Moonwell has halted new borrowing across its Core Markets on Base after an apparent MAMO collateral price manipulation exploit drained about $8.7 million from the lending protocol.
Moonwell Halts Borrowing After MAMO Exploit
The exploit targeted Moonwell's Core Markets on the Base network, where an attacker manipulated the price of MAMO collateral to extract approximately $8.7 million from the lending pools. Moonwell responded by halting new borrowing across affected markets to prevent further drainage while the team investigates the incident. The attack highlights ongoing vulnerabilities in DeFi lending protocols, particularly those involving collateral price manipulation.
This exploit follows a series of DeFi security incidents this week, including the Term Finance Meta Vaults attack that drained $8.5M. Both incidents demonstrate the persistent risks in DeFi lending markets despite improved security practices across the industry.
Collateral Price Manipulation Targeted
The attack involved manipulating the oracle price of MAMO collateral used within Moonwell's lending markets on Base. By artificially inflating the collateral's value, the attacker was able to borrow more from the protocol than the collateral was actually worth, effectively draining the lending pools of legitimate assets. This type of oracle manipulation attack has been a recurring vulnerability in DeFi protocols, where price feeds can be exploited if they rely on low-liquidity assets or manipulable sources.
Moonwell's Core Markets on Base supported lending and borrowing using various collateral types, including MAMO. The protocol's lending markets are designed to let users supply assets and earn interest while borrowers use their supplied collateral to obtain loans. The exploit exposed a weakness in the price oracle mechanism for MAMO specifically. This incident is part of a broader pattern of crypto security breaches, including the Coldcard hardware wallet hack involving $114M in stolen Bitcoin.
DeFi Security Concerns Persist
The Moonwell exploit adds to a growing list of DeFi security incidents in 2026, highlighting the continued risks faced by lending protocols. The attack on Base's lending market demonstrates that even established protocols on major layer-2 networks remain vulnerable to sophisticated exploitation techniques. Moonwell has not yet disclosed the full technical details of the exploit or announced a compensation plan for affected users.
The protocol's team is working with security researchers and blockchain analytics firms to trace the stolen funds and identify the attacker. The incident may prompt other DeFi lending protocols to review their oracle implementations and collateral listing practices, particularly for lower-liquidity assets that are more susceptible to price manipulation.
