb the Extraction

Moonwell is one of the largest lending applications on Base, with individual markets for USDC, WETH, cbBTC, wstETH and other collateral and borrowing assets. The attack affected liquidity available through those shared markets rather than user wallets directly.

The cbBTC leg alone removed more than $4 million of Bitcoin-backed liquidity, while the remaining transactions targeted USDC and Ethereum-linked assets as the manipulated MAMO valuation remained active.

The incident came four days after KiiChain halted its network following a separate EVM-module exploit, adding another major loss to a concentrated stretch of August protocol attacks.

Bitcoin coin symbol
Btc
Bitcoin
$77.268
price
red chart
decrease symbol0.51901%
price change
TRADE NOW

Moonwell’s published Base configuration lists the MAMO collateral factor at 50%, with the market capped at 20 million MAMO supplied and 3 million MAMO borrowed.

Previous

Machi Big Brother Offers $1M to Revive Friend.tech as FRIEND Surges 3,000%

Next

Manpreet Kohli Loses UK Extradition Fight Over Saitama Fraud Case

Written by

glenn nästa

Glenn Nasta

@glennnasta

450 posts

Glenn is a long-time crypto enthusiast and active day trader. He quickly acknowledged the potential of blockchain technology and the benefits of decentralization. Glenn believes in a future where blockchain technology and decentralization will govern and provide financial freedom.

VIEW AUTHOR

Publish your own article

Guest post article. Guaranteed publishing with just a few clicks

START PUBLISHING ADVERTISE WITH US

Browse categories

Explore trending topics in the crypto community right now.

Bitcoin

JPMorgan Forecasts 10% Annual Bitcoin Returns, Outpacing Stocks and Gold

JPMorgan Asset Management has introduced a 10% annualized return forecast for Bitcoin in its 2027 Long-Term Capital Market Assumptions, placing the cryptocurrency ahead of U.S. large-cap equities, gold and several traditional asset classes over the next 10 to 15 years. Released on October 19, the 31st edition marks JPMorgan's first formal inclusion of Bitcoin in its long-term return projections, extending the bank's institutional investment framework into cryptocurrency. The 10% base-case assumption exceeds the bank's 7.5% annual forecast for U.S. large-cap...

Bitcoin and Ethereum Plunge as Hot U.S. CPI Sparks Nearly $1 Billion in Crypto Liquidations

Bitcoin and Ethereum extended their losses on October 15 after hotter-than-expected U.S. inflation data rattled financial markets, triggering nearly $1 billion in cryptocurrency liquidations as leveraged traders faced another wave of forced selling. Bitcoin fell toward $80,000, trading around $81,000 after retreating from levels above $83,000 before the inflation release. Ethereum suffered heavier losses, dropping more than 6% over 24 hours to approximately $2,365. The sell-off followed the October 14 release of September's Consumer Price Index (CPI), which showed annual...

Standard Chartered Launches Bitcoin and Ethereum Trading for Wealthy UAE Clients

Standard Chartered has launched cryptocurrency trading for affluent clients in the United Arab Emirates, allowing eligible investors to buy and sell Bitcoin and Ethereum directly through their existing bank accounts. The October 14 launch marks the bank's first cryptocurrency trading offering for wealth clients globally and the first such service introduced by an international bank in the UAE. The offering has received licensing approval from Dubai's Virtual Assets Regulatory Authority (VARA) and initially targets customers classified as Professional Investors. Transactions,...

Strategy Buys 250 Bitcoin and Repurchases $192M in STRC as Holdings Reach 848,250 BTC

Michael Saylor's Strategy has acquired another 250 Bitcoin and repurchased approximately $192 million of its STRC preferred stock, continuing to deploy capital across its cryptocurrency treasury and securities repurchase programs. The October 12 corporate disclosure puts Strategy's total holdings at 848,250 BTC as of October 11, alongside approximately $5.5 billion in combined U.S. dollar reserves and deployable cash. The latest Bitcoin purchase cost $21.5 million, with $21 million funded through sales of MSTR common shares and another $500,000 drawn from...

MORE ARTICLES

Ethereum

Abstract Ethereum Layer 2 to Shut Down on December 15 With $47.9M Still Secured

Abstract, the consumer-focused Ethereum Layer 2 backed by Pudgy Penguins parent Igloo Inc., will shut down on December 15, 2026, ending a nearly three-year effort to build a blockchain around consumer crypto. Users must move their assets before the deadline through Abstract’s official Migration Hub or native bridge. Assets remaining on the network after December 15 will become inaccessible. The native bridge currently carries an expected withdrawal delay of roughly three hours. The October 6 wind-down notice also warned users...

Ledger Patches Ethereum Signing Flaw Before Researchers Disclose It

Ledger has patched a vulnerability in its Ethereum hardware-wallet app that could allow a malicious dApp to replace a transaction during the approval process while the device continued showing users the transaction they originally reviewed. Security firm TestMachine disclosed the signature-substitution flaw on August 21 after reproducing it on Ledger hardware. Ledger had already shipped Ethereum app version 1.22.2 on August 12, with its release history listing security fixes for the update. Malicious dApp Could Change the Transaction Before Signing...

