Moonwell Lost $8.7 Million Without a Single Line of Code Being Hacked

Lending protocol Moonwell lost an estimated $8.7 million to an exploit on Thursday. No smart contract was broken. An attacker simply made MAMO, a small Base token, look far more valuable than it is.

The inflated price let the attacker borrow real assets, including Coinbase Wrapped Bitcoin (cbBTC) and USD Coin (USDC). Security firm Blockaid caught the activity, and Moonwell froze new borrowing within hours.

How the Moonwell Exploit Worked

The trick was price, not code. Blockaid reported that the attacker manipulated MAMO collateral pricing to drain cbBTC from Moonwell's mCBTC market. Its first estimate showed 50.6 cbBTC gone, worth more than $4 million.

MAMO is the token of Mamo, a yield tool built on Base. Every MAMO in existence is worth about $7.6 million combined, and the token trades near $0.011366. A market that small is cheap to pump.

… Continue reading the full article at the original source below.