Moonwell lending market on Base hit by suspected exploit tied to MAMO collateral
Security & Exploits ·
An attacker borrowed roughly $9 million in assets from the Moonwell protocol on Base, draining 50.6 cbBTC so far in what security researchers describe as a collateral-manipulation attack.
The incident centers on MAMO, a token used as collateral within Moonwell's lending markets. According to a report shared on X, the attacker exploited pricing of MAMO to borrow against inflated collateral value, extracting close to $9 million in stablecoins and wrapped assets. Separate figures circulating in the same cluster put the loss at approximately $8.7 million, suggesting some divergence in accounting as the situation unfolds, though the underlying mechanism described across reports is consistent: manipulated collateral pricing on MAMO enabled outsized borrowing against Moonwell's reserves.
Moonwell is a lending protocol operating on Base, Coinbase's Ethereum Layer 2 network. Lending protocols like Moonwell allow users to post collateral and borrow other assets against it, with the protocol relying on price oracles to determine how much a given collateral asset is worth. When that pricing mechanism can be manipulated, an attacker can post a comparatively small amount of collateral, have it valued far above its actual worth, and borrow disproportionately large sums of other assets held in the protocol's pools. The described flash-loan-like structure of the attack points to a rapid sequence of transactions used to inflate MAMO's price and extract borrowed funds before the position could be unwound or flagged.
The exploit has drawn scrutiny from security researchers and is now under formal review. The Block reported that Moonwell is investigating an issue affecting its lending market on Base, confirming that the protocol is treating the incident as an active matter requiring examination rather than a resolved event. Security firms had separately flagged the protocol for a multimillion-dollar exploit vulnerability, indicating that concerns about the MAMO collateral setup were identified independently of the attack itself. Coverage of the incident spans five distinct sources, with reported loss figures ranging between roughly $8.7 million and $9 million, and cbBTC withdrawals specifically pegged at 50.6 tokens.
What remains unresolved is the final scope of losses, whether Moonwell will pause the affected markets or freeze MAMO as collateral, and whether any funds can be recovered or the attacker identified. It is also unclear whether the discrepancy between the $8.7 million and $9 million figures reflects different snapshots in time or differing methodologies for valuing the drained assets. Moonwell's ongoing investigation, as confirmed by The Block, is expected to provide more definitive figures and a technical post-mortem in the coming period.