Moonwell halted borrowing across its Base lending markets on August 27 after an attacker manipulated the price of the illiquid MAMO token to extract $8.7 million in real assets, according to security firm CertiK.
The attacker used MAMO as collateral to borrow cbBTC, USDC, wstETH and ETH from Moonwell's core markets. By artificially inflating the MAMO price, the attacker was able to draw loans far exceeding the token's true value. Moonwell responded by implementing supply and borrow caps across affected markets, effectively pausing new lending activity on Base while the protocol investigated the incident.
Moonwell is a cross-chain lending protocol that allows users to deposit crypto assets and earn yields by supplying collateral to borrowers. Base, built on the Ethereum network by Coinbase, has become a hub for DeFi protocols seeking lower transaction costs than mainnet Ethereum. Lending markets on Layer 2 networks like Base have grown substantially, but they often attract experimental tokens with thin liquidity that create price manipulation risks.
The exploit illustrates a recurring vulnerability in lending protocols: the reliance on price oracles that do not account for the liquidity profile of collateral. When a token trades on limited order books or decentralized exchanges with low volume, an attacker can move the price with a relatively small transaction and use that inflated price to borrow real, liquid assets. Moonwell's oracle mechanism apparently did not guard against this dynamic with MAMO.
CertiK flagged the incident as it unfolded, confirming the $8.7 million figure across Moonwell's affected lending pools. Moonwell implemented supply and borrow caps across all markets rather than liquidating positions, preventing further withdrawals of real assets.
The exploit represents the largest single incident on Moonwell since the protocol's launch. Similar price manipulation attacks have targeted other lending protocols on Layer 2 networks, though most have involved smaller amounts or were caught before full execution. Moonwell now faces the task of restoring confidence in its collateral screening process and potentially redesigning how it weighs illiquid tokens in its lending models.
If borrowers begin withdrawing deposits en masse as confidence erodes, Moonwell may face a liquidity squeeze even with real assets still held in reserves. The number that decides whether this remains a contained incident is how many users exit positions in the days following the halt announcement.
