Moonwell MAMO exploit drains $8.7M in cbBTC after collateral manipulation
Another day, another DeFi lending exploit — but this one didn’t need a single line of malicious code. On August 27, decentralized lending protocol Moonwell lost roughly $8.7 million after an attacker figured out how to game the price of one of its own listed tokens, MAMO, and used the inflated collateral to walk away with real bitcoin-backed assets on the Base network. The Moonwell MAMO exploit has reignited scrutiny of how thinly traded tokens can become a backdoor into otherwise well-audited lending markets.
Key takeaways
- Moonwell lost about $8.7 million on August 27 after an attacker manipulated the price of the illiquid MAMO token used as collateral on Base.
- The attacker borrowed real cbBTC against the inflated MAMO collateral, then converted the proceeds into DAI and consolidated everything in one wallet.
- Moonwell set borrow caps to 1 wei across all Base Core Markets and cut MAMO and WELL supply caps to 1 wei to stop further bleeding.
- WELL fell about 13% and MAMO dropped roughly 9% within 24 hours of the attack.
- This is Moonwell’s third security incident in 2026, following an oracle mispricing bug and a governance attack earlier in the year.
Moonwell Suffers $8.7 Million Exploit via MAMO Token Price Manipulation
An attacker drained approximately $8.7 million from Moonwell’s MAMO Core Market by exploiting a weakness that had nothing to do with smart contract code and everything to do with market thinness. MAMO, a relatively illiquid token on Base, turned out to be an easy lever to pull: push its price up artificially, and the protocol’s collateral math follows along.
… Continue reading the full article at the original source below.
