Moonwell loses up to $9M on Base after attacker inflates MAMO collateral

An attacker manipulated the price of MAMO on Moonwell’s Base lending market on Wednesday and used the inflated collateral to borrow real assets that it never repaid.

The losses are estimated to be in the range of about $4 million to $9 million. The attack drained cbBTC, USDC, wstETH and ETH out of real depositor liquidity.

Who attacked Moonwell?

Moonwell, a decentralized lending protocol, has suffered its third security incident in nine months.

An attacker manipulated the price of the illiquid MAMO token on Moonwell’s Base lending market, driving its value up about eightfold from around $0.0105 to nearly $0.088 and allowing them to borrow real crypto assets like cbBTC, USDC, wstETH, and ETH against inflated collateral that was never repaid.

The security firm ExVul says the attacker spent about $7 million buying MAMO to force the price up, then sold roughly $3.2 million of it back, taking a loss of close to $3.8 million on the token trades alone.

The loss was a calculated cost that let the attacker borrow around $10 million in real assets from Moonwell, leaving a net haul of roughly $6 million.

… Continue reading the full article at the original source below.