On August 27, 2026 an attacker pulled roughly $8.7 million out of the Moonwell lending protocol on the Ethereum layer Base without breaking a single line of program code. He pushed up the pri
On August 27, 2026 an attacker pulled roughly $8.7 million out of the Moonwell lending protocol on the Ethereum layer Base without breaking a single line of program code. He pushed up the price of a thinly traded token and posted that inflated holding as collateral for loans. If you have funds sitting in a DeFi lending market, the most important question raised by this case is this: which collateral does your own market accept, and who sets its price?
Moonwell is a lending protocol, an application into which users deposit crypto assets so that other users can borrow against collateral of their own. It runs on Base, the Ethereum layer 2 operated by Coinbase, and ranks there among the larger addresses for interest-bearing deposits.
The protocol's post-mortem dates the attack sequence to August 27, 2026 between 06:09:45 and 09:30:13 UTC. Within those three hours and change the attacker borrowed assets with a gross value of $11,028,762 from four markets, according to the report. The security firms PeckShield and CertiK put the damage at around $8.7 million the same day; Blockaid initially identified 50.6 cbBTC worth more than $4 million flowing out of a single market. The spread between these figures is explained by the cut-off point: the gross amount describes what was borrowed, the lower figures describe what was actually missing after the liquidations.
The following day Moonwell put the remaining borrower obligations from the MAMO market at roughly $9.131 million. That is the sum standing open in the protocol for which there is no longer any solvent debtor.
An oracle is a protocol's price source: the mechanism through which a contract on the blockchain learns what a token is currently worth. Without an oracle a lending market cannot calculate how much a posted collateral covers.
That is exactly where the attack applied its lever. According to the post-mortem, the price of the MAMO token rose from about $0.010597 to a peak of $0.43127363, roughly fortyfold. The highest price Moonwell accepted as valid stood at $0.40248571. MAMO is the token of an AI-assisted finance app on Base and is thinly traded. That means there are few buy and sell orders in the market, and even a medium-sized purchase moves the price appreciably.
Whoever can move such a price also moves the calculation base of the lending market. A holding with a real market value in the low six figures became, in the protocol's bookkeeping, collateral worth millions. The rest was ordinary protocol usage: post collateral, draw a loan, do not repay it.
Moonwell's contracts did what they were written to do. There was no overflowing memory, no forgotten permission check, no injected foreign code. The weakness lay in an assumption: that the observed market price of a token adequately describes its value as collateral. On a widely traded asset that assumption holds. On a thinly traded token it does not.
The borrowing was not done in MAMO but in assets that can be sold immediately. The post-mortem names four markets: cbBTC, WETH, USDC and wstETH. cbBTC is Coinbase Wrapped Bitcoin, a claim on deposited bitcoin that trades on Base. WETH is the tradable contract form of ether, wstETH an interest-bearing variant of it, and USDC a stablecoin pegged to the dollar.
These four markets were not themselves attacked. They were where the inflated collateral was paid out from. According to several reports the attacker then swapped the proceeds into DAI and consolidated them in one address. The price of the two protocol-adjacent tokens gave way over the first 24 hours: on data from CoinGecko and DEX Screener, WELL lost around 13 percent and MAMO about 9 percent.
The timing the protocol itself documents is worth noting: the liquidations kicked in 32 seconds after the last successful loan. The automatic mechanism meant to unwind exactly such positions did work. It simply arrived at a moment when the posted collateral had already lost its price again.
Thinly traded collateral does not carry the weight of real assets: the MAMO price briefly rose fortyfold and then fell back. A borrow cap is the ceiling on how much may be borrowed from a market in total. A supply cap correspondingly limits how much can be deposited. Both values are parameters that a protocol governance can change at any time.
At 10:53:43 UTC an emergency transaction lowered the borrow caps of every core market on Base to 1 wei. Wei is the smallest unit of ether, one quintillionth; a ceiling of that size means in practice that nobody can borrow anything any more. At 11:09:43 UTC the supply cap for MAMO followed, and the cap for the protocol token WELL was set to the same value.
For you as a depositor that carries two practical consequences. New loans are ruled out, so the hole cannot keep growing. Whether you can withdraw your deposit, by contrast, depends on the utilisation of the market in question: a lending market can only ever pay out as much as is not currently lent.
