Moonwell was hit by an estimated $9 million oracle manipulation attack on Base after exploiters inflated the price of thinly traded MAMO collateral and used the artificial valuation to borrow
Moonwell was hit by an estimated $9 million oracle manipulation attack on Base after exploiters inflated the price of thinly traded MAMO collateral and used the artificial valuation to borrow higher-value assets from the lending protocol.
The attack pushed MAMO from around $0.01 to nearly $0.47 through low-liquidity markets before the elevated price reached Moonwell’s collateral calculations. Early transactions extracted cbBTC, USDC, wstETH and ETH-backed assets from shared lending pools.
At least 50.6 cbBTC worth more than $4 million was removed from the cbBTC market during the attack. Additional borrowing across the affected markets pushed early estimates of the total extraction toward $9 million as investigators continued tracing the Base transactions.
Moonwell allows MAMO to be used as collateral on Base with a 50% collateral factor, a 20 million MAMO supply cap and a 3 million MAMO borrow cap.
That configuration meant a sharp increase in MAMO’s oracle price immediately increased the dollar value assigned to attacker collateral. Once MAMO was valued near $0.47 instead of roughly $0.01, the same token position could support vastly larger loans.
The borrowed assets came from liquidity supplied by other Moonwell users. The attacker did not need to compromise private keys or break Base consensus. The extraction depended on manipulating the price used to value collateral and borrowing against that distorted valuation before the market could correct.
MAMO was already one of Moonwell’s more heavily utilized Base markets. During the week ending August 20, MAMO borrowing averaged 84.86% of its 3 million-token cap.
Moonwell dealt with a separate pricing failure earlier this year after a cbETH oracle configuration produced incorrect valuations and forced liquidations on Base. The protocol later moved to restore its previous cbETH pricing model while discussing compensation for affected borrowers.
Oracle manipulation has also hit other lending markets in 2026. Bonzo Lend lost about $9.05 million in July after a manipulated SAUCE price allowed an attacker to borrow millions of dollars in USDC and wrapped HBAR against collateral worth only a few dollars.
A separate $915,000 oracle exploit at 42DAO used an abnormal BTCB price to trigger liquidations after the protocol accepted the value without sufficient deviation controls.
Moonwell is one of the largest lending applications on Base, with individual markets for USDC, WETH, cbBTC, wstETH and other collateral and borrowing assets. The attack affected liquidity available through those shared markets rather than user wallets directly.
The cbBTC leg alone removed more than $4 million of Bitcoin-backed liquidity, while the remaining transactions targeted USDC and Ethereum-linked assets as the manipulated MAMO valuation remained active.
The incident came four days after KiiChain halted its network following a separate EVM-module exploit, adding another major loss to a concentrated stretch of August protocol attacks.
Moonwell’s published Base configuration lists the MAMO collateral factor at 50%, with the market capped at 20 million MAMO supplied and 3 million MAMO borrowed.
The post Moonwell Hit by $9M Oracle Manipulation Attack on Base appeared first on Crypto Adventure.
