Moonwell Card

Documented events with consequences still open. Each entry carries a source and a date.

1. Aug 27, 2026 Hack / funds theft Severe $9M ● open

   Oracle manipulation on the MAMO market (Base): $8.7M drained from the lending protocol, new borrowing frozen across all Core Markets

   On 27 Aug 2026 an attacker manipulated the price of the illiquid MAMO token used as collateral on Moonwell's Base market. Per the official post-mortem on the governance forum (Anthias report, evidence cutoff Base block 50,524,962, 27 Aug 14:01 UTC): starting from $1.947M in USDC, they sent 53.4M MAMO directly to the mMAMO contract, inflating the exchange rate ~3.68x without tripping supply caps, then pushed the oracle price from $0.0106 to $0.43 by buying MAMO into thin liquidity; they borrowed $11,028,762 across cbBTC, WETH, USDC and wstETH and exfiltrated $8.728M in DAI to Ethereum (estimated net gain $6.785M). Neither cryptography nor contract code was breached: this was an economic attack on the oracle. Liquidators recovered nearly all mMAMO collateral (735.6M tokens), but roughly $9.1M of residual bad debt remains on the protocol's books. As an emergency measure Moonwell set the borrow caps of ALL Core Markets on Base to 1 wei (new borrowing effectively frozen) along with the MAMO and WELL supply caps. On 28 Aug the team retained security firm ZeroShadow for recovery efforts. What matters for the card: its spend-against-collateral feature relies on borrowing in that same Moonwell Base market, frozen for as long as the caps stay at 1 wei. Several independent outlets note this is the protocol's third security incident in 11 months.

   ↗ source
2. Feb 15, 2026 Withdrawals halted Severe $2M ● open

   cbETH oracle misconfiguration after proposal MIP-X43: cascading liquidations on Base and Optimism, $1.77M of bad debt and cbETH suppliers still unable to withdraw

   On 15 Feb 2026 at 18:01 UTC the execution of proposal MIP-X43, which enabled Chainlink OEV wrapper contracts across the Base and Optimism Core Markets, introduced a faulty cbETH oracle configuration: instead of multiplying the cbETH/ETH feed by the ETH/USD price, the system used the raw exchange rate, pricing cbETH at about $1.12 instead of roughly $2,200. Per the official post-mortem published on the governance forum by Anthias Labs (the protocol's risk manager), liquidation bots immediately targeted cbETH-collateralised positions, seizing 1 cbETH for about $1 of debt repaid: many users lost all their collateral while still carrying residual debt, and a smaller number of addresses exploited the distorted price to massively over-borrow cbETH. The discrepancy was detected at 18:05 UTC and the cbETH market's supply and borrow caps were cut to 0.01, but liquidations continued because fixing the oracle required the 5-day governance vote and timelock. The consequences are not closed: in the official reserve report of 24 Aug 2026 the cbETH market on Base is the largest source of bad debt, $1,768,665 against reserves of 2.81 cbETH (~$7,361) and a repayment plan allocating $0.00 to cbETH. Reserve-funded repayment (repayBorrowBehalf) covers only borrowers liquidated between 14 and 18 February: users who merely supplied cbETH without borrowing fall under no stated plan and, on the official forum, still report being unable to withdraw (thread opened 23 Aug, still active on 5 Sep 2026). For the card the link is the same as with the MAMO incident: credit spending relies on Moonwell's Base markets, and cbETH is one of them.

   ↗ source

verified on Sep 6, 2026