Bad debt in a lending protocol denotes the portion of outstanding loans no longer matched by realisable collateral. It arises when a position loses value faster than liquidation can unwind it, or when the collateral was valued too highly from the outset.
The roughly $9.131 million in open obligations from the MAMO market is precisely that. Here lies the point that makes this case interesting beyond Moonwell: the shortfall is borne by the depositors of the four plundered markets. Anyone who supplied cbBTC, WETH, USDC or wstETH in order to earn interest never touched MAMO and is nevertheless caught in the default, unless the protocol makes it good from its own funds.
There was no pledge of compensation at the time of reporting; Moonwell stated merely that the investigation was continuing. It is therefore open whether the shortfall will be covered from a reserve, from the foundation treasury, or not at all. That uncertainty is exactly why a yield in a lending protocol is not an interest payment in the sense of a bank account. If you want to weigh such default risks against the models of more closely supervised providers, a look at our comparison of the best staking and yield platforms helps, since it sets the models and their safeguards side by side.
Lending protocols organise their markets in two ways. In a core market several assets share a common pot: one collateral can be borrowed against any other asset in that pot. In an isolated market every pair of collateral and borrowed asset is walled off, so that a default stays confined to that single pair.
In the Moonwell incident MAMO belonged to the core markets on Base. That is why collateral consisting of a token with low trading volume could draw out genuine bitcoin and ether holdings, and why the emergency brake then had to cover every core market on the chain rather than only the affected one.
The lesson for you is uncomfortably simple: in a common pot your risk is never smaller than the risk of the weakest collateral admitted there. Anyone supplying USDC while assuming they carry only stablecoin risk has not examined how the market is built.
After the attack the borrow caps of all core markets on Base stood at 1 wei, which rules out new loans in practice. The August incident does not stand alone. In February 2026 a faulty price calculation valued Coinbase Wrapped Ether at around $1.12 instead of roughly $2,200 and left $1.78 million of bad debt according to reports. March 2026 brought a governance attack in which a stake of about $1,800 in MFAM tokens threatened assets worth around $1.08 million.
How many incidents that adds up to depends on the counting. The trade outlet Techtimes speaks of the third disruption in eleven months, Protos of four incidents in a year. What both counts have in common is that the price source stood at the centre twice and the distribution of voting rights once. For your assessment the exact number matters less than the pattern behind it.
Comparable cases have been piling up for weeks. At Ostium on Arbitrum the price source was likewise the way in, and at Ajna v2 around $775,400 drained out through the liquidation calculation in late August, there without any oracle at all. What links these cases is the valuation of thin markets inside contracts that nobody can subsequently halt.
The case is useful to you above all because its cause can be looked up in any other lending protocol. All of the details below are publicly available in the documentation or in the interface of the protocol concerned.
This check costs you half an hour per protocol, once. It replaces no guarantee, but it separates the markets whose risk you know from those whose risk you merely hope about.
A spot oracle reads the price applying at a trading venue in that very moment. A TWAP oracle, short for time-weighted average price, instead forms an average over a time window and thereby renders a brief price spike largely ineffective.
The practical difference shows up in precisely a case like this one. Whoever can drive a price fortyfold for a few minutes immediately gains creditworthiness against a spot price. Against an average over thirty minutes he would have to hold the price up for half an hour, which is incomparably more expensive and frequently makes the attack unprofitable.
In a protocol's documentation you will usually find this detail under oracles, price feeds or risk parameters. If an established price provider with several sources is named there, that is a good sign. If the reference is to a single liquidity pool, you already know the attack path.
For as long as a crypto asset is working inside a lending protocol, you carry that protocol's contract and valuation risk. A holding you do not lend out carries none of it. That is why the split between yield-bearing and dormant holdings deserves a decision of its own rather than being made in passing. Which devices come into question for the dormant part is shown by our hardware wallet comparison.
If you are affected by the incident, secure the evidence now. Note the time, the amounts and the transaction hashes of your deposits and withdrawals while the episode is fresh. Reconstructing events later, when the interface may no longer exist, is considerably more laborious.
For further reading: the post-mortem in the Moonwell governance forum of August 28, 2026 with the full timeline, along with the assessments of the security firms at crypto.news.
(As of August 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
