Moonwell lost an estimated $8.7 million on Thursday to a price manipulation exploit on its Base deployment. An attacker inflated the value of MAMO, a small-cap token, and used it as collateral to drain real assets including Coinbase Wrapped Bitcoin (cbBTC) and USDC.
The attack exploited Moonwell's oracle by manipulating MAMO's price on thin markets before posting the token as collateral at the inflated value. MAMO, the token for Mamo, a yield tool built on Base, has a combined market value of approximately $7.6 million and trades near $0.011366. This small market cap made it vulnerable to price pumps.
Security firm Blockaid identified the activity, estimating 50.6 cbBTC worth more than $4 million was drained from Moonwell's mCBTC market. PeckShield later revised total losses to $8.7 million. Stolen funds are currently held in DAI at a wallet address beginning with 0xD71d.
Moonwell immediately set borrow caps for all Core Markets on Base to one wei, effectively halting new borrowing. Supply caps for MAMO and WELL, Moonwell's governance token, were also reduced to one wei.
Moonwell said an update is forthcoming with specific figures on final bad debt once MAMO's price stabilizes and detail on available cbBTC and USDC for suppliers seeking withdrawals.