Jesse Pollak Pushes Back On Coinbase ETH Selling Criticism, Points To 150K ETH Treasury

Base creator Jesse Pollak has pushed back against criticism that Coinbase is selling ETH while benefiting from Ethereum, pointing to the exchange’s roughly 150,000 ETH corporate position and years of investment across the network. Pollak argued that Coinbase has held about 150,000 ETH through multiple market cycles, while describing the company as the largest ETH holder outside dedicated digital asset treasury companies by a wide margin. Coinbase’s latest regulatory filing backs up the scale of that position. The company held...

Tornado Cash Phishing Frontend Drains 1,010 ETH From User

A crypto user lost 1,010 ETH after following an old Tornado Cash bookmark into a phishing frontend that captured the private withdrawal credentials needed to access the deposited funds. The victim deposited the ETH into legitimate Tornado Cash contracts, but the malicious interface obtained the private note generated during the process. The attacker then used those credentials to withdraw the assets within roughly 12 hours without compromising the underlying Tornado Cash smart contracts. Phishing Frontend Targeted Private Withdrawal Notes Tornado...

MORE ARTICLES

Trading

5 Best Crypto APIs for Trading Bots in 2026

A crypto trading bot is a chain of dependencies. It reads a position, prices it, decides, places an order, and confirms settlement. Every one of those steps is an API call, and a failure at any single step stops the strategy. The provider choice shapes what a bot can actually do more than the strategy logic does. The common mistake is searching for one API that covers everything. No such API exists in 2026. Market data providers do not route...

Best Prediction Markets Alternatives: Outpoll, Limitless, Myriad, Manifold

Polymarket and Kalshi helped turn prediction markets into a mainstream trading category, but neither platform fits every trader. Access varies by country, market selection can lean heavily toward certain topics, and the tools available for entering, managing, and automating positions differ sharply across platforms. The strongest alternatives are not identical copies. Some emerging prediction markets platforms focus on professional order controls, some concentrate on fast crypto and financial markets, and others use onchain infrastructure or play-money forecasting. Users unfamiliar with...

How to Get a Funded Crypto Trading Account in 2026 Step by Step

A funded crypto trading account gives a trader access to more notional capital after they prove they can follow a firm’s risk rules. The usual route starts with a paid crypto prop firm challenge that requires a profit target without breaching daily or overall loss limits. Passing is not only about making money. Drawdown control, minimum trading days and rule compliance determine whether the account survives. The evaluation fee can be lost, and crypto prop firms use different account models,...

How To Trade Tokenized Stock Perps: Leverage, Funding And Risks

Tokenized stock perps allow traders to take long or short exposure to companies, ETFs and equity indexes through crypto-native derivatives markets. Positions can use stablecoin collateral, remain open without an expiry date and continue trading when the main stock exchange is closed. The trader receives price exposure, not ownership of the referenced shares. The interface often looks identical to a crypto perpetual futures market. The risk does not. A stock-linked contract can remain active overnight, through weekends and during holidays...

MORE ARTICLES

Tech

Trade.xyz Restores GitBook Docs After Security Incident

Trade.xyz, the Hyperliquid-based trading platform offering perpetual futures tied to stocks, indexes and commodities, has restored its technical documentation following unauthorized activity on its GitBook pages, while maintaining a warning against clicking links as investigators assess the breach. The November 2 incident affected the platform's documentation infrastructure, with the team restoring its previous version by 9:15 a.m. Eastern Time (14:15 UTC). Trade.xyz has not reported any confirmed losses, trading interruptions or disruption to on-chain settlements, although it has yet to...

Mercado Bitcoin Says $38M Hit, $11.2M in Assets Frozen

Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, has suspended operations following a security breach involving approximately $38 million in digital assets, with $11.2 million already frozen as investigators trace suspicious transfers across multiple blockchains. The incident occurred on November 2, when attackers allegedly gained control of wallets associated with the exchange and transferred substantial cryptocurrency holdings to newly created addresses. Mercado Bitcoin initially suspended deposits and withdrawals before temporarily taking its platform offline. The company maintained that customer assets...

Kraken Restores Spot, Derivatives Trading After Outage

Cryptocurrency exchange Kraken restored trading services on October 30 after a widespread connectivity outage disrupted access to its spot and derivatives platforms for approximately one hour, preventing some customers from placing and managing orders. The incident began at 02:42 UTC and affected web and mobile applications alongside REST, WebSocket and FIX connections used by automated trading systems. Kraken confirmed that the disruption was resolved at 03:42 UTC, returning its affected trading services to normal operation. The outage occurred amid heightened...

Binance Hack: $6.3B Affected, $3B in Assets Frozen

Binance has confirmed a major security breach affecting approximately $6.3 billion in digital assets, with nearly $3 billion frozen as the cryptocurrency exchange works with blockchain networks, stablecoin issuers and law enforcement to contain what could become the largest crypto theft on record. The October 30 disclosure follows suspicious withdrawals totaling an initial $2.77 billion across five blockchains the previous evening. Binance's preliminary investigation indicates that attackers may have compromised a DevOps engineer's laptop, gained access to an internal service...

MORE ARTICLES