Moonwell Loses About $8.7 Million on Base After an Attacker Inflated the Price of Its Own Collateral Token

The lending protocol Moonwell lost roughly $8.7 million on Base on August 27 after an attacker manipulated the market price of MAMO, a thinly traded token accepted as collateral in one of its markets. The security firms CertiK and PeckShield put the loss near that figure. The attacker pushed MAMO's price up sharply, borrowed against the inflated collateral value, and left with liquid assets including cbBTC, USD Coin, wrapped staked ether and ether.

The mechanism is now documented in code. The DeFiHackLabs repository, which maintains executable reproductions of on-chain incidents, published a proof of concept on August 28 labeled Chainlink oracle-source price manipulation of MAMO, and a second commit adding the same test to the collection. The distinction matters. The price feed did not fail: it reported exactly what the market it was reading showed. The failure was the decision to let a token with shallow liquidity secure loans backed by deep liquidity.

Moonwell said it was investigating the affected MAMO market and restricted further borrowing on Base. Several outlets reported that the loss exceeds the protocol's annual revenue and that it is the third security failure at Moonwell inside eleven months. Moonwell has not published a full technical postmortem, and no attribution has been made public.

This fits a recurring pattern in 2026 losses. Audits typically scope the smart-contract code itself. The money is instead leaving through components that operate alongside that code and behave exactly as designed: oracle price feeds, collateral listings, governance keys. Base holds $5.48 billion in decentralized finance (DeFi) value according to DeFiLlama, and its lending markets compete by listing as many tokens as possible, the same competitive pressure that put an illiquid token into a collateral slot in the first place. Rekt News has documented the same category of failure across other protocols this year.