The decentralized lending protocol Moonwell, operating on the Base Layer 2 blockchain, fell victim to a cyberattack in which the attacker withdrew approximately $8.7 million in funds. The incident was flagged by specialists at CertiK, a company specializing in smart contract auditing. According to their analysis, the attacker exploited a collateral-related security vulnerability and gained access to the platform's liquidity pools.
The exploitation mechanism, based on preliminary data, involved manipulation of the low-liquidity token MAMO, which was used as collateral. Under this collateral, the attacker borrowed significant amounts of cbBTC, USDC, wstETH, and ETH, leaving the protocol with undercollateralized liabilities. Coinminutes noted that final loss estimates are still being refined and may increase as on-chain transaction analysis is completed.
Various analytical teams have presented differing damage estimates. Early on-chain data indicated a loss of approximately 50.6 cbBTC, equivalent to more than $4 million. ExVul specialists estimated the damage at roughly 71.36 cbBTC (approximately $5.7 million), while CertiK recorded losses at $8.7 million. Several independent observers pointed to a figure of around $9 million, reflecting the complexity of precise assessment amid ongoing transaction analysis.
Moonwell representatives officially confirmed the incident, linking it to the primary MAMO token market. As an emergency measure, developers reduced the borrowing caps on the Base network to a minimum value of 1 wei in order to prevent further accumulation of undercollateralized debt on the platform. Additional restrictions were imposed on the supply of MAMO and WELL tokens to reduce the risk of further manipulation of these assets within the protocol.
The market reaction to the incident was mixed. In the first hours following the attack, the MAMO token showed a rise in price, which analysts attributed to an artificial increase in trading volume. Subsequently, the price corrected, though no significant crash followed. The platform's native token WELL declined by 13%, falling to $0.0032, reflecting holders' concerns over the protocol's security.
This incident marks yet another case of vulnerability exploitation in decentralized finance protocols. Earlier, on August 19, developers of the Maya Protocol were forced to halt the network following a hack that caused approximately $1.7 million in damages. Such events underscore the persistent security risks in decentralized finance, where complex collateralized lending mechanisms create additional vectors for potential exploits.