Moonwell loses $8.7 million after attacker inflates MAMO price on Base

Moonwell, a DeFi lending protocol on Base, suffered an $8.7 million loss after an attacker artificially inflated the price of MAMO, a low‑value token, and used the false valuation as collateral to borrow high‑value assets.

How the exploit worked

The attacker pumped the price of MAMO on thin markets, causing Moonwell’s price oracle to report a much higher value. With the inflated price, the attacker was able to borrow assets from Moonwell’s markets, including Coinbase Wrapped Bitcoin (cbBTC) and USD Coin (USDC). The initial estimate showed 50.6 cbBTC, worth over $4 million, removed from the protocol.

Immediate response

Moonwell froze new borrowing by setting borrow caps for all Core Markets on Base to one wei, effectively halting further loans while allowing withdrawals. Supply caps for MAMO and the governance token WELL were also reduced to one wei.

Loss assessment

Security firm Blockaid first reported the suspicious activity, and PeckShield later confirmed total losses of $8.7 million, now held in DAI at a specific wallet address. The loss exceeds the total market value of all existing MAMO tokens.

Historical context

Moonwell has previously suffered losses due to oracle price errors, including $3.7 million in November 2025 and $1.78 million in February 2026, bringing cumulative bad‑debt from pricing failures to over $14 million in ten months. Similar design‑related exploits have affected other DeFi projects.

Next steps

Moonwell plans to release further updates, including the final bad‑debt figure after MAMO’s price stabilizes and the remaining balances of cbBTC and USDC available for suppliers.