Moonwell Suffers $8.7 Million Loss from Exploit as Supply Cap Bypass Emerges

On Thursday, Moonwell reported a substantial loss amounting to approximately $8.7 million. By Friday morning, the funds were noted to exist within a single Ethereum address, holding roughly 8.73 million DAI. Security firms CertiK and Blockaid attributed the exploit to price manipulation of MAMO, a token with limited trading volume that Moonwell accepted for collateral. According to PeckShield's analysis, the loss stands at $8.7 million. What's particularly alarming is that the attacker bypassed the protocol's supply limit without directly breaching it.

How the Exploit Unfolded

Moonwell has a mechanism that restricts the amount of MAMO that can be deposited through its standard channels, which is enforced at the point of share minting. In a calculated move, an attacker managed to deposit 7.1 million MAMO at 09:12:59 UTC, acquiring a total of 346 million shares in the process. This technique of exploiting limited trading volume is not uncommon in decentralized finance but is concerning for platforms that can't adequately safeguard against such price manipulations. Following this initial deposit, the attacker circumvented the usual deposit channels. At 09:19:59 UTC, another transaction involved sending 34,910,397 MAMO to the market contract, with a subsequent transaction of 18,482,894 MAMO. Each of these transactions was executed using a gas fee of 120,017 but failed to create any shares, indicating a premeditated strategy to inflate the share value without a legitimate process.

Impact on Shares and Borrowing

Moonwell operates on the Compound v2 model, where share value is determined by the total assets in the pool divided by the number of outstanding shares. This means adding a significant number of tokens to the reserves directly affects share value. Before the initial transfer, the market's exchange rate was recorded at 0.0205, and once both sets of transfers concluded, it surged to 0.0755, marking a 3.7 times increase in value. This spike offers a stark illustration of how quickly numbers can shift in decentralized finance. As a direct consequence, the 346 million shares purchased for 7.1 million MAMO suddenly gained access to an estimated 26 million in value, enabling the attacker to borrow assets like cbBTC, USDC, and wstETH against this inflated collateral. If you’re working in this space, it’s a vivid reminder that the mechanics of share valuation can be manipulated, raising unsettling questions about the integrity of collateral assets.

Recurrence of Vulnerabilities

Moonwell has acknowledged the issue via a post on X, asserting that they are currently investigating the breach. They mentioned that “borrow caps for all Core Markets on Base have been set to 1 wei,” effectively halting new borrowing activities to mitigate further damage. But this incident isn't isolated; prior issues have plagued Moonwell, including a significant incident in October 2025 related to price discrepancies that resulted in bad debt. Another oracle malfunction later overvalued wrsETH, allowing further exploits involving the same actor behind previous incidents. Such repeated vulnerabilities expose serious deficiencies in Moonwell's security architecture and risk management—issues that the broader DeFi community can't afford to overlook.

Consequences and Future Safeguards

A contributor proposed implementing automated protective measures back on June 8, including a circuit breaker intended to automatically pause a market if oracle prices significantly deviated from established thresholds. However, this idea garnered little feedback and did not progress to a vote, raising questions on whether it could have prevented the recent exploit. This is where community governance really comes into play; without the right engagement, potential safeguards can slip through the cracks (and this is the part most people overlook). Following the breach, Moonwell’s total value locked plummeted from about $73 million pre-attack to roughly $45 million by Friday morning. Outstanding borrowings, on the other hand, increased. The losses from the exploit dwarf the $1.9 million in revenue the protocol has reportedly generated over the last year, underscoring a precarious situation. Aave recently indicated intentions to strengthen security protocols after experiencing their own vulnerabilities earlier this year, signaling a broader trend in the industry. But are these measures enough?

Echoing concerns, one depositor who faced issues back in February mentioned on August 23 that they were still unable to withdraw funds despite having supplied cbETH. This lack of access not only frustrates users but also undermines confidence in the platform, which is detrimental for any DeFi project aiming to attract and retain users.

Looking Ahead: Industry Implications

The vulnerabilities exposed by this incident could trigger a wave of scrutiny not just for Moonwell but for similar platforms as well. It forces protocols to reevaluate their risk management practices thoroughly. A deeper examination of collateral mechanics, oracle reliability, and deposit limitations will likely come to the forefront of discussions among decentralized finance developers. As the industry scrutinizes these weaknesses, there may be greater interest in formalizing security standards and best practices across the board. Such moves could lead to a more resilient ecosystem, but not without pushing struggling projects to the brink. The specter of regulatory intervention looms, particularly if these issues continue to surface, and developers would do well to maintain transparency to regain user trust. The repercussions of this hack are more significant than they might appear, as they could set the stage for a broader reevaluation of security practices in the DeFi space.

Related Listen: Treasury Puts DeFi On Notice as Roman Storm Trial Drags On