Multi-million dollar hack: Moonwell crypto platform hit by price manipulation
Decentralized lending platform Moonwell has halted borrowing on the Base network following an attack that resulted in approximately $8.7 million in damages. An attacker exploited the low liquidity of the MAMO token to inflate collateral values and withdraw high-value assets.
The decentralized lending platform Moonwell is investigating a significant security incident on its market on the Base network, following warnings from blockchain security firms regarding an attack that caused approximately 8.7 million dollars in damages. According to the crypto security firm CertiK, the incident focused on the cryptocurrency MAMO, a token with relatively low liquidity. It is suspected that the attacker managed to influence the coin's price, use the inflated value as collateral for loans, and withdraw assets with higher liquidity in return. Moonwell confirmed it is aware of the issue and has announced emergency measures to prevent further damage while the investigation continues.
Crypto lending systems rely on assets deposited by users as collateral to secure loans. In this case, the vulnerability lay in the connection between the price of MAMO and the value assigned to the collateral within the system. With low-liquidity coins, even relatively small trading volumes can significantly impact the market price. The attacker exploited this mechanism to artificially increase collateral value, subsequently using it to borrow valuable crypto assets. So far, the withdrawal of over 50 cbBTC, worth more than 4 million dollars, has been reported. Total damages are estimated at approximately 8.7 million dollars.
Moonwell's response was swift: the company lowered loan limits across all its core markets on Base to 1 wei, effectively halting the ability to open new loans. Additionally, deposits of MAMO and WELL, Moonwell's native token, were restricted. This move does not necessarily indicate that the entire Moonwell system or its smart contracts were directly compromised; according to security firms, the incident centered on the manipulation of an asset's price used as collateral. This event highlights a broader challenge in decentralized finance (DeFi): while systems are decentralized and automated, they remain dependent on price data. If this metric can be manipulated, even a lending system operating without a central bank is exposed to significant risk. For users, this serves as a reminder that the technology is still maturing and systems are not yet immune to errors or manipulation.
