Moonwell Exploit Drains $8.7 Million After MAMO Price Manipulation on Base

DeFi lender Moonwell has restricted borrowing across its Base markets after an attacker manipulated the price of MAMO collateral and extracted an estimated $8.7 million in assets.

Unlike a conventional smart-contract hack, the incident appears to have exploited Moonwell's pricing infrastructure rather than protocol code. Security firms CertiK and PeckShield both estimated losses at roughly $8.7 million, while Blockaid initially identified 50.6 cbBTC, worth more than $4 million, leaving the protocol's mCBTC market.

The attacker used MAMO, a relatively illiquid token associated with the Mamo yield platform, as collateral after artificially pushing its market price higher. The inflated valuation allowed significantly more valuable assets to be borrowed against it, including cbBTC, USDC and other liquid tokens. PeckShield later said the stolen funds had been consolidated into DAI.

Moonwell Effectively Freezes New Borrowing

Moonwell responded by lowering borrow caps for all Core Markets on Base to 1 wei, effectively preventing new loans while the incident is investigated. Supply caps for both MAMO and WELL were also reduced to 1 wei, while other supply limits remained unchanged.

The emergency action illustrates how oracle and collateral risks can create losses even when smart contracts themselves function as designed. Similar weaknesses have previously affected other lending platforms. A 2025 KiloEX exploit, for example, caused $7.5 million in losses after attackers exploited weaknesses in its price-oracle system.

The latest attack also comes during an unusually costly period for DeFi security. Crypto protocols lost about $247.4 million in July alone, more than triple June's total, with lending platforms, bridges and wallets all among the targets.

Thin Liquidity Creates a Collateral Risk

MAMO's limited liquidity appears central to the attack. A shallow market makes it easier for relatively concentrated buying to move a token's quoted price, creating problems if a lending protocol accepts that price without sufficient safeguards.

One analysis estimated that the attacker spent about $7 million purchasing MAMO before selling part of the position back for roughly $3.2 million. The trading loss was offset by the higher-value assets borrowed from Moonwell using the temporarily inflated collateral.

[TABLE — PLACE HERE: “Moonwell exploit snapshot.” Include estimated loss: $8.7M; initial Blockaid drain: 50.6 cbBTC/$4M+; network: Base; manipulated asset: MAMO; Moonwell response: borrow caps cut to 1 wei.]

The event follows another recent $8.5 million DeFi exploit at Term Finance, underscoring how protocol risk now extends beyond straightforward coding vulnerabilities.

More broadly, collateralized crypto lending depends on reliable asset pricing because loans are automatically sized against the market value of deposited tokens.

Moonwell has said it is continuing to investigate the MAMO market incident. Security researchers including Blockaid and PeckShield have been tracking the affected transactions, while the final recovery prospects remain unclear